Servers and applications
CVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 10 Jan 2022.
- Severity
- Critical 9.8
- Published
- 5 Jun 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 100% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
EximServers and applications · cpe:a:exim:exim |
|
Known exploited
- CISA name
- Exim Mail Transfer Agent (MTA) Improper Input Validation
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 10 Jul 2022
- Used in ransomware
- Not known