CVE-2026-94057

Executive Summary

CVE-2026-94057 is an SMTP smuggling vulnerability in Exim mail transfer agent (MTA) versions prior to 4.100.1, classified under CWE-93 (Improper Neutralization of CRLF Sequences). The flaw allows an attacker to cause the message ultimately received by a downstream/destination system to differ from the message actually sent — the received content depends on crafted data transmitted after a rejection during DATA processing. Any organization running an internet-facing Exim MTA below 4.100.1 (directly, as a relay, or as an outbound gateway where downstream SMTP implementations disagree on message framing) is potentially affected; impact is integrity-focused (message spoofing/injection), rated CVSS 4.0.

Technical Analysis

The NVD description states: "Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing."

SMTP smuggling is a message-framing desynchronization class of attack. SMTP uses CRLF-delimited lines, and the end-of-data boundary is signaled by a line containing only a period (<CRLF>.<CRLF>). During the DATA phase, an SMTP server indicates acceptance or rejection of the message body. This CVE describes a condition specific to that phase: when Exim rejects a message during DATA processing, crafted data sent by the client after the rejection alters what the receiving side ultimately treats as the delivered message. In effect, the received message does not correspond to any message the client ostensibly "sent" — a framing/parsing desynchronization between what the sender intended and what the receiver materializes.

The underlying weakness is CWE-93, Improper Neutralization of CRLF Sequences. This is consistent with the SMTP smuggling class: control over line terminators/boundary sequences permits an attacker to shape where one message ends and another begins. The exact parsing paths, the precise rejection condition during DATA processing, and the byte sequences required are not disclosed in the provided data, so the specific internal mechanism (e.g., which handler or state transition is involved) cannot be stated without fabrication. What is reliably known: the trigger is a rejection during DATA processing, followed by crafted post-rejection data.

Attack surface: the SMTP transaction interface on Exim's listening ports (commonly TCP/25, with 587/465 for submission paths), reachable by any client able to complete an SMTP session up to the DATA phase. No authentication is required per the CVSS vector (PR:N), though attack complexity is High (AC:H) — indicating the attacker must satisfy non-trivial preconditions (e.g., specific rejection circumstances and crafted framing) rather than a trivial single-packet trigger. The scope is changed (S:C), meaning the impact crosses a security authority — consistent with a downstream consumer (final mailbox, relay, or scanning layer) being affected differently than the Exim boundary itself.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None; Nuclei template: NO; Exploit code: NO). The attack chain below is inferred strictly from the vulnerability class (SMTP smuggling / CWE-93) and the NVD description; no specific function names, endpoints, or payload bytes are asserted because none are given.

1. Reconnaissance / target identification. Identify an accessible SMTP service running Exim below 4.100.1 that is internet-facing or reachable by the attacker (Shodan dorks: product:"Exim", port:25 Exim, port:587 Exim). Determine whether the Exim host relays to, or is followed by, a downstream SMTP consumer (mailbox server, gateway, or scanner) — the attack's effect is realized at the receiving/consuming side, which is why CVSS scope is Changed.

2. Trigger the flaw class (rejection during DATA). The attacker initiates a standard SMTP session and enters the DATA phase. Per the description, the attacker deliberately triggers a rejection during DATA processing — i.e., causes Exim to reject the message at this stage rather than accept it. The precise rejection condition is not disclosed; the attacker must find or induce the circumstance under which Exim emits the rejection.

3. Payload / framing manipulation (vulnerability-class level). After the rejection, the attacker sends additional crafted data. Because of improper neutralization of CRLF sequences (CWE-93) in this post-rejection path, the crafted data influences message framing such that the message ultimately received does not match any message sent. This is a desynchronization/framing-injection primitive, not an RCE primitive — the attacker gains control over message boundaries and content as seen by the receiver, not code execution on the Exim host.

4. Post-exploitation impact. The realized impact is integrity of mail content and provenance (CVSS I:L, C:N, A:N). Practical consequences include injecting or splitting content into messages that pass downstream inspection, spoofing the apparent origin/body of delivered mail, bypassing message-level policy controls that act on differing message boundaries, and evading signature/filtering layers that parse the message differently than the final recipient. This aligns with the CVSS vector's limited-integrity, no-confidentiality, no-availability profile.

Note: the AC:H rating and absence of any published exploit mean weaponization is non-trivial; no observed in-the-wild exploitation is evidenced in the supplied data.

Impact Assessment

Business impact is centered on mail integrity and trust. CVSS 4.0 with vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N:

• AV:N (Network): exploitable over the network via SMTP.
• AC:H (High): non-trivial preconditions — attacker must induce a DATA-phase rejection and craft post-rejection data to achieve desynchronization; not a straightforward one-shot attack.
• PR:N / UI:N: no credentials and no user interaction required.
• S:C (Changed): the impact crosses a security boundary — the effect is realized on a downstream component that frames/parses the message differently than the vulnerable Exim instance.
• C:N / I:L / A:N: no confidentiality loss, no availability impact, limited integrity impact — consistent with controlled message framing/spoofing rather than disclosure or service disruption.

Blast radius: any Exim deployment below 4.100.1 that participates in mail relay or delivery where a downstream SMTP consumer exists. Organizations relying on message-level filtering, SPF/DKIM-aligned trust, or content inspection may see policy bypass if inspection and final delivery disagree on message boundaries. Because the vulnerability enables a received message that "does not match any sent message," downstream trust assumptions (sender authenticity, content scanning results) are the primary assets at risk. No CISA KEV listing (not known exploited), and no EPSS score is available.

