# CVE-2026-94057: Exim SMTP smuggling in DATA phase rejection handling

Source: https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94057 · Severity: medium · CVSS 4 · Published 2026-09-19

Exim mail server (versions before 4.100.1) is vulnerable to SMTP smuggling attacks where a remote attacker can cause the mail server to receive and process a message that differs from what the sending system sent and logged. An attacker exploits this by sending crafted data after a message rejection during the DATA phase, potentially allowing unauthorized message injection or modification.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2026-94057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94057 being exploited in the wild.

**How severe is CVE-2026-94057?** Medium severity, with a CVSS score of 4, published 19 September 2026.

**Which products and versions are affected?** Exim before 4.100.1.

**Is there a fix for CVE-2026-94057?** A patch was published on 2026-09-18: Fix available in Exim 4.100.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94057 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-94057?** Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This SMTP smuggling vulnerability in Exim's SMTP reception layer allows an attacker to send crafted data after a DATA-phase rejection, causing a mismatch between the logged message and what is actually received and processed. The vulnerability affects all Exim versions up to 4.100 and requires no special configuration or authentication. The fix, released in version 4.100.1, corrects the handling of message data after rejection points.

## Affected products

- Exim Exim before 4.100.1

## Timeline

- 2026-09-18: disclosed: Public release of Exim 4.100.1 with security fixes
- 2026-09-18: patched: Fix available in Exim 4.100.1

## References

- [https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html](https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html)

## Related threats

- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim out-of-bounds write in Proxy Protocol v1](https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim privilege escalation in .forward pipe transport force_command](https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command)
- [Exim directory traversal in queue-name arguments](https://junglewise.ai/threats/cve-2026-66140-exim-directory-traversal-in-queue-name-arguments)