Exim

United Kingdom Open Source www.exim.org ↗
C
CAUTION
16
Total CVEs
8
Crit / High
4
Medium
4%
Unpatched
74%
Patched
6.6
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
74%
Unpatched
4%
Under Review
22%
✓ 17 patched ✗ 1 unpatched ~ 5 under review
▸ Intelligence by Audience
PoC Available
8 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"exim" port:443
org:"Exim" http.status:200
Top EPSS (Exploitation Probability)
CVE-2025-26794 77.64% exploitation probability
CVE-2023-42118 47.51% exploitation probability
CVE-2024-39929 41.23% exploitation probability
CVE-2023-42117 6.79% exploitation probability
CVE-2023-42116 3.76% exploitation probability
Quick Facts for Reporting
Total CVEs tracked
16
Critical severity
2
Actively exploited (CISA)
0
Unpatched ratio
4%
Avg CVSS score
6.6
Security grade
C (CAUTION)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-06-16
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution - The Hacker News
The Hacker News 2026-05-12
New Exim BDAT GnuTLS Vulnerability Enables Code Execution Attacks - CyberSecurityNews
CyberSecurityNews 2026-05-13
Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool - GBHackers News
GBHackers News 2026-07-23
Critical Exim vulnerability allows remote code execution - SC Media
SC Media 2026-05-14
Multiple Exim Mail Server Vulnerabilities Leads to Crash with Malicious DNS data - CyberSecurityNews
CyberSecurityNews 2026-05-02
Exim Mail Transfer Agent Actively Exploited by Russian GRU Cyber Actors - National Security Agency (NSA) (.gov)
National Security Agency (NSA) (.gov) 2020-05-28
▸ Recent CVEs showing 20 of 23
CVE IDSeverityPatchEPSSDate
CVE-2026-94057 4.0 MEDIUM PATCH UNDER REVIEW 0.20% 2026-09-19
CVE-2026-94056 7.5 HIGH PATCH UNDER REVIEW 0.24% 2026-09-19
CVE-2026-94055 PoC 3.7 LOW PATCH UNDER REVIEW 0.29% 2026-09-19
CVE-2026-94054 PoC 7.0 HIGH PATCH UNDER REVIEW 0.27% 2026-09-19
CVE-2026-66140 PoC 8.4 HIGH PATCHED / FIX AVAILABLE 0.39% 2026-07-24
CVE-2026-66141 PoC 7.4 HIGH PATCHED / FIX AVAILABLE 0.14% 2026-07-24
CVE-2026-48840 PoC 5.3 MEDIUM PATCHED / FIX AVAILABLE 0.26% 2026-05-30
CVE-2026-45185 PoC 9.8 CRITICAL PATCHED / FIX AVAILABLE 0.94% 2026-05-12
CVE-2026-40686 3.7 LOW PATCHED / FIX AVAILABLE 0.25% 2026-04-30
CVE-2026-40684 PoC 5.9 MEDIUM PATCHED / FIX AVAILABLE 0.36% 2026-04-30
CVE-2026-40685 6.5 MEDIUM PATCHED / FIX AVAILABLE 0.32% 2026-04-30
CVE-2026-40687 PoC 4.8 MEDIUM PATCHED / FIX AVAILABLE 0.37% 2026-04-30
CVE-2025-67896 7.0 HIGH PATCHED / FIX AVAILABLE 0.47% 2025-12-14
CVE-2025-30232 8.1 HIGH PATCHED / FIX AVAILABLE 0.52% 2025-03-27
CVE-2025-26794 7.5 HIGH PATCHED / FIX AVAILABLE 77.64% 2025-02-21
CVE-2024-39929 5.4 MEDIUM PATCHED / FIX AVAILABLE 41.23% 2024-07-04
CVE-2023-42119 3.1 LOW PATCHED / FIX AVAILABLE 1.61% 2024-05-03
CVE-2023-42118 7.5 HIGH UNKNOWN / UNPATCHED 47.51% 2024-05-03
CVE-2023-42117 8.1 HIGH PATCHED / FIX AVAILABLE 6.79% 2024-05-03
CVE-2023-42116 8.1 HIGH PATCHED / FIX AVAILABLE 3.76% 2024-05-03
View all 23 CVEs for Exim →
▸Intel
HQCambridge, United Kingdom
Founded1995
CountryUnited Kingdom
LicenseOpen Source
Trust ScoreC — CAUTION
Max CVSS9.8
Last Updated2026-06-16
▸Top Weaknesses
CWE-125
Out-of-Bounds Read
3 occurrences in Exim CVEs (19% of total)
CWE-125 ⓘ
3
CWE-684
Unknown Weakness Type
2 occurrences in Exim CVEs (13% of total)
CWE-684 ⓘ
2
CWE-416
Use After Free
2 occurrences in Exim CVEs (13% of total)
CWE-416 ⓘ
2
CWE-191 (Integer Underflow (Wrap or Wraparound))
Unknown Weakness Type
1 occurrence in Exim CVEs (6% of total)
CWE-191 (Integer Underflow (Wrap or Wraparound)) ⓘ
1
CWE-89
SQL Injection
1 occurrence in Exim CVEs (6% of total)
CWE-89 ⓘ
1
CWE-839
Unknown Weakness Type
1 occurrence in Exim CVEs (6% of total)
CWE-839 ⓘ
1
CWE-119
Buffer Overflow
1 occurrence in Exim CVEs (6% of total)
CWE-119 ⓘ
1
CWE-20
Unknown Weakness Type
1 occurrence in Exim CVEs (6% of total)
CWE-20 ⓘ
1
▸Company Profile

Exim is an open-source mail transfer agent (MTA) used on Unix-like operating systems to route and deliver email. It is widely deployed on internet-facing mail servers, making it a frequent target for security research and vulnerability disclosures. Exim's significance in cybersecurity stems from its critical role in email infrastructure and the high-impact remote code execution vulnerabilities that have been discovered in it.

▸Response Metrics
Est. MTTR ⓘ ~68 days (Average)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↗ +100% worse
CVE count 2026 vs 2025:  3 → 6 CVEs
Patch Speed ⓘ Poor (>65% open)
4% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€470K
Est. GDPR High
€4.7M

Based on 2 critical CVEs, 0 CISA KEV, 75% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Exim C valtersit.com