CVE-2026-66141
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
Risk Assessment
An attacker can execute code with exim or root privileges, leading to full compromise of the mail server.
Recommendation
Upgrade Exim to version 4.99.5 or later.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
- CVE-2026-48840Medium
Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.
- CVE-1999-0971High
Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.
Original NVD description (English source)
Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.