{"id":"CVE-2019-10149","published":"2019-06-05T14:29:11Z","modified":"2026-06-17T02:10:21Z","title":"Exim Mail Transfer Agent (MTA) Improper Input Validation","vendor":"Exim","product":"Mail Transfer Agent (MTA)","tier":"core","eol":null,"description":{"text":"A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper validation of the recipient address in the deliver_message() function in /src/deliver.c of the Exim Mail Transfer Agent (MTA), affecting Exim versions 4.87 through 4.91 inclusive. An attacker who can reach the mail server over the network can send a crafted recipient address that may lead to remote command execution, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:09Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99961,"percentile":0.99975,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-01-10","dueDate":"2022-07-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-10149","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-12-27","exploitedFirstSeen":"2019-12-27","ransomware":false,"evidence":[{"url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","date":"2019-12-27"},{"url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf","date":"2020-05-28"},{"url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA-Sandworm-Actors-Exploiting-Vulnerability-in-Exim-Transfer-Agent-20200528.pdf","date":"2020-05-28"},{"url":"https://us-cert.cisa.gov/ncas/current-activity/2020/05/28/nsa-releases-advisory-sandworm-actors-exploiting-exim","date":"2020-05-28"},{"url":"https://www.cisa.gov/news-events/alerts/2020/05/28/nsa-releases-advisory-sandworm-actors-exploiting-exim-vulnerability","date":"2020-05-28"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-296a","date":"2020-10-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-296a","date":"2020-12-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-10"},{"url":"https://cisa.gov/news-events/alerts/2022/01/11/understanding-and-mitigating-russian-state-sponsored-cyber-threats-us","date":"2022-03-01"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-011a","date":"2022-03-01"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2019/Jun/16","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/3","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/4","tags":["Exploit","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/06/1","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/25/6","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/25/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/26/4","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/04/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108679","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/5","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201906-01","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4010-1/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4456","tags":["Third Party Advisory"]},{"url":"https://www.exim.org/static/doc/security/CVE-2019-10149.txt","tags":["Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2019/Jun/16","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/2","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/3","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/05/4","tags":["Exploit","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2019/06/06/1","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/25/6","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/25/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/26/4","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/04/7","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/108679","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/5","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201906-01","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4010-1/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4456","tags":["Third Party Advisory"]},{"url":"https://www.exim.org/static/doc/security/CVE-2019-10149.txt","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Remote unauthenticated mail input exploits public-facing service","mappingType":"uncategorized","evidence":[{"from":"description","quote":"Improper validation of recipient address in deliver_message() function","start":60,"end":130}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploit yields command execution on host","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may lead to remote command execution","start":149,"end":185}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cd856cf3551423cebe83","title":"U/OO/140757-20 PP-20-0393 28 May 2020","publisher":"media.defense.gov","url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf","date":null,"mentions":[{"quote":"On 5 June 2019, an update for a critical vulnerability (CVE-2019-10149) in Exim was released.","start":630,"end":723},{"quote":"When CVE-2019-10149 is successfully exploited, an actor is able to execute code of their choosing.","start":1449,"end":1547},{"quote":"exploited CVE-2019-10149, the victim machine would subsequently download and execute a shell