CVE-2026-126624

Fixes and workarounds

Fix

Upgrade to hMailServer 6.3.8, whose setup looks, before it stops the service and again once the folders are hardened, at everything in Bin and ControlPanel, on the program folder's own level, and in Addons, Events, DBScripts, WebAdmin, Languages and MySQL, and refuses with exit code 7 to install where a program, a library, a script, a settings file or a folder there is owned by anybody but SYSTEM, the Administrators or TrustedInstaller, has an owner that cannot be read, or has an entry of its own that lets another account change it, naming each with the icacls that deals with it and a restart of Windows before setup runs again. Until then, install hMailServer under Program Files, or into a new folder inside one that only administrators may change. Before running setup into or over a program folder that other accounts could write, list the owners from an elevated Command Prompt - dir /q /a "<program folder>" and dir /q /s /a over its Bin, ControlPanel, Events, WebAdmin, DBScripts, Addons, Languages and MySQL, as the hMailServer documentation, ServiceAccount.md, "Before upgrading an installation at a drive's root", gives them for all but MySQL - and the entries of their own, with icacls "<program folder>" and icacls "<folder>" /T over the same folders, where an entry not marked (I) that gives anybody but SYSTEM, the Administrators or TrustedInstaller a right to change the item is another account's (the service's own Modify on hMailServerApiKeys.ini in Bin apart); where anybody but those owns anything there, or has such an entry, do not install over it: reinstall into a new folder as that page's "Reinstalling into a new folder" says.