Detection Guidance

Sigma Rule

title: Suspicious SMTP DATA-Phase Rejection Followed by Additional Client Data (SMTP Smuggling)
id: 8f2c1a44-9b7e-4d3a-9c5e-202694057ab1
status: experimental
description: Detects SMTP sessions where a DATA-phase rejection is immediately followed by additional client-supplied data, consistent with SMTP smuggling behavior in Exim before 4.100.1 (CVE-2026-94057).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94057
author: valtersit.com
date: 2026/01/01
logsource:
  product: exim
  service: smtp
detection:
  selection_reject:
    message|contains:
      - 'rejected'
      - 'DATA'
  selection_after:
    message|contains:
      - 'unexpected data after'
      - 'data after rejection'
      - 'SMTP smuggling'
  condition: selection_reject and selection_after
fields:
  - src_ip
  - client_ip
  - message_id
falsepositives:
  - Misbehaving or non-standard SMTP clients
  - Debug/test mail tooling
level: medium

YARA Rule

rule CVE_2026_94057_Exim_SMTP_Smuggling_Logs
{
    meta:
        author = "valtersit.com"
        description = "Detects Exim log evidence of SMTP smuggling via post-rejection DATA handling (CVE-2026-94057)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94057"
        date = "2026-01-01"
        cve = "CVE-2026-94057"
    strings:
        $s1 = "DATA" ascii
        $s2 = "rejected" ascii nocase
        $s3 = "unexpected data" ascii nocase
        $s4 = "SMTP smuggling" ascii nocase
        $s5 = "SMTP error" ascii nocase
    condition:
        filesize < 2MB and
        ($s1 and $s2) and
        any of ($s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587,465] (msg:"CVE-2026-94057 Exim SMTP smuggling potential post-rejection DATA framing"; flow:established,to_server; content:"DATA"; nocase; content:"|0d 0a|.|0d 0a|"; within:2048; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; sid:2026940571; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-94057, vendor Exim;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.transport == "tcp" and destination.port in (25, 587, 465) and
     smtp.data_phase == true and smtp.response_code >= "500"]
  [network where network.transport == "tcp" and destination.port in (25, 587, 465) and
     smtp.client_payload_after_reject == true]

Splunk SPL Query

index=mail sourcetype=exim OR sourcetype=smtp
| search ("DATA" AND ("rejected" OR "reject"))
| rex field=_raw "(?<client_ip>\d{1,3}(?:\.\d{1,3}){3})"
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by client_ip
| where count >= 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="exim,smtp,cve_2026_94057,">
  <rule id="100940" level="8">
    <if_sid>3100</if_sid>
    <match>DATA</match>
    <regex>rejected|reject|unexpected data</regex>
    <description>CVE-2026-94057: Possible Exim SMTP smuggling - DATA-phase rejection with subsequent client data</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94057,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source; no vendor fix or workaround supplied in the data). The NVD description references "Exim before 4.100.1," implying 4.100.1 resolves the issue, but no verified advisory, commit, or release artifact is available in the provided data — treat all upgrade guidance as unverified until confirmed with the Exim project directly.

1. Immediate mitigations.

   • Restrict SMTP exposure: limit inbound port 25/587 reachability on Exim hosts below 4.100.1 to trusted relay networks only; do not expose directly to the internet where avoidable.
   • Enforce strict message-framing consistency across the mail path so the parley between Exim and downstream consumers uses identical line-ending/boundary handling (the core of the smuggling class).
   • Increase logging verbosity around the DATA phase and reject-then-data sequences, and forward to SIEM using the detections above.
   • Monitor for internal mail-from-external patterns and anomalous header/message-boundary artifacts.

2. Patch / upgrade steps.

   • Confirm the fixed version with the Exim project (NVD description indicates 4.100.1 is the first non-vulnerable release). Validate against your distribution's packaged Exim.
   • Stage upgrade in a mail test environment; verify SMTP transaction behavior across relays and downstream consumers after upgrade.
   • Track the official Exim security advisory and release notes before production rollout; do not rely solely on the CVE text.

3. Long-term hardening.

   • Standardize CRLF/boundary handling across all SMTP-aware components (MTA, scanners, mailboxes) to prevent framing desynchronization.
   • Deploy end-to-end message authentication (SPF/DKIM/DMARC) and enforce alignment to reduce the value of spoofed/framing-injected mail.
   • Maintain an MTA patch cadence with rapid response to Exim security releases; monitor CISA KEV and vendor channels (currently NOT in KEV).
   • Log full SMTP session transcripts for DATA-phase anomalies and retain for forensic review.

References

• NVD — CVE-2026-94057: https://nvd.nist.gov/vuln/detail/CVE-2026-94057
• MITRE CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection'): https://cwe.mitre.org/data/definitions/93.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Exim project security/announcements page (verify fixed version 4.100.1): https://exim.org/
• FIRST EPSS (no score available for this CVE at time of writing): https://www.first.org/epss/

Threat actor / exploit-in-the-wild note: No public PoC, exploit code, Nuclei template, CISA KEV entry, or named threat-actor campaign is evidenced in the supplied data. No attribution is made.