CVE-2025-26794: Exim SQL injection via SQLite hints and ETRN serialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, no-auth, no-interaction reachability and a very high EPSS probability, though exploitation is constrained to specific non-default configurations.

What it is

Exim 4.98 before 4.98.1 allows remote SQL injection when SQLite hints and ETRN serialization are used. The flaw is a CWE-89 SQL injection reachable over the network without authentication, and the record notes that resolving it requires an update to 4.99.1 in certain non-default rate-limit configurations.

Impact

An unauthenticated remote attacker can inject SQL into the Exim SQLite-backed hint database, with CVSS 3.1 scoring 9.8 (C:H/I:H/A:H), meaning full loss of confidentiality, integrity and availability of the affected component.

Attack surface

Reachable over the network (AV:N) with no privileges (PR:N) and no user interaction (UI:N), per the CVSS vector. Exploitation depends on the deployment using SQLite hints together with ETRN serialization, which the description frames as a non-default configuration.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high at 0.77173 (99.528th percentile), and the references include vendor advisories and patches but no public exploit tag.

What to do

• Upgrade Exim to 4.98.1 or later; if you run the affected non-default rate-limit configuration, upgrade to 4.99.1 as the description states.
• If immediate patching is not possible, disable SQLite hints and/or ETRN serialization where the configuration allows, since the flaw requires both.
• Apply the vendor patch commit referenced in the Exim repository or the equivalent distribution patch (SUSE, OpenBSD ports, NixOS).
• Review Exim configurations for use of SQLite hint databases and ETRN, and treat those hosts as highest priority for patching.
• Monitor vendor advisories for any follow-up guidance on the 4.99.1 requirement.

Detection

• Inspect Exim logs for anomalous ETRN commands and unusual SQL-like strings in SMTP session data.
• Audit SQLite hint database contents and query logs for injected SQL or unexpected schema/table access.
• Alert on Exim versions below 4.98.1 (and below 4.99.1 in rate-limit configurations) present in the environment.
• Correlate network connections to Exim SMTP ports with ETRN usage from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.