Fix CVE-2026 Exim Vulnerability: Complete Upgrade Guide 2026

Look, I need to get this off my chest. Stop postponing Exim updates. I’ve watched two servers get popped because somebody didn’t feel like upgrading, and both times it ended the same way: long nights, angry clients, and that horrible why-didn’t-I-just-do-it-earlier feeling during the morning debrief. This time the stakes are higher.

I’m talking about CVE-2026-45185. Remote code execution. CVSS score 9.8 out of 10. No clickbait, no drama. An attacker can execute code without logging in, without any authentication, just by sending a crafted TLS connection to port 25. And out in the wild, tons of servers are still running vulnerable versions. I honestly don’t understand why people keep putting this off.

Before we get to the fix, let me explain where the bug actually lives, because once you see it you’ll understand why this can’t be shrugged off. CVE-2026-45185 is a use-after-free in the GnuTLS backend, specifically in the code path that handles message bodies received through the CHUNKING extension, also known as BDAT. When a client sends a TLS close_notify in the middle of the body transfer, then follows it up with one byte in cleartext on the same TCP connection, Exim tries to write into a memory buffer that was already freed during the TLS session teardown. The result is heap corruption. And heap corruption is a very well-trodden road to remote code execution.

Every Exim build from 4.97 up to 4.99.2 is affected – but only if it was compiled with USE_GNUTLS=yes. If your build uses OpenSSL, you’re safe from this particular bug. But don’t breathe that sigh of relief just yet, because there are other 2026 CVEs that don’t care about your TLS library at all. I’ll give you the full table further down.

Now, I’ve heard this one a hundred times: my server is only an internal relay, I don’t expose SMTP to the internet, I’m safe right? I really hope so. But in practice, plenty of people who claim internal-only end up with port 25 reachable from the outside. A misconfigured firewall, a permissive datacenter default, a load balancer forwarding everything. Check it yourself from an external host with nmap – don’t just trust the firewall config on paper. The right move is to upgrade now. Not tomorrow. Now.

What are the symptoms, and why you can’t rely on them

This is the part that really bugs me. The bug doesn’t always crash Exim outright. Sometimes only the child process handling that connection dies. Sometimes nothing is visible at all, until the attacker successfully runs their payload. If you’re waiting for symptoms before you upgrade, you’re gambling with your production mail server.

When something does show up, the pattern usually looks like this. Check /var/log/exim/mainlog:

2026-07-20 14:12:30 1mXaBc-0004-9pz <= H=mail.attacker-net.example [198.51.100.45] P=ESMTPS X=TLSv1.3 TLS_AES_256_GCM_SHA384 CV=no S=1352
2026-07-20 14:12:30 1mXaBc-0004-9pz BDAT 2048
2026-07-20 14:12:30 1mXaBc-0004-9pz BDAT 0
2026-07-20 14:12:31 paniclog: 1mXaBc-0004-9pz: child process crashed with signal 11 (SIGSEGV)
2026-07-20 14:12:31 1mXaBc-0004-9pz ** H=mail.attacker-net.example [198.51.100.45] terminated

Let me walk you through it line by line:

• Line one: an inbound connection from mail.attacker-net.example using ESMTPS, which means TLS. On its own this is completely normal – inbound mail over TLS happens all the time.
• Lines two and three: the client issues two BDAT commands. That’s the CHUNKING extension, and it’s exactly the code path being targeted.
• Line four: this is the one that should make your skin crawl. A paniclog entry – the child process crashed with signal 11, SIGSEGV. A segmentation fault is a classic sign of memory corruption.
• Line five: the connection gets terminated. No clean SMTP error, the process just died.

If your paniclog shows a recurring SIGSEGV pattern, especially during quiet hours, that’s a fire alarm. But remember: the absence of this pattern doesn’t mean you’re safe, because a successful exploit can go completely silent. The only detection you can really trust is checking your version.

Check your Exim version and build

This is the first command you need to run:

exim -bV

The output will look roughly like this:

Exim version 4.99.2 #2 built 11-May-2026 13:33:19
Copyright (c) The Exim Maintainers 2026
(c) The University of Cambridge
Berkeley DB: unknown version
Support for: crypteq iconv() IPv6 PAM Perl Expand_dlfunc GnuTLS Content_Scanning

Two things to look at: the version number on the first line, and whether the word GnuTLS shows up in the Support for line. If the version is 4.99.2 or lower AND GnuTLS is there, you need to upgrade. If it’s 4.99.5 or higher, you’re already good – skip to the verification section.

On Debian or Ubuntu you can also check through the package manager:

dpkg -l | grep exim

On RHEL, AlmaLinux, or Rocky:

rpm -qa | grep exim

The fix: upgrade, step by step

Your version is vulnerable, so we upgrade. But before that, there’s one step you absolutely cannot skip.

Backing up the config is easy – just copy the directory:

cp -a /etc/exim4 /root/backup-exim4-$(date +%F)

If your distro keeps the config in /etc/exim, like RHEL, Gentoo, or manual builds:

cp -a /etc/exim /root/backup-exim-$(date +%F)

Verify the backup actually landed:

ls -la /root/ | grep backup-exim

Once the folder shows up, move on.

Upgrade on Debian / Ubuntu

For Debian 12 and Ubuntu 22.04/24.04, use apt:

apt update
apt upgrade exim4 exim4-base exim4-daemon-light exim4-daemon-heavy

Keep an eye on the output. If your distro’s repository doesn’t have a version of 4.99.3 or newer yet, grab it from backports:

apt install -t bookworm-backports exim4-daemon-heavy

On Ubuntu, check what’s available first with apt policy exim4-daemon-heavy. The fix sometimes waits for a point release. If it’s taking too long, skip down to the source build section.

Upgrade on RHEL / AlmaLinux / Rocky

Exim on the RHEL family usually comes from EPEL:

dnf --enablerepo=epel update exim

Upgrade on cPanel & WHM

cPanel ships its own Exim as cpanel-exim. The easiest path is through upcp:

/scripts/upcp

cPanel builds that already carry the CVE-2026 fixes are 136.0.7, 134.0.23, 118.0.64, and 110.0.112. If your WHM version is below those, bump it up first.

Upgrade on Plesk

Plesk updates through its autoinstaller:

plesk installer --select-product-id plesk --select-release-current --upgrade-installed-components

Or through the UI: Tools & Settings, then Updates. Make sure the mail server component actually gets updated.

Build from source (last resort)

If your distro repo hasn’t picked up the patch and you don’t want to wait, compile it yourself. Download the tarball:

cd /usr/local/src
wget https://downloads.exim.org/exim4/exim-4.99.5.tar.gz
tar xzf exim-4.99.5.tar.gz
cd exim-4.99.5

Prepare Local/Makefile from the EDITME file:

cp src/EDITME Local/Makefile

Then edit Local/Makefile: set EXIM_USER=exim, EXIM_GROUP=exim, and enable USE_GNUTLS if that’s what you use. Match it to your old build configuration. Then run:

make
make install

After that, verify the version reads 4.99.5.

Verify after the upgrade

exim -bV

You should see 4.99.5 now. Then confirm the queue survived:

exim -bpc

Restart the service:

systemctl restart exim4   # Debian/Ubuntu
systemctl restart exim     # RHEL or source build

Check the status:

systemctl status exim4

Finally, send a real test message to make sure mail flow still works:

printf 'Subject: post-upgrade testnnhope this worksn' | exim -v recipient@example.com

If the output shows Completed, you’re healthy.

The other 2026 Exim CVEs you shouldn’t ignore

Here’s what keeps tripping people up: they patch one CVE and forget the rest. In 2026, Exim picked up several CVEs at once, and the correct fix is to jump straight to 4.99.5 so all of them are covered in one move.

Now you can see why the target is 4.99.5. Going to 4.99.3 fixes the headline RCE, but you’d still be exposed to CVE-2026-66140, a local privilege escalation path. If you’re upgrading anyway, go all the way to the latest.

Pro tips & warnings from the trenches

• Don’t update just one server if you run a relay chain. Patch every hop. Otherwise an attacker walks straight through whichever one you left behind.
• Someone always asks, what if I just firewall port 25 to an allowlist? That shrinks the attack surface, it doesn’t fix the bug. An attacker already inside your network can still reach it. Upgrade regardless.
• Set up monitoring on the paniclog. If /var/log/exim/paniclog starts filling with SIGSEGV, that’s your signal to panic – not your client’s.
• If you manage multiple servers, keep a list of the Exim version on each one. Security audits become way faster.
• After upgrading, update your monitoring. Stale alerts sometimes still flag a vulnerable version that’s already patched.

If you want to go deeper on hardening, check out the Exim server hardening guide and our piece on monitoring Exim queue and mainlog. Newer to mail servers? The TLS/STARTTLS configuration guide for Exim is a solid place to start.

FAQ

Please don’t put this upgrade off. Check your Exim version right now – before someone else checks it for you, in the worst possible way. Keep your mail server safe. Take it seriously.