Exim Mail Transfer Agent (MTA) Remote Command Execution Vulnerability Analysis and Mitigation Guide (CVE-2019-10149)
Executive & SecOps Summary
SECOPS ASSESSMENTExim mail server versions 4.87 to 4.91 inclusive
Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending specially crafted recipient addresses
Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The most effective remediation is upgrading Exim to version 4.92 or later. Use your operating system's package manager to apply the update immediately.
# For Debian / Ubuntu-based systems
sudo apt-get update && sudo apt-get install --only-upgrade exim4 -y
# For RHEL / CentOS / Rocky Linux-based systems
sudo yum update exim -y
# Or using dnf
sudo dnf upgrade exim -y2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, modify your Exim configuration file (/etc/exim4/exim4.conf or /etc/exim/exim.conf) to reject recipient addresses containing shell metacharacters.
# Add the following rule under the acl_check_rcpt section
deny
domains = +
local_parts = ^[./|] : ^.*[@%!/|]
message = Invalid recipient address format
# Restart the Exim service to apply changes
sudo systemctl restart exim4 || sudo systemctl restart exim3. Log Audit & IoC Verification Commands
Verify the running Exim version and inspect mail logs for potential exploitation attempts containing the ${run pattern.
# 1. Check the currently running Exim version
exim -bV | head -n 1
# 2. Search mail logs for indicators of compromise (IoCs)
sudo grep -E '\$\{run\{' /var/log/exim4/mainlog /var/log/exim/mainlog 2>/dev/nullStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-10149) is a critical remote command execution (RCE) flaw in Exim, a widely used open-source Mail Transfer Agent (MTA). The root cause lies in the improper validation of recipient addresses within the deliver_message() function in /src/deliver.c. This lack of sanitization allows an attacker to inject malicious shell commands into the recipient address field, leading to OS Command Injection (CWE-78).
2. Exploitation Mechanics & Attack Scenario
An attacker initiates an SMTP connection to the target Exim server and transmits a crafted RCPT TO command containing shell expansion syntax (e.g., using ${run{...}}). In default configurations, local attackers can exploit this immediately for local privilege escalation. For remote attackers, the command is executed with root privileges when the server attempts to deliver the message locally and triggers the vulnerable deliver_message() function. With an EPSS score of 0.9996 and inclusion in the CISA KEV catalog, this vulnerability has been heavily exploited in the wild by botnets and cryptominers.
3. Infrastructure & Business Impact
Exim is a backbone component of global email infrastructure. With a CVSS score of 9.8 (Critical), successful exploitation grants attackers complete control over the mail server. This can lead to the theft of sensitive corporate communications, lateral movement within the internal network, and the compromise of IP reputation as the server is co-opted into spam-sending botnets.
Official Vendor Advisories & References
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Frequently Asked SecOps Questions (CVE-2019-10149)
FAQQ1. How critical is CVE-2019-10149 and is it actively exploited in the wild?
CVE-2019-10149 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-10149?
Primary impacted vendors include exim across exim. Scope summary: Exim versions 4.87, 4.88, 4.89, 4.90, and 4.91
Q3. What temporary mitigations or workarounds exist for CVE-2019-10149 before patching?
[Mitigation] Immediately upgrade Exim packages to a patched version (4.92 or higher) and apply temporary configuration workarounds Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-10149
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (exim)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089) Security Advisory
[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808) Advisory
[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.