CVE-2026-104704: Cleartext Transmission of Sensitive Information in hMailServer

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-08
Weakness: CWE-319

Description

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.

Affected products

Progressive Robot Ltd hMailServer: from 6.0.0 before 6.3.6 — fixed in 6.3.6

How to fix

Upgrade to a fixed version: Progressive Robot Ltd hMailServer 6.3.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-104704 or the next vulnerability affects your stack