CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Exim Mail Transfer Agent (MTA) Improper Input Validation
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Affected products
exim: exim; canonical: ubuntu linux; debian: debian linux
References10
- www.exim.org/static/doc/security/CVE-2019-10149.txt Vendor Advisory
- www.exim.org/static/doc/security/CVE-2019-10149.txt Vendor Advisory
- www.openwall.com/lists/oss-security/2019/06/05/3 Mailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2019/06/05/3 Mailing ListPatchThird Party Advisory
- packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-… ExploitThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-… ExploitThird Party AdvisoryVDB Entry
- www.openwall.com/lists/oss-security/2019/06/05/4 ExploitMailing List
- www.openwall.com/lists/oss-security/2019/06/06/1 ExploitMailing ListThird Party Advisory
- packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-… ExploitThird Party AdvisoryVDB Entry
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% percentile: 100 · as of 10 November 2026
- CWE
- CWE-78
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.