script from a","start":1563,"end":1669},{"quote":"Additionally, network-based security appliances may be able to detect and/or block CVE-2019-10149 exploit attempts.","start":3119,"end":3234},{"quote":"can also be queried for emails with a recipient containing “${run”, which would likely indicate a CVE -2019-10149 exploit","start":3606,"end":3727}]},{"id":"SRC-5d2b20805459665b8dca","title":"APT44: Unearthing","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf","date":null,"mentions":[{"quote":"A101-165 Application Vulnerability - APT44, CVE-2019-10149, Remote Code Execution, Benign Payload","start":97271,"end":97368},{"quote":"A101-166 Application Vulnerability - APT44, CVE-2019-10149, Remote Code Execution, Malicious Payload","start":97370,"end":97470},{"quote":"#1\r\nA102-579 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #1\r\nA102-580 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #2\r\nA102-581 Malicious File Transfer - APT44, VPNFILTER, Download, Variant #3\r\nA101-287 Malicious File Transfer - CVE-2019-10149, APT44, Malicious Bash Script,","start":104593,"end":104902}]},{"id":"SRC-49fc93fc459e761858b6","title":"Centreon to Exim and Back: On the Trail of Sandworm","publisher":"domaintools.com","url":"https://www.domaintools.com/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm","date":null,"mentions":[{"quote":"The vulnerability linked to Sandworm activity, CVE-2019-10149, can allow for Remote Code Execution (RCE) on the vulnerable host depending on Exim’s configuration and if it is remotely accessible.","start":4547,"end":4742}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-2187","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2187","exploited":true,"exploitedSince":"2022-01-10","provenance":"source"},"exploits":[{"id":46974,"url":"https://www.exploit-db.com/exploits/46974","title":"Exim 4.87 < 4.91 - (Local / Remote) Command Execution","type":"remote","platform":"linux","date":"2019-06-05","verified":false,"provenance":"source"},{"id":46996,"url":"https://www.exploit-db.com/exploits/46996","title":"Exim 4.87 - 4.91 - Local Privilege Escalation","type":"local","platform":"linux","date":"2019-06-17","verified":true,"provenance":"source"},{"id":47307,"url":"https://www.exploit-db.com/exploits/47307","title":"Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2019-08-26","verified":true,"provenance":"source"},{"id":47307,"url":"https://www.exploit-db.com/exploits/47307","title":"Exim 4.87 / 4.91 - Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2019-08-26","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2019-06-05"},"pocGithub":{"count":17,"skipped":2,"earliest":"2019-06-10","earliestUrl":"https://github.com/bananaphones/exim-rce-quickfix","repos":[{"name":"bananaphones/exim-rce-quickfix","url":"https://github.com/bananaphones/exim-rce-quickfix","stars":22,"created":"2019-06-10"},{"name":"Diefunction/CVE-2019-10149","url":"https://github.com/Diefunction/CVE-2019-10149","stars":20,"created":"2019-10-27"},{"name":"cowbe0x004/eximrce-CVE-2019-10149","url":"https://github.com/cowbe0x004/eximrce-CVE-2019-10149","stars":14,"created":"2019-06-12"},{"name":"MNEMO-CERT/PoC--CVE-2019-10149_Exim","url":"https://github.com/MNEMO-CERT/PoC--CVE-2019-10149_Exim","stars":14,"created":"2019-06-13"},{"name":"AzizMea/CVE-2019-10149-privilege-escalation","url":"https://github.com/AzizMea/CVE-2019-10149-privilege-escalation","stars":9,"created":"2019-06-27"}]},"metasploit":[{"name":"Exim 4.87 - 4.91 Local Privilege Escalation","module":"exploit/linux/local/exim4_deliver_message_priv_esc","type":"exploit","disclosureDate":"2019-06-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/exim4_deliver_message_priv_esc.rb"}],"first":{"date":"2019-06-05","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46974"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html","http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html","http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html","http://www.openwall.com/lists/oss-security/2019/06/05/4","http://www.openwall.com/lists/oss-security/2019/06/06/1"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-06-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10149","provenance":"source"},{"date":"2019-06-05","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46974); later: Metasploit 2019-06-05, PoC-in-GitHub 2019-06-10","url":"https://www.exploit-db.com/exploits/46974","provenance":"source"},{"date":"2019-12-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.sonicwall.com/en-us/2019/12/top-cves-exploited-in-the-wild-in-the-year-2019/","provenance":"source"},{"date":"2022-01-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2187","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Exploit-DB","daysToKev":950},"priority":{"score":77.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2498 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":7.74,"detail":"3 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 4 Exploit-DB entries; 17 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}