CVE-2026-104659

validated

EUVD-2026-94834 ↗

check availablenot proven exploitable

cve.orgpublic pockev

Progressive Robot Ltd hMailServer >= 6.0.0, < 6.3.6

fixed in 6.3.6

CWE-346 Origin Validation Error

ETK-2026-970, permanent identifier

cvss7.5cna vendorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

+2h46mTTV

38mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+2h46magent stopped

+1h

+2h

+3h

description

hMailServer 6.0.0 through 6.3.5 has REST API handling flaws that can permit repeated attempts against the administrator password. An attacker who can cause a browser on the server to access a DNS-rebinding site may obtain administrative control if the REST listener is enabled.

mitigation

Upgrade hMailServer to version 6.3.6. Until upgraded, disable the REST API listener where it is not required.

fixed in 6.3.6

check

available

exploit

automation

deterministic

auth required

EPSS

0.14%3rd percentile

agent run time

38m

cve.org record, t = 0

2026-10-08 10:52Z

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-08 10:52Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-104659

this entry in the feed

GET /api/v1/feed/CVE-2026-104659

{
  "etk_id": "ETK-2026-970",
  "cve_id": "CVE-2026-104659",
  "display_id": "CVE-2026-104659",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-94834",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Origin validation and login throttling flaws in hMailServer",
  "summary": "hMailServer 6.0.0 through 6.3.5 has REST API handling flaws that can permit repeated attempts against the administrator password. An attacker who can cause a browser on the server to access a DNS-rebinding site may obtain administrative control if the REST listener is enabled.",
  "mitigation": "Upgrade hMailServer to version 6.3.6. Until upgraded, disable the REST API listener where it is not required.",
  "vendor": "Progressive Robot Ltd",
  "product": "hMailServer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 6.0.0, < 6.3.6"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.3.6"
      ],
      "package_name": "hMailServer",
      "purl": null
    }
  ],
  "cwes": [
    346
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss_score": 0.0014,
  "epss_percentile": 0.0328,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.79166956666667,
  "t0_at": "2026-10-08T10:52:55.630000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-08T13:39:16.605164+00:00",
      "days": 0.11552054587962964,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T10:52:55.630000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T10:52:55.630000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T10:52:55.630000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104659"
    }
  }
}

published 2026-10-08 13:01Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.