Critical Remote Code Execution Vulnerability (CVE‑2019‑16928) in Exim Mail Server
What It Is — Exim Internet Mailer contains an out‑of‑bounds write flaw that can be triggered by a specially crafted SMTP command, allowing an unauthenticated attacker to execute arbitrary code on the mail server.
Exploitability — Public proof‑of‑concept code exists; the vulnerability scores 9.8 (CVSS v3.1), classifying it as Critical. No known active exploit campaigns were reported at the time of disclosure, but the risk of weaponisation is high.
Affected Products — All Exim releases prior to 4.92.0 (the version that introduced the fix). The issue impacts on‑premises mail gateways, cloud‑hosted mail services that bundle Exim, and any third‑party appliance that ships the vulnerable binary.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous patch management and evidence that updates are applied promptly – a core control‑area for audit readiness.
- Highlights the importance of vulnerability scanning as ongoing assurance evidence across frameworks (e.g., NIST CSF Identify and Protect functions).
- Failure to remediate can break the defensible audit trail required by regulators and enterprise buyers who demand proof of a hardened mail infrastructure.
Recommended Actions
- Upgrade Exim to 4.92.0 or later on all mail servers.
- Verify the running version with an automated inventory scan and retain the scan report as compliance evidence.
- Enable and regularly review IDS/IPS alerts for anomalous SMTP traffic that could indicate exploitation attempts.
- Document the remediation in your change‑management system and map the patch activity to the “Vulnerability Management” control objective in your framework of record.
Source: CISA KEV – CVE‑2019‑16928