What is the CVSS score of CVE-2026-66140?

CVE-2026-66140 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Exim are affected by CVE-2026-66140?

Exim mail server versions 4.88-4.99.4 contain a directory traversal vulnerability enabling local privilege escalation with potential for complete system compromise.. A patch is available.

How to fix or mitigate CVE-2026-66140?

Within 24 hours, inventory all Exim deployments to identify systems running versions 4.88-4.99.4; no public exploit identified at time of analysis, which moderates near-term risk but does not eliminate the need for urgent remediation. Within 7 days, upgrade all affected Exim instances to version 4.99.5 or later, prioritizing production mail servers and systems where untrusted local users have access. Within 30 days, complete full-environment patching and validation testing to confirm mail service continuity, replicate patches to all redundant systems, and verify upgrade completion across the infrastructure.

Exim CVE-2026-66140

EUVD-2026-48478 HIGH

Path Traversal: '../filedir' (CWE-24)

2026-07-24 mitre

GHSA-5qxf-w5v2-m3rg

Path Traversal Exim

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (mitre) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack requiring low-privileged user to supply queue-name arguments; full C/I/A impact because arbitrary file access enables privilege escalation to root.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.4 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 19:18 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 19:07 NVD

8.4 (HIGH) 7.8 (HIGH)

Patch available

Jul 24, 2026 - 06:02 EUVD

Analysis Generated

Jul 24, 2026 - 05:17 vuln.today

CVE Published

Jul 24, 2026 - 04:32 cve.org

HIGH 8.4

DescriptionNVD

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

AnalysisAI

Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.

Technical ContextAI

Exim is a widely-deployed open-source Mail Transfer Agent (MTA) used predominantly on Unix/Linux systems. It maintains a spool directory where in-transit messages and queue metadata are stored. The affected code path handles queue-name arguments used in queue management operations; CWE-24 (Path Traversal with '../filedir') indicates that user-supplied queue-name values are not canonicalized or stripped of traversal sequences before being used in filesystem operations. This allows an attacker to construct a queue-name containing '../' sequences to reference paths outside the intended spool directory boundary. The CPE string cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* with version range 4.88 to 4.99.4 confirms the scope is the Exim application itself, not OS-level packages.

RemediationAI

Upgrade to Exim 4.99.5, which contains the vendor-released patch addressing the queue-name argument handling flaw. The upstream disclosure is documented at https://openwall.com/lists/oss-security/2026/07/22/9. If immediate upgrade is not possible, restrict local system access to Exim queue management commands by limiting which local accounts can invoke Exim's queue-management flags (e.g., via sudo rules or filesystem ACLs on the Exim binary), accepting the trade-off that legitimate queue inspection by non-root users will also be blocked. Additionally, monitor filesystem access patterns from the Exim process user for anomalous reads outside the spool directory as a detection compensating control. The patch from the vendor is confirmed available; no exact commit or PR reference was provided in the source data, so obtaining the fix via the official Exim 4.99.5 release is the recommended path.