Exim mail server flaw allowed remote code execution without login: update Exim

In May 2026, the Exim maintainers published a fix for CVE-2026-45185, a critical flaw in the Exim mail server reported by XBOW, which named it "Dead.Letter". It was announced on 12 May 2026 with a CVSS score of 9.8 out of 10.

The flaw is a memory error in the way Exim receives a message in chunks over an encrypted connection. According to the Exim advisory, an attacker only needs to open a TLS connection and use the CHUNKING (BDAT) extension, and the CVE record says an unauthenticated attacker could run code on the server. Exim says there is no mitigation other than upgrading. The sources we checked do not report exploitation in the wild.

Exim published more security releases afterwards: 4.99.4 in May, 4.99.5 in July and 4.100.1 on 18 September 2026, which fix less severe problems, including issues for servers using the Proxy Protocol and an SMTP smuggling flaw.

Who is affected

Exim versions 4.97 up to and including 4.99.2, but only builds compiled with GnuTLS. Builds using OpenSSL are not affected by this flaw. Exim is a very common mail server on Linux hosting, so it may be what sends and receives your business email. On shared hosting, the mail server belongs to your host.

How to check your site

• On shared hosting, ask your host which Exim version runs on your server and whether it was updated after May 2026.
• On your own VPS, the command exim -bV prints the installed Exim version. Your distribution or panel vendor may ship a patched package under an older-looking version number, so check their security notices too.

What to do now

1. Ask your host to confirm that Exim is at 4.99.3 or later, ideally 4.100.1 or later, or that their package includes the fix for CVE-2026-45185.
2. On your own server, install the latest Exim update from your distribution or control panel, and enable automatic security updates.
3. If you manage the server yourself and cannot update right away, get help from your provider: Exim lists no workaround, so updating is the only fix.
4. Watch for signs of trouble, such as a sudden spike in outgoing mail or your domain landing on spam blocklists.

Hosts usually roll out Exim fixes quickly through their regular updates, so a server updated since May 2026 is most likely protected against this flaw, but it is worth confirming. This alert reports what the sources listed below published and is not a guarantee about any specific site.