# CVE-2026-66141: Exim privilege escalation in .forward pipe transport force_command

Source: https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-66141 · Severity: high · CVSS 7.4 · Published 2026-07-24

Exim, a widely used mail transfer agent for Unix-like operating systems, contains a vulnerability that could allow a local user to gain elevated system privileges. By exploiting how the software handles user-defined mail forwarding rules, an attacker can execute commands with the permissions of a more privileged user. This could lead to a full system compromise or unauthorized access to sensitive data.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2026-66141 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66141 being exploited in the wild.

**How severe is CVE-2026-66141?** High severity, with a CVSS score of 7.4, published 24 July 2026.

**Which products and versions are affected?** Exim 4.82 through 4.99.4.

**Is there a fix for CVE-2026-66141?** A patch was published on 2026-07-22: Version 4.99.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66141 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-66141?** Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local privilege escalation vulnerability exists in Exim versions 4.82 through 4.99.4. The flaw occurs when a redirect router implements .forward facilities for local users and uses a pipe transport that has the 'force_command' option enabled. If the pipe transport is configured to run as a privileged user, a local attacker can use string expansion within their .forward file to manipulate command execution. This allows the attacker to execute arbitrary commands with the privileges of the user assigned to the pipe transport. The issue is resolved in version 4.99.5; a temporary mitigation is to disable the 'force_command' option on pipe transports.

## Affected products

- Exim Exim 4.82 through 4.99.4

## Timeline

- 2026-06-22: other: Report received by maintainers
- 2026-07-22: disclosed: Public release of advisory
- 2026-07-22: patched: Version 4.99.5 released
- 2026-07-24: advisory: NVD publication date

## References

- [https://openwall.com/lists/oss-security/2026/07/22/9](https://openwall.com/lists/oss-security/2026/07/22/9)

## Related threats

- [Exim SMTP smuggling in DATA phase rejection handling](https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received)
- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim out-of-bounds write in Proxy Protocol v1](https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim directory traversal in queue-name arguments](https://junglewise.ai/threats/cve-2026-66140-exim-directory-traversal-in-queue-name-arguments)