Quick answers
- Is CVE-2026-94057 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-94057 being exploited in the wild.
- How severe is CVE-2026-94057?
- Medium severity, with a CVSS score of 4, published 19 September 2026.
- Which products and versions are affected?
- Exim before 4.100.1.
- Is there a fix for CVE-2026-94057?
- A patch was published on 2026-09-18: Fix available in Exim 4.100.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-94057 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-94057?
- Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This SMTP smuggling vulnerability in Exim's SMTP reception layer allows an attacker to send crafted data after a DATA-phase rejection, causing a mismatch between the logged message and what is actually received and processed. The vulnerability affects all Exim versions up to 4.100 and requires no special configuration or authentication. The fix, released in version 4.100.1, corrects the handling of message data after rejection points.
Affected products
- Exim Exim before 4.100.1
Timeline
- 2026-09-18: disclosed: Public release of Exim 4.100.1 with security fixes
- 2026-09-18: patched: Fix available in Exim 4.100.1