CVE-2019-10149: Exim MTA improper recipient validation leads to remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active inclusion in CISA KEV, near-maximum EPSS score, and public exploit code make this an urgent remote code execution risk.

What it is

Exim versions 4.87 through 4.91 fail to properly validate recipient addresses in the deliver_message() function in /src/deliver.c, allowing command injection. Because Exim is a mail transfer agent, this flaw can be triggered remotely and can lead to full command execution on the mail server.

Impact

An unauthenticated remote attacker can execute arbitrary commands on the Exim server, potentially taking complete control of the host. This can lead to data theft, mail interception, lateral movement, and service disruption.

Attack surface

The flaw is reachable over the network through SMTP handling of a crafted recipient address; the CVSS vector indicates no privileges or user interaction are required. Any internet-facing or internally reachable Exim service in the affected version range is exposed.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-01-10, and EPSS shows a 30-day exploitation probability of 0.99961 (99.975th percentile). Multiple references are tagged as Exploit, confirming public exploit code exists.

What to do

• Upgrade Exim to a fixed version (4.92 or later) or apply the vendor patch for your distribution.
• Apply the Ubuntu, Debian, or other vendor security updates referenced in the advisory.
• Restrict SMTP access to trusted networks where possible and block unnecessary inbound port 25 exposure.
• Monitor Exim logs for unusual recipient addresses or command-like strings in mail transactions.
• If immediate patching is not possible, consider disabling or isolating affected Exim instances.

Detection

• Search Exim logs for recipient addresses containing shell metacharacters or unusual command syntax.
• Monitor for unexpected child processes spawned by the Exim daemon, especially shell or command interpreters.
• Use network detection to flag SMTP transactions with malformed or suspicious RCPT TO values.
• Audit host process creation for Exim spawning non-mail-related binaries.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.