New Critical Exim Mailer Flaw Allows Remote Code Execution

A critical remote code execution vulnerability has been disclosed in Exim, one of the most widely deployed open-source mail transfer agents (MTAs) in the world. The flaw affects specific configurations of Exim and can be exploited by an unauthenticated remote attacker to execute arbitrary code on vulnerable mail servers.

Exim powers a significant proportion of internet-facing mail infrastructure, particularly on Linux and Unix systems, making this disclosure a high-priority patching event for server administrators and email operators globally.

What Is Exim?

Exim is a free, open-source MTA developed at the University of Cambridge and first released in 1995. It is the default MTA on Debian-based Linux distributions and is widely used by:

• Hosting providers and ISPs
• Enterprise email infrastructure
• University and research institution mail servers
• Self-hosted email deployments (cPanel/WHM environments)

Shodan surveys routinely show hundreds of thousands of Exim instances exposed directly to the internet, making vulnerabilities in Exim highly impactful when weaponized.

Vulnerability Details

The newly disclosed flaw allows an unauthenticated remote attacker to send a specially crafted request to a vulnerable Exim server and achieve remote code execution in the context of the Exim process. The vulnerability affects certain configurations of Exim — specific details about which configurations are affected have been disclosed in the Exim security advisory to allow administrators to assess exposure before broad exploitation begins.

Historical Context: Exim Has a Significant Vulnerability Track Record

Exim vulnerabilities have a history of becoming widely exploited due to the software's prevalence on internet-facing servers:

The 2019 "Return of the WIZard" (CVE-2019-10149) flaw was exploited within days of disclosure to install cryptocurrency miners and backdoors on hundreds of thousands of servers. Security teams should treat this new disclosure with similar urgency.

Who Is Affected?

Administrators running Exim in the affected configuration should treat this as a P1 emergency requiring immediate action. The affected configurations were specified in the Exim advisory to enable targeted assessment — if you are unsure whether your deployment matches the vulnerable profile, treat it as affected until confirmed otherwise.

High-risk environments include:

• Hosting providers running cPanel/WHM (which uses Exim as its default MTA)
• Self-managed mail servers on Debian, Ubuntu, or other Exim-default distributions
• Any internet-facing SMTP server running Exim without upstream filtering
• Organizations with Exim instances directly accessible on port 25

Immediate Actions

1. Determine Your Exim Version and Configuration

# Check installed Exim version
exim --version
exim4 --version 2>/dev/null || exim --version
 
# View current Exim configuration
exim -bP | head -50
 
# Check which configurations are enabled
cat /etc/exim4/exim4.conf.template 2>/dev/null || \
  cat /etc/exim/exim.conf | grep -E "^[a-z]" | head -30

2. Check for Available Updates

# Debian / Ubuntu
sudo apt update && apt-cache policy exim4
 
# Red Hat / CentOS / Rocky
sudo yum check-update exim || sudo dnf check-update exim
 
# cPanel environments — update via WHM
# WHM > Upgrade to Latest Version

3. Apply the Patch

# Debian / Ubuntu
sudo apt update && sudo apt upgrade exim4
 
# RHEL / CentOS
sudo yum update exim || sudo dnf update exim
 
# Verify updated version
exim --version

4. Immediate Mitigations if Patching Is Delayed

If an immediate patch application is not feasible, consider the following temporary mitigations:

Restrict SMTP access at the firewall:

# Allow SMTP only from known sending IP ranges
# Block all other inbound connections to port 25 from untrusted sources
iptables -A INPUT -p tcp --dport 25 -s <trusted_ip_range> -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP

Place Exim behind a mail relay or filtering proxy:

• Route inbound SMTP through a filtering MTA or cloud-based spam/malware gateway
• This adds a layer of inspection before traffic reaches the vulnerable Exim instance

Monitor for anomalous Exim process activity:

# Watch for Exim spawning unexpected child processes
watch -n 5 "ps auxf | grep exim"
 
# Monitor Exim logs for unusual SMTP sequences
tail -f /var/log/exim4/mainlog | grep -E "(error|rejected|panic)"

Detection Indicators

Organizations with SIEM or log monitoring should alert on the following in Exim logs:

Patch Cadence and CISA Tracking

Given Exim's historical exploitation patterns and the critical severity of this disclosure, CISA is expected to add a confirmed exploitation indicator to the Known Exploited Vulnerabilities (KEV) catalog if active in-the-wild exploitation is observed. Federal agencies and CISA-compliant organizations should monitor the KEV catalog and apply patches within mandated timelines.

References

• BleepingComputer — New critical Exim mailer flaw allows remote code execution
• Exim Official Website
• CISA Known Exploited Vulnerabilities Catalog
• Related: CVE-2019-10149 — Return of the WIZard

Related Reading

• New Exim BDAT Vulnerability Exposes GnuTLS Builds to
• Critical Unpatched GNU Telnetd Flaw (CVE-2026-32746)
• Over 14,000 F5 BIG-IP APM Instances Still Exposed to RCE