Threat reportVulnerabilityTL-2026-1692
Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and .forward Privilege Escalation (CVE-2026-66141, CVSS 7.4) Enable Local Privilege Escalation via Queue-Name Argument and force_command Abuse
Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and (TL-2026-1692), also tracked as EXIM-Security-2026-06-22.1, is a high-severity software vulnerability scored CVSS 8.4, first published 2026-07-25. It has no confirmed attribution, affects Exim Exim Internet Mailer (queue-name command-line handling), references 2 CVEs (CVE-2026-66140, CVE-2026-66141), maps to 13 MITRE ATT&CK techniques (T1003, T1005, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
- CVSS
- 8.4/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 20Indicators of compromise
Key facts for TL-2026-1692
- Threat ID
- TL-2026-1692
- Also known as
- EXIM-Security-2026-06-22.1, GCVE-25-2026-07-45-1, EXIM-Security-2026-06-22.3, GCVE-25-2026-07-45-3
- Severity
- HIGH
- CVSS
- 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- hostingproviders, managedserviceproviders, technology, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
Malware and tooling: Exim Internet Mailer
How Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and works
Exim 4.88-4.99.4 mishandles command-line arguments used to transfer queue-name across its internal execution chain (the -MC/-MCG re-exec options), letting a local attacker with shell access traverse outside the mail spool directory and reach arbitrary files, enabling privilege escalation (CVE-2026-66140, CVSS 8.4). A companion flaw in Exim 4.82-4.99.4 mishandles force_command expansion of a local_part in pipe transports invoked from a user's .forward file, providing a second local privilege-escalation path (CVE-2026-66141, CVSS 7.4). Both are fixed in Exim 4.99.5; no workaround exists, no public PoC or in-the-wild exploitation has been observed, and neither CVE is CISA KEV-listed.
On 2026-07-22 the Exim security team (announced by maintainer Jeremy Harris on the oss-security mailing list) published two coordinated security advisories against the Exim Internet Mailer, the open-source MTA that runs a substantial share of the world's SMTP mail infrastructure.
The first, EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1, CVE-2026-66140, CWE-24 Path Traversal), affects Exim 4.88 through 4.99.4. Exim re-executes itself internally to hand off delivery work using options that are explicitly documented as "not intended for use by external callers" -- most notably -MC (invoke another Exim instance to deliver a waiting message over an existing SMTP connection) and its companion -MCG <queue name> (signal that an alternate, named queue is in use). Because the queue-name value passed through this internal execution chain was not validated for path-traversal sequences or restricted to already-privileged users, a local attacker with command-line access could manipulate the queue-name argument to escape the configured spool directory and reach files outside it. Since Exim performs certain queue-management operations with elevated privileges, this out-of-spool file access can be leveraged for local privilege escalation, with particular risk in multi-user systems, shared/multi-tenant hosting, and containerized deployments where local shell access is more commonly available to untrusted parties.
The second, EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3, CVE-2026-66141, CWE-829 Inclusion of Functionality from Untrusted Control Sphere), affects Exim 4.82 through 4.99.4. It requires four configuration elements to be present: a redirect router granting local users .forward-file support, a reachable pipe transport, that pipe transport configured with force_command, and the pipe transport itself running as a privileged user -- a configuration pattern used to force a fixed command while still allowing limited per-user customization. Exim mishandled the expansion of the local_part inside force_command, so a local user who controls their own .forward file could inject a string-expansion that altered the command executed by the privileged pipe transport, again yielding local privilege escalation.
Both advisories credit "the unnamed and uncredited authors whose works were ingested as the training corpus" -- an unusual attribution that multiple outlets (warp2search, linuxcompatible) reported as evidence the flaws were surfaced through AI/LLM-assisted vulnerability research rather than traditional manual audit, a first for the Exim project. Exim 4.99.5, released the same day, fixes both issues: it restricts the queue-name-transferring command-line options to already-privileged users and enforces stricter character validation on queue names (CVE-2026-66140), and it removes the expansion of local_part under force_command in pipe transports (CVE-2026-66141). No interim workaround exists for either issue beyond upgrading; administrators can partially reduce CVE-2026-66141 exposure pre-patch by removing force_command from pipe transport configurations. Both vulnerabilities require pre-existing local command-line access and are not remotely exploitable; no public proof-of-concept code and no evidence of in-the-wild exploitation had been reported as of 2026-07-25, and neither CVE appears in the CISA Known Exploited Vulnerabilities catalog.
MITRE ATT&CK techniques used in TL-2026-1692
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Collection
T1005 Data from Local System; T1114 Email Collection
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Initial Access
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Defense Evasion
T1211 Exploitation for Stealth
Persistence
T1546 Event Triggered Execution
privilege-escalation
Affected products and versions in Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
Remediation for Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
Patches
- Exim 4.99.5 -- restricts command-line options that transfer queue-name across Exim's internal execution chain to already-privileged users and enforces stricter character validation on queue names (fixes CVE-2026-66140)
- Exim 4.99.5 -- removes expansion of local_part under force_command in pipe transports (fixes CVE-2026-66141)
Immediate actions
- Upgrade Exim to version 4.99.5 or later immediately -- no workaround exists for either CVE-2026-66140 or CVE-2026-66141
- Audit systems for untrusted or unnecessary local shell/command-line access before and after patching, especially on shared-hosting and multi-tenant hosts
- Review any pipe transport configurations that use force_command and remove it where not strictly required, as a partial mitigation for CVE-2026-66141 pending patch deployment
Workarounds
- None published for CVE-2026-66140 -- the Exim security team states upgrading is the only remediation
- Partial mitigation for CVE-2026-66141: remove force_command from pipe transport configurations until upgraded to 4.99.5
Longer-term hardening
- Prioritize patch rollout on multi-user, shared-hosting, and containerized Exim deployments where local shell access by untrusted parties is more likely
- Monitor and alert on invocation of Exim's internal re-exec options (-MC, -MCG, -MCA, -MCD, -MCQ, etc.) by processes other than Exim itself, since these are documented as not intended for external callers
- Apply mandatory access controls (SELinux/AppArmor) constraining the Exim binary's ability to read files outside the configured spool directory
- Where .forward support is offered to local users, avoid pairing redirect routers with privileged pipe transports that use force_command
CVEs associated with Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
Weaknesses (CWE) in Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
Timeline of Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
- Exim 4.82 released, the earliest version later found vulnerable to the force_command/.forward privilege-escalation flaw (CVE-2026-66141).
- Exim 4.88 released, the earliest version later found vulnerable to the queue-name directory-traversal flaw (CVE-2026-66140).
- Both vulnerabilities reported to the Exim security team.
- Exim security team drafts fixes for both the queue-name traversal and force_command/.forward flaws.
- GCVE identifiers assigned to the vulnerabilities (GCVE-25-2026-07-45-1 and GCVE-25-2026-07-45-3).
- Fix branch/tag pushed to the Exim source repository ahead of public release.
- GBHackers publishes initial coverage of the queue-name directory traversal flaw.
- CVE-2026-66140 (CVSS 8.4) and CVE-2026-66141 (CVSS 7.4) published in the CVE dictionary.
- Exim 4.99.5 released, fixing both CVE-2026-66140 and CVE-2026-66141; maintainer Jeremy Harris publicly announces the advisories EXIM-Security-2026-06-22.1 and EXIM-Security-2026-06-22.3 on the oss-security mailing list.
- CyberSecurityNews, CyberPress, SecurityOnline.info, TeamWin, Warp2Search, and LinuxCompatