internet-facing-service-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Critical Unauthenticated RCE Patched in Exim SMTP Server

Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Sep 3, 2026

Multiple flaws in the Exim mail transfer agent include CVE-2023-42115, a critical unauthenticated remote-code-execution vulnerability rated CVSS 9.8. The out-of-bounds write affects Exim's SMTP service when the EXTERNAL authentication scheme is configured and available, potentially enabling an unauthenticated remote attacker to execute code as the Exim service account.

Exim versions 4.96.1 and 4.97 address CVE-2023-42115 and the related CVE-2023-42114 and CVE-2023-42116 vulnerabilities. Organizations should upgrade promptly; where immediate patching is not possible, they should disable exposed authentication features and limit remote SMTP access. Other disclosed issues depend on configurations such as SPA/NTLM authentication, an untrusted Proxy Protocol proxy, SPF ACL use, or reliance on an untrusted DNS resolver.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events

Reported Oct 2, 20233y ago
Exim releases fixes for CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116
Exim versions 4.96.1 and 4.97 fixed CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116. At the time described, CVE-2023-42117 and CVE-2023-42118 had no available fixes and were assumed to affect all Exim versions.
Exim 0day Vulnerabilities: Everything You Need to Know | Wiz Blog
Reported Oct 2, 20233y ago
ZDI publicly discloses multiple Exim vulnerabilities
The Zero Day Initiative publicly disclosed multiple Exim MTA vulnerabilities, including critical unauthenticated RCE flaw CVE-2023-42115. The issue is an out-of-bounds write reachable when EXTERNAL authentication is configured and can allow code execution as the Exim service account.
Exim 0day Vulnerabilities: Everything You Need to Know | Wiz Blog

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Exim EXTERNAL AUTH Out-of-Bounds Write Remote Code Execution (CVE-2023-42115)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

UnclassifiedNews · Jan 1, 2026

Index of /exim4/Open source ↗

Wiz BlogNews · Oct 2, 2023

Exim 0day Vulnerabilities: Everything You Need to Know | Wiz BlogOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Critical Unauthenticated RCE Patched in Exim SMTP Server

How this story unfolded

Exim releases fixes for CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116

ZDI publicly discloses multiple Exim vulnerabilities

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Exim 4.99.2 Patches Four Mail Server Vulnerabilities

Exim fixes critical BDAT use-after-free that could enable remote code execution

Exim 4.100.1 Fixes SMTP Smuggling, Heap Corruption and TLS Use-After-Free Flaws

Critical Unauthenticated RCE Patched in Exim SMTP Server

How this story unfolded

Exim releases fixes for CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116

ZDI publicly discloses multiple Exim vulnerabilities

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Exim 4.99.2 Patches Four Mail Server Vulnerabilities

Exim fixes critical BDAT use-after-free that could enable remote code execution

Exim 4.100.1 Fixes SMTP Smuggling, Heap Corruption and TLS Use-After-Free Flaws