CVE-2019-10149
9.0
CRITICAL
CVSS 3.0
EPSS 100.0% · 100th pctCISA KEV · Exploited in the wildCWE-78Port 25 · SMTPPort 465 · SMTPS (submissions)Port 587 · SMTP Submission
2019-06-05Updated 2025-10-21KEV 2022-01-10
CISA Known Exploited Vulnerabilities
Exim Mail Transfer Agent (MTA) Improper Input Validation is confirmed as actively exploited and is listed in the CISA KEV catalog.
Added to KEV
2022-01-10
Remediation due
2022-07-10
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2019-10149
Description
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Severity
CVSS 3.0 · CNA9 CRITICAL
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impacttotal
Exploitation Context
as of October 13, 2026- CISA added CVE-2019-10149 to the KEV catalog 950 days after its CVE record was published.
- It is one of 5 Exim entries in the CISA KEV catalog, and one of 4 added in 2022.
- Its current EPSS score (100.0%) is higher than that of 94% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| exim | exim exim | 4.92 |
References
20 LinksVendor advisories
Mailing lists
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit
- [oss-security] 20190605 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit
- 20190605 [SECURITY] [DSA 4456-1] exim4 security update
- [oss-security] 20190606 Re: CVE-2019-10149: Exim 4.87 to 4.91: possible remote exploit
- 20190611 The Return of the WIZard: RCE in Exim (CVE-2019-10149)
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2
- [oss-security] 20190725 Re: Statistics for distros lists updated for 2019Q2
- [oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2
- [oss-security] 20210504 21Nails: Multiple vulnerabilities in Exim
Vulnerability databases
Other references
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149
- https://www.exim.org/static/doc/security/CVE-2019-10149.txt
- http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
Record Details
Published
2019-06-05
Last updated
2025-10-21
Assigner (CNA)
redhat
Credited to
-
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.