PatchTheCVEexim vulnerabilities and fixes
Recent CVEs affecting exim, with upgrade or downgrade steps. 4 tracked.
exim has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-09-19. Highest priority: CVE-2026-94056 (score 35/100).
- CVE-2026-94054 HIGH 7.0 UPGRADE Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write
- CVE-2026-94055 LOW 3.7 UPGRADE Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
- CVE-2026-94056 HIGH 7.5 UPGRADE Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read c
- CVE-2026-94057 MEDIUM 4.0 UPGRADE Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and i
FAQ
How do I fix exim vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is exim being exploited right now?
None of the tracked exim CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which exim CVE should I patch first?
CVE-2026-94056 currently ranks highest (35/100): Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read c.