Notifications
Clear all
Topic starter
19/08/2026 3:50 pm
TL;DR: Exim CVE-2026-45185, or Dead.Letter, is a critical use-after-free flaw in the BDAT parsing path that can let an unauthenticated network attacker execute code on internet-facing mail servers, according to CYCOGNITO. The issue is a reminder that exposed SMTP services, default-enabled protocol features, and privileged mail daemons create a narrow but dangerous attack window when patching lags.
NHIMG editorial — based on content published by CYCOGNITO: Exim Dead.Letter vulnerability analysis and exposure patterns
By the numbers:
- Exim CVE-2026-45185 carries a CVSS v3.1 base score of 9.8, reflecting a critical unauthenticated remote code execution risk.
- Exim 4.97 through 4.99.2 are affected when compiled with USE_GNUTLS=yes, concentrating exposure on GnuTLS-backed deployments.
- Debian and Ubuntu distributions shipped coordinated fixes for affected Exim packages on May 12, 2026, reducing exposure for patched systems.
Questions worth separating out
Q: What fails when a mail server has an exploitable parser bug and broad internet exposure?
A: The failure is not only code execution.
Q: Why do privileged SMTP services increase blast radius after exploitation?
A: Because mail daemons often run with rights that exceed their narrow function.
Q: How can security teams tell whether Exim exposure is actually under control?
A: They should verify three things: the installed build is patched, the running binary matches the patched code, and the exposed SMTP surface is limited to systems that genuinely need public access.
Practitioner guidance
- Verify the patched binary, not just the package version Confirm the running Exim binary is linked against the fixed code path after upgrading to 4.99.3 or a distribution security build.
- Inventory every externally reachable SMTP listener Map servers on TCP/25, TCP/465, and TCP/587 that advertise STARTTLS and CHUNKING, then classify which are truly required to accept public mail.
- Restrict relay reachability where public access is unnecessary Limit SMTP access to known relay peers on systems that only need internal or partner mail flow, and remove unnecessary exposure from the internet.
What's in the full report
CYCOGNITO's full analysis covers the operational detail this post intentionally leaves for the source:
- Package-level remediation guidance for Debian and Ubuntu builds, including version validation steps
- The exact Exim build conditions that trigger the vulnerable GnuTLS code path
- Exposure mapping guidance for TCP/25, TCP/465, and TCP/587 listeners
- Practical verification steps for confirming the patched binary is the one actually running
👉 Read CYCOGNITO's analysis of Exim CVE-2026-45185 and Dead.Letter exposure →
Exim Dead.Letter vulnerability: what mail teams need to fix first?
Explore further
19/08/2026 4:26 pm
Exposed mail infrastructure is still identity-adjacent infrastructure. SMTP relays are often excluded from identity programmes until something goes wrong, yet they run privileged services, handle trusted routing, and depend on operational accounts and release processes. When a parser flaw turns into code execution, the boundary between infrastructure security and access governance collapses. Practitioners should treat externally reachable mail servers as governed assets, not orphaned utilities.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- That same research found DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records.
A question worth separating out:
Q: Who is accountable when a vulnerable mail relay stays exposed after a fix is available?
A: Accountability should sit with the service owner, the platform team, and the patch governance process together. A public-facing relay is an operational asset, so failure to verify binary state, exposure scope, and service ownership is a control breakdown across operations and security, not a single-team issue.
👉 Read our full editorial: Exim Dead.Letter shows how one mail flaw becomes remote code execution
