Exim Mail Server Local Privilege Escalation & Arbitrary Command Execution (CVE-2010-4345)
Executive & SecOps Summary
SECOPS ASSESSMENTMail server environments running Exim version 4.72 and earlier
Local attackers or compromised 'exim' service accounts can execute arbitrary system commands with root privileges by specifying a malicious alternate configuration file, leading to full system compromise
Immediately upgrade Exim to a secure version (4.73 or later) and restrict execution permissions on the Exim binary
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade Exim to version 4.73 or later, where the ability of the exim user to specify arbitrary configuration files has been strictly restricted.
# For Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade exim4-daemon-heavy exim4-daemon-light -y
# For RedHat/CentOS-based systems
sudo yum update exim -y2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict access to the Exim binary and disable the use of alternate configuration files by non-root users. Ensure that 'ALT_CONFIG_PREFIX' is defined during compilation to restrict configuration file paths.
# Restrict execution permissions of the Exim binary to trusted groups only
sudo chmod 4750 /usr/sbin/exim
# Verify that no untrusted users belong to the 'exim' system group
getent group exim3. Log Audit & IoC Verification Commands
Use the following commands to check the running Exim version and audit system logs for unauthorized configuration file loading attempts.
# 1. Check the currently running Exim version
exim -bV | grep 'Exim version'
# 2. Scan mail logs for suspicious use of the alternate configuration (-C) flag
sudo grep -E '\-C[[:space:]]+' /var/log/exim4/mainlog /var/log/maillog 2>/dev/null
# 3. Search for suspicious command execution patterns inside configuration files
sudo find / -name '*.conf' -type f 2>/dev/null | xargs grep -i 'spool_directory' | grep -E '(\||\`|\$)'Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability is a critical Local Privilege Escalation (LPE) flaw in the configuration file handling mechanism of the Exim Mail Transfer Agent (MTA). By design, Exim runs with high privileges (often root) to bind to privileged ports and deliver mail. However, in Exim versions 4.72 and earlier, a design flaw allows the 'exim' system user account to specify an alternate configuration file using the '-C' command-line option. When parsing this user-defined configuration file, certain directives such as 'spool_directory' can contain arbitrary commands or macros that Exim executes with root privileges without proper validation (CWE-77).
2. Exploitation Mechanics & Attack Scenario
An attacker first gains initial access to the server as the low-privileged 'exim' user, typically by exploiting a web application vulnerability (e.g., Remote Code Execution or Local File Inclusion in a webmail client). Once local access is established, the attacker creates a crafted configuration file in a writable directory like '/tmp'. This malicious configuration file contains a directive, such as 'spool_directory', embedded with arbitrary shell commands. The attacker then executes the Exim binary pointing to this configuration file: 'exim -C /tmp/evil.conf'. Because Exim starts its initialization process with root privileges, it parses the configuration file and executes the embedded payload as root, granting the attacker an interactive root shell.
3. Infrastructure & Business Impact
This vulnerability is highly critical and is actively tracked in the CISA KEV (Known Exploited Vulnerabilities) catalog. While it requires local access to exploit, it serves as a highly reliable privilege escalation vector for attackers who have established a foothold on a mail or web server. A successful exploit leads to complete infrastructure compromise, allowing attackers to exfiltrate sensitive emails, repurpose the server as a malicious spam relay, deploy ransomware, or pivot deeper into the internal corporate network.
Official Vendor Advisories & References
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
Frequently Asked SecOps Questions (CVE-2010-4345)
FAQQ1. How critical is CVE-2010-4345 and is it actively exploited in the wild?
CVE-2010-4345 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 18.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2010-4345?
Primary impacted vendors include exim across exim. Scope summary: Exim versions 4.72 and all prior versions
Q3. What temporary mitigations or workarounds exist for CVE-2010-4345 before patching?
[Mitigation] Immediately upgrade Exim to a secure version (4.73 or later) and restrict execution permissions on the Exim binary Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2010-4345
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (exim)
View Category →Microsoft Windows Shell Command Injection and Security Feature Bypass (CVE-2026-96951) Advisory
[Affected Scope] All supported versions of Windows OS including Windows 10, 11, and Windows Server.
Apple macOS Screen Sharing Authentication Bypass Vulnerability (CVE-2026-65400)
[Affected Scope] macOS systems running versions prior to Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1/26.7, or Golden Gate 27 with Screen Sharing or VNC services enabled
DAEMON Tools Lite Official Installer Supply Chain Attack and Trojanized Binaries (CVE-2026-8398)
[Affected Scope] DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434 distributed between April 8, 2026, and May 5, 2026
Apple iOS and macOS Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2026-86950) Security Advisory
[Affected Scope] All Apple devices running versions prior to iOS 18.7.11/26.7.1 and macOS Sequoia 15.8.1/Tahoe 26.7.1.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.