PatchTheCVE: hmailserverhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-52374: Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to dechttps://patchthecve.com/cve/CVE-2025-52374.htmlhttps://patchthecve.com/cve/CVE-2025-52374.htmlWed, 17 Jun 2026 09:36:26 +0000MEDIUM 4.6: Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServer admin consoles with configured connections.CVE-2025-52373: Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrhttps://patchthecve.com/cve/CVE-2025-52373.htmlhttps://patchthecve.com/cve/CVE-2025-52373.htmlWed, 17 Jun 2026 09:36:26 +0000MEDIUM 4.6: Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.CVE-2025-52372: An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/inhttps://patchthecve.com/cve/CVE-2025-52372.htmlhttps://patchthecve.com/cve/CVE-2025-52372.htmlWed, 17 Jun 2026 09:36:26 +0000MEDIUM 5.1: An issue in hMailServer v.5.8.6 allows a local attacker to obtain sensitive information via the hmailserver/installation/hMailServerInnoExtension.iss and hMailServer.ini components.