CVE-2025-26794

Exim, the widely deployed open-source mail transfer agent, is vulnerable to remote SQL injection (CVE-2025-26794, CWE-89) in version 4.98 before 4.98.1. The flaw is reachable over the network when a server uses SQLite for its hints database together with ETRN serialization, and per the CVSS vector requires no privileges or user interaction, with high impact on confidentiality, integrity, and availability. A successful attacker could manipulate the SQLite-backed data Exim relies on and disrupt mail handling, consistent with the critical 9.8 score. Only sites running Exim 4.98.x on affected configurations are exposed; sites with certain non-default rate-limit configurations need version 4.99.1 for the SQL injection to be fully resolved. No public proof-of-concept or CISA KEV entry exists yet, but EPSS assigns a 77.2% probability of exploitation within 30 days (100th percentile), so patching should be treated as urgent.

What to do: Upgrade Exim to 4.98.1 or later; sites using certain non-default rate-limit configurations should move to 4.99.1, since the SQL injection is only fully resolved there. Administrators should check whether their configuration uses SQLite for the hints database and ETRN serialization, and until patching can mitigate by disabling SQLite hints/ETRN serialization or restricting network access to the SMTP service. Given the 77.2% EPSS score, treat this as a priority patch even though exploitation has not yet been confirmed.