Exim CVE-2026-66141

Exploitation requires a local shell account on the target system (CVSS PR:L, AV:L) with the ability to write to the account's home directory to create or modify ~/.forward. The Exim installation must be configured to process .forward files for local mail delivery, and pipe transport must be enabled and accessible to local user accounts - this is a common Exim configuration but not universally deployed. Exploitation is triggered when mail is delivered to the attacker's local account, causing Exim to process the malicious .forward file through the pipe transport. Remote unauthenticated exploitation is not possible. Configurations that disable .forward processing (e.g., no_process_forward in the local delivery router), restrict pipe transport usage to trusted accounts, or set force_command correctly would prevent exploitation. Shared hosting environments and multi-user Unix systems where untrusted local users exist represent the highest-risk deployment scenario.

The CVSS 3.1 score of 7.8 High with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the local privilege escalation profile: a standard user account is sufficient, complexity is low, no interaction is required, and full CIA impact results upon success. However, multiple signals temper immediate urgency: EPSS at 0.10% (1st percentile) places this well below typical exploitation thresholds; SSVC independently rates exploitation status as 'none' and automatable as 'no,' consistent with the local-only attack vector that precludes mass exploitation. SSVC rates technical impact as 'total,' matching the H/H/H CVSS impact triad. This vulnerability is absent from CISA KEV with no public exploit code identified. Realistic risk is highest in multi-user Linux environments where untrusted local accounts exist - shared hosting, academic or research servers, legacy Unix systems. In containerized or single-tenant deployments, exploitation is constrained to scenarios where an attacker already has local shell access, significantly reducing the threat surface relative to the raw CVSS score.

A local user on a multi-user Linux server running a vulnerable Exim version crafts a ~/.forward file containing a pipe directive designed to execute a privilege-escalating shell command. When Exim processes incoming mail for that user's account, the mishandling of force_command in the pipe transport allows the user-controlled command to execute under the elevated privileges of the Exim mail delivery context rather than being overridden by the administrator-defined force_command. No public exploit code has been identified at the time of this analysis.