Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation's Bin folder) as Latin-1 bytes, which the client reads in the system's ANSI code page when it builds a plugin's path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service's account (LocalSystem, or the service's virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin's name, when the installation folder's path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime's wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose greeting names caching_sha2_password by default, the DLL is loaded at the next connection the service makes, whatever plugin the database account uses; a DLL's entry point runs when it is loaded. A path holding any character above U+00FF was handed over as an empty string, whatever the code page, from which the client makes a plugin's name at the root of the current drive: for the service, whose current folder is System32, that is the root of the system drive, where by default only administrators can create a file, but the server's own database commands (hMailServer.exe --check-database, --upgrade-database and the others from 6.3.4, and the /Debug and /Test console modes from 6.2.3) run in the folder they are started from - the product tells administrators to run them from an elevated prompt in the Bin folder, and the setup of 6.3.4 and 6.3.5 ran two or three of them itself with the Bin folder as their working folder for a new installation with an external database - so a DLL that a local authenticated user placed under a plugin's name at the root of a drive other users may write, such as a FAT or exFAT volume, was loaded into the administrator's process at the command's first connection to a MySQL 8.0 or later server. 6.3.8 fixes both cases: it hands the folder in the code page's bytes or by its short (8.3) name, and where neither can be written, a folder under the Windows system folder that holds no plugin and that only administrators can create, or else refuses the connection before attempting it; it never hands the empty value or a folder the current drive completes. The configuration is not the default: the default installation folder, under Program Files, is ASCII. Linux builds set no plugin folder and are not affected.
CVE-2026-126607
“—” beside the score: it is equal to the CVSS score beside it.
Score 7.8 from GitHub Security Advisory (severity: HIGH) published 2026-11-11. A secondary CVSS source baseline 7.8; sources differ by 0.0.
Also known asEUVD-2026-123322 (ENISA EUVD) · GHSA-332h-7rh6-hg9m (GitHub Security Advisories)Source: ENISA EUVD
- High severity, but no confirmed exploitation yet
Upgrade to hMailServer 6.3.8, which on Windows always hands the bundled client its plugin folder in the bytes the client reads it in - the ANSI code page, or UTF-8 where that is the code page - or, where the code page l… (from the CVE record's solution, GitLab Inc.) — apply it.
- CVSS v3
- 7.8
- EG Score
- 7.8HIGHhigh confidence
- EG Risk
- 35EG Risk 35/100
EG Risk is EchelonGraph's 0–100 priority score. It fuses impact severity (EG Severity, the CVSS base score, never the KEV-floored or EPSS-lifted EG Score) with real-world exploitation and automatability, under weights EchelonGraph set by hand, so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner.
How it’s computed (value × EchelonGraph’s weight)Severity78% × 45%Impact severity (EG Severity): CVSS 7.8 of 10. Never the KEV-floored or EPSS-lifted EG Score.Exploitation0.2% × 40%FIRST EPSS: the 30-day exploitation probability when EchelonGraph scored this CVE.Automatability0% × 15%CISA's BOD 26-04 default: no one has published Automatable for this CVE, and CISA treats it as “no” for a CVE not in KEV.SSVC (CISA's decision table, applied by EchelonGraph): Track at low or medium mission impact; Track* at high (mission-essential systems).Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE.Action: Upgrade to hMailServer 6.3.8, which on Windows always hands the bundled client its plugin folder in the bytes the client reads it in - the ANSI code page, or UTF-8 where that is the code page - or, where the code page l… (from the CVE record's solution, GitLab Inc.). Apply it within your standard update timelines. - EPSS PROB
- 0.2%
- EPSS %ILE
- 6th
- KEV
- Not listed
What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)
The EG score (7.8): severity, escalated by confirmed exploitation. This CVE's 7.8 is its impact severity (EG Severity), not escalated.
