Unprotected COM Objects Enable Local Privilege Escalation

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder with no credential as the server's own event-script host. Because the service does not impersonate the COM caller, Attachments.Add reads any file the

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 on Windows contain a critical authorization bypass vulnerability in their COM object implementation. By registering COM classes without DCOM access controls or launch permissions and initializing security with no security descriptor, the service exposes privileged functionality to any local interactive user—including those connecting via Remote Desktop. This allows attackers to read and write arbitrary files with service account privileges and forge email messages from any sender, fundamentally compromising the confidentiality, integrity, and availability of mail systems and hosted data.

Casky's 283 mapped security skills leverage Claude's extended reasoning to correlate indicators across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners using Casky would detect this attack pattern through findings showing: unauthorized COM object instantiation attempts from unexpected processes, file access patterns consistent with CWE-862 (missing authorization checks), suspicious email queuing from low-privileged contexts, and Registry modifications to COM security settings. The platform's skill coverage enables detection of the reconnaissance phase (process enumeration of running services), exploitation attempts (COM interface activation), and post-exploitation activities (file read/write operations and email forgery)—providing defenders with the contextual intelligence needed to identify and contain hMailServer compromise before attackers establish persistence or exfiltrate sensitive mail data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104660.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-104660

Casky has 283 skills that investigate the attack patterns behind CVE-2026-104660. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn