Exim vulnerabilities in CISA KEV
Exim has 5 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 46th highest of any vendor. none were added in the last 12 months; 1 is linked to known ransomware use (20% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 14 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Exim, with 3 entries. Other frequently affected products: Exim Internet Mailer (1); Mail Transfer Agent (MTA) (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor exim --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
5
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2022-03-25
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
1 of 5
20% linked to ransomware
┌─ distinct products
3
affected products
$ awk -F, {print $1} /var/log/kev/exim.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 1 |
| 2022 | 4 | 0 |
$ sort /var/log/kev/exim.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Exim 3 entries
- Exim Internet Mailer 1 entry
- Mail Transfer Agent (MTA) 1 entry
$ kev-due-dates --vendor exim
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Exim
21 days (range 14 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/exim.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (5 of 5 have at least one CWE).
$ grep -ril 'Exim' /var/log/news | head -5
Our reporting that names Exim or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./exim.kev · 5 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2010-4344
Exim
Exim Heap-Based Buffer Overflow Vulnerability
due 2022-04-15 · CWE-119
$ cat CVE-2010-4344.txt
Description. Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
Required action. Apply updates per vendor instructions.
- CVE-2010-4345
Exim
Exim Privilege Escalation Vulnerability
due 2022-04-15 · CWE-264
$ cat CVE-2010-4345.txt
Description. Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
Required action. Apply updates per vendor instructions.
- CVE-2019-16928
Exim Internet Mailer
Exim Out-of-bounds Write Vulnerability
due 2022-03-17 · CWE-787
$ cat CVE-2019-16928.txt
Description. Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Required action. Apply updates per vendor instructions.
- CVE-2019-10149
Mail Transfer Agent (MTA)
Exim Mail Transfer Agent (MTA) Improper Input Validation
due 2022-07-10 · CWE-78
$ cat CVE-2019-10149.txt
Description. Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Required action. Apply updates per vendor instructions.
- CVE-2018-6789
Exim [RANSOMWARE]
Exim Buffer Overflow Vulnerability
due 2022-05-03 · CWE-119
$ cat CVE-2018-6789.txt
Description. Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.
Required action. Apply updates per vendor instructions.