- EG Severity
- 7.8 HIGHCVSS-B, impact only: no KEV listing, EPSS or EG-KEV tier raises it.GitHub Security Advisory CVSS
- EG Likelihood
- 0.2% within 30 daysSource: FIRST EPSS (model v2026.06.15, score date 2026-11-12). FIRST's exploitation probability, not an EchelonGraph model.
- Confirmed exploitation
- None on record (CISA KEV, EG-KEV Tier 1)Reported apart from the likelihood: an observed fact, not a probability.
- EG Priority
- SSVC Track at medium mission impactTrack at low or medium mission impact; Track* at high (mission-essential systems).CISA BOD 26-04: 14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.Each input and its source, and whom BOD 26-04 binds: the SSVC and BOD 26-04 blocks below.
SSVC (CISA's decision table, applied by EchelonGraph)Track at low or medium mission impact; Track* at high (mission-essential systems).
Upgrade to hMailServer 6.3.8, which on Windows always hands the bundled client its plugin folder in the bytes the client reads it in - the ANSI code page, or UTF-8 where that is the code page - or, where the code page l… (from the CVE record's solution, GitLab Inc.). Apply it within your standard update timelines.
Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE. Mission impact is CISA's Mission & Well-being decision point, and only you can judge it. CISA's table makes it high when Mission Prevalence is Essential — the vulnerable component "directly provides capabilities that constitute at least one MEF for at least one entity" (MEF: mission essential function) — or when Public Well-Being Impact is Irreversible: "multiple fatalities are likely", the cyber-physical system "is likely lost or destroyed", "extreme or serious externalities" are imposed on other parties, or social systems such as elections or the financial grid "are destabilized and potentially collapse". CISA's decision table
BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.
The score's inputs: In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it
Published
November 11, 2026
Last Modified
November 12, 2026
Advisory Details (2)
Auto-updated Nov 11, 2026hMailServer 6.3.8 · hmailserver / hMailServer · GitLab
https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.8Windows: the bundled MySQL client was handed its authentication-plugin folder as Latin-1 bytes, read in the ANSI code page, so an installation path with a character of U+0080 to U+00FF could load a plugin DLL from another folder (6.2.3 to 6.3.7) (#116) · Issues · hmailserver / hMailServer · GitLab
https://gitlab.com/hmailserver/hmailserver/-/work_items/116Vendor Advisories for CVE-2026-126607(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed its CVE.org record (CNA or CISA ADP). An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). "EchelonGraph re-scored" is our own recompute of this CVE's score, not an update from a source, and is not counted in the refreshes above. Most recent first.
- 2026-11-13 16:50 UTCEPSS rescoreEPSS 0.2% · 6th percentile
- 2026-11-12 19:08 UTCEchelonGraph re-scored
- 2026-11-12 19:08 UTCGHSA enrichmentGHSA-332h-7rh6-hg9m · GitHub severity HIGH · GitHub CVSS 7.8
- 2026-11-12 16:33 UTCEPSS rescoreEPSS 0.2% · 6th percentile
- 2026-11-11 16:38 UTCEPSS rescoreEPSS 0.2% · 6th percentile
- 2026-11-11 09:46 UTCEchelonGraph re-scored
- 2026-11-11 09:46 UTCGHSA enrichmentGHSA-332h-7rh6-hg9m · GitHub severity HIGH · GitHub CVSS 7.8
- 2026-11-11 09:28 UTCEchelonGraph re-scored
- 2026-11-11 09:00 UTCENISA EUVD ID recordedEUVD-2026-123322 · Source: ENISA EUVD
- 2026-11-11 08:39 UTCEchelonGraph re-scoredFirst assessed: 7.8 HIGH
- 2026-11-11 08:39 UTCMITRE cvelistV5first tracked
Related CVEs(same CWE)
Frequently asked(5)
What is CVE-2026-126607?
When was the CVE record for CVE-2026-126607 published?
Is CVE-2026-126607 actively exploited?
What is the CVSS score of CVE-2026-126607?
How do I remediate CVE-2026-126607?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-126607
Is Your Infrastructure Affected by CVE-2026-126607?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.