Exim CVE-2026-66140

Exploitation requires a local account on the target system with at least low-level privileges (consistent with CVSS PR:L), sufficient to invoke Exim queue management operations that accept queue-name arguments. The attack vector is strictly local (AV:L), ruling out remote unauthenticated exploitation. The attacker must be able to supply a controlled queue-name argument to the affected Exim code path - this is enabled by the presence of Exim 4.88 through 4.99.4 on the system. No special non-default configuration is required; any Exim installation in the affected version range is vulnerable when a local user can interact with queue-management functionality. Exploitation is limited by the need for local access: remote-only attackers cannot trigger this without first gaining a foothold on the host.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) places this as a local privilege escalation with low attack complexity and low required privileges, yielding a score of 7.8. SSVC corroborates the severity with a technical impact of 'total', but rates exploitation as 'none' and automatable as 'no', which aligns with the local attack vector - mass remote exploitation is not feasible. The EPSS score of 0.27% at the 19th percentile confirms this is not currently being exploited at scale. The absence of a CISA KEV listing and no reported POC further reduce immediate urgency. The realistic threat model is an attacker or malicious process that already has a local low-privileged account on an Exim-bearing server - a credible scenario in shared hosting or compromised web application contexts. Any organization running internet-facing mail infrastructure, whether a large enterprise or a smaller regional operator, should treat this as a meaningful privilege escalation risk given that Exim processes are typically long-running and may run as a semi-privileged system user. The gap between the 'total' SSVC technical impact and the low EPSS score is consistent with a vulnerability that is severe once local access is achieved but requires that prerequisite, limiting opportunistic mass exploitation.

A low-privileged local user or compromised web application process with the ability to invoke Exim queue operations submits a crafted queue-name value containing directory traversal sequences (e.g., '../../etc/shadow') as an argument to Exim's queue management interface. Exim processes the argument without stripping the traversal sequences, causing filesystem operations to target files outside the spool directory. The attacker reads sensitive system files or overwrites privileged files to escalate to root. No public POC has been identified at time of analysis.