External risk intelligence

Exim email servers could allow external attackers to gain full server control.

Exim email server software could allow external attackers to execute code, potentially exposing sensitive files, compromising admin access, and causing operational disruption to core messaging infrastructure. Applying available security updates is necessary to secure these critical communication gateways.

NVD published May 12, 2026 (3 days ago)

External risk briefCRITICAL

CVE-2026-45185

Halo Surface Signal

5/ 5

Exim is a Mail Transfer Agent (MTA). By design, MTAs act as internet-facing gateways to receive mail from external servers, making them inherently exposed to the public internet for normal operation.

Exposure facts

CVSS

9.8

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.06%

H – Horizon Alert

A security vulnerability has been identified in Exim email server software regarding how it processes specific incoming data. This flaw allows an attacker to manipulate memory, which could potentially lead to the unauthorized execution of code on the host system. Because this affects core messaging infrastructure, it represents a significant risk to the integrity and security of the affected technology.

A – Asset Exposure

This vulnerability affects Exim mail transfer agents, which serve as essential gateways for organization-wide email communications. Because these systems are typically deployed to face the public internet to facilitate messaging, they are accessible to external network traffic. A successful exploit could allow an unauthorized party to execute code, potentially compromising admin access, exposing sensitive files, or causing significant disruptions to service availability. Protecting these gateways is vital to maintaining the integrity of core communication infrastructure.

L – Live Threat

Security researchers have publicly documented a method that could allow an unauthenticated attacker to achieve remote code execution through specific memory handling errors. Despite this technical disclosure, the available context does not indicate active exploitation or observed targeting in the wild. We are not currently seeing reports of widespread malicious activity or functional exploit code being utilized in real-world attacks.

O – Operational Fix

Please coordinate with your IT and security teams to apply the latest security updates provided by the Exim project. These updates are essential for resolving the identified memory management vulnerability in your email infrastructure. If immediate patching is not feasible, please have your team review the official vendor security advisory to identify any necessary configuration changes or temporary mitigations. Prioritizing these updates will help maintain the ongoing security and stability of your systems.