CVE-2026-94057: 
Exim vulnerability analysis and mitigation

CVE-2026-94057 is an SMTP smuggling vulnerability in Exim, the widely-used open-source mail transfer agent, affecting all versions before 4.100.1. The flaw allows an unauthenticated remote attacker to inject crafted data after a DATA processing rejection, causing the received message to differ from the originally sent message. It was published on September 19, 2026, with a patch released in Exim 4.100.1. The vulnerability carries a CVSS v3.1 base score of 4.0 (Medium) (GitHub Advisory).

The root cause is classified as CWE-93 (Improper Neutralization of CRLF Sequences / CRLF Injection). During SMTP DATA phase processing, Exim fails to properly handle crafted input submitted after a rejection response, allowing an attacker to smuggle additional SMTP commands or message content by exploiting CRLF sequence handling. This technique — known as SMTP smuggling — exploits inconsistencies between how the sending and receiving SMTP servers interpret message boundaries, enabling injection of unintended message content or commands. No public proof-of-concept code has been identified at this time (GitHub Advisory, Exim Mailing List).

Successful exploitation allows an unauthenticated network attacker to tamper with email message integrity — the message received by the target does not match the message originally sent. This can enable injection of unintended email content, spoofing of message bodies, or bypassing of email security controls that rely on message consistency. The scope is marked as "Changed," indicating the impact can extend beyond the vulnerable Exim component itself to downstream mail processing systems or recipients. Confidentiality and availability are not directly impacted (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attack complexity is rated High, as exploitation requires precise crafting of SMTP sequences and depends on specific server behavior during DATA rejection handling.

The primary remediation is to upgrade Exim to version 4.100.1 or later, which contains the fix for this vulnerability (GitHub Advisory, Exim Mailing List). For organizations unable to patch immediately, restricting SMTP access at the network perimeter (e.g., via firewall rules limiting which hosts can initiate SMTP sessions) can reduce exposure. Administrators should also review SMTP logs and message delivery records for anomalies such as messages whose content does not match expected delivery records.