Critical and high severity Exim vulnerabilities: everything you need to know

Detect and mitigate CVE-2023-42115, and 5 more vulnerabilities in Exim. Organizations using affected configurations should mitigate and patch the vulnerabilities urgently.

Multiple vulnerabilities were publicly disclosed by the Zero Day Initiative (ZDI) in Exim Mail Transfer Agent (MTA), including CVE-2023-42115, which is a critical vulnerability enabling unauthenticated attackers to remotely execute code on publicly exposed Exim servers with “External” authentication enabled. This issue results from improper input validation that leads to writing arbitrary code past the end of the buffer. The recommendation is to update Exim to patched versions, or if not possible, restrict remote access to Exim mail servers if you have “External” authentication enabled, or to switch to a different authentication method.

Exim is a very prevalent mail server, due in part to being the default MTA preinstalled on Debian and other Linux distributions. According to the recently publishedMail Server Survey, Exim is the world’s most popular MTA software. As MTA servers are often accessible via the Internet, they are likely to serve as an initial access vector for attackers.

CVE-2023-42115 allows unauthenticated remote attackers to execute arbitrary code on affected installations of Exim, which runs over the SMTP service – exposed on port 25 by default, though ports 26, 587 and 465 are also commonly used. This issue results from improper input validation that leads to an out-of-bounds write found in the SMTP service when “External” authentication is enabled. This results in a write past the end of the buffer. A successful exploitation of this vulnerability could lead to an attacker executing code in the context of the service account.

Since disclosure, security researchers have been exploring Exim’s source code to find the relevant vulnerabilities,with some claiming success. Therefore, we expect exploitation in the wild to be observed shortly.

Besides CVE-2023-42115 which is critical, CVE-2023-42116, CVE-2023-42117 and CVE-2023-42118 are high severity vulnerabilities that also allow remote code execution under certain conditions, while CVE-2023-42114 and CVE-2023-42119 are low severity and only allow limited information disclosure. In all cases, these vulnerabilities require specific features to be enabled in order to be exploitable.

According to Wiz data, 23% percent of cloud environments have at least one instance of Exim, but we estimate that less than 5% of environments have publicly exposed Exim servers that might be at risk of exploitation.

Not all of the vulnerabilities have received patches yet.

Organizations should upgrade Exim instances to apatched versionor apply the workarounds listed above. If you are confident that you aren’t using any of the features required for exploitation, you can deprioritize patching for now.

To determine whether you’re using “External” authentication, run the following command to locate your configuration file. If it includesdriver = external, you should consider switching to a different authentication method or limiting remote access to the server altogether:

exim4 -bP configure_file

Wiz customers can use the pre-built query and advisory in the Wiz Threat Center to search for all vulnerable instances in their environment, or limit results to instances publicly exposed on common SMTP ports.

Exim maintainers’ statement

ZDI advisory

WatchTowr blogpost

Delving into CVE-2023-4863 and CVE-2023-5217 - critical vulnerabilities in libwebp and libvpx exploited in the wild.

An Introduction to Extended BPF and Its Transformative Impact.

Wiz helps accelerate the machine learning journey for practitioners by protecting their generative AI applications

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings