External risk intelligence

hMailServer JScript Event Injection Leading to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-100741

The vulnerability affects an email server (hMailServer) which inherently operates as an internet-facing service for SMTP, POP3, and IMAP protocols. While exploitation requires specific non-default event scripting configurations to be enabled, the primary product role is an externally reachable mail gateway, making it commonly deployed in a manner that faces the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in hMailServer, an email server software, that could allow an unauthenticated attacker to execute arbitrary code with the privileges of the service account. This requires specific, non-default configurations related to event scripting to be enabled, but its potential impact on server integrity is significant. The main concern is confirming relevance and exposure given the specialized configuration needed for exploitation.

Code execution via specially crafted passwords.
Affects email servers facing external access.
Assess if your email server configuration is vulnerable.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted login credentials or error messages to an email server. This would target a JScript event handler that processes these inputs, allowing the attacker to inject and execute arbitrary JScript code within the server's process. This could lead to the execution of commands on the server with the same privileges as the hMailServer service.

Network-accessible email server.
Triggered by specific input in login or error messages.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's specific non-default configuration, an attacker could execute arbitrary JScript within the hMailServer service process. This could occur through specially crafted passwords or server responses during email protocol interactions, potentially leading to command execution with the privileges of the service account.

Arbitrary JScript execution.
Specially crafted input during logon or server reply.
Command execution as service account.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in hMailServer affects the JScript event-script dispatcher, allowing remote code execution within the service process. Ownership will likely fall to the application owners or platform teams managing hMailServer, with coordination from network and security teams to assess exposure. The first practical step is to inventory all hMailServer instances, confirm if event scripting is enabled and configured with JScript, and verify if critical accounts or sensitive data are hosted.

Application owners should own remediation.
Verify event scripting and JScript configuration.
Plan maintenance for affected servers.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is hMailServer and what is it used for?

hMailServer is an open-source, Windows-based mail server application. It manages email infrastructure by handling standard communication protocols like SMTP for sending, and POP3 or IMAP for retrieving messages, serving as a centralized hub for organizations to process and store their electronic mail.

How does CVE-2026-100741 work in plain English?

This vulnerability is an Eval Injection, classified under CWE-95. When hMailServer uses JScript for custom event handling, it fails to properly sanitize specific input characters like backslashes in passwords or error responses. An attacker can use these characters to break out of the intended data format and trick the server into running their own malicious JScript code as if it were part of the legitimate server logic.

Do I need specific settings for CVE-2026-100741 to be triggered?

Yes. This bug is not triggered by default installations. It specifically requires that you have manually enabled event scripting, explicitly set the scripting language to JScript instead of the default VBScript, and defined specific handlers like OnClientValidatePassword, OnExternalAccountDownload, or OnDeliveryFailed.

Why is this a concern for internet-facing email servers?

Halo Surface Signal notes that because hMailServer is designed to process external traffic for SMTP, POP3, and IMAP, it is typically deployed as an internet-facing service. If you meet the non-default configuration requirements mentioned above, the server becomes an reachable entry point for unauthenticated remote attackers to attempt code execution.

Is there a first step to take if I run hMailServer?

The immediate priority is to audit your hMailServer instances to determine if event scripting is enabled and if JScript is the configured language. If these non-default settings are active, you are at risk and should prioritize applying the vendor's provided update to eliminate the code execution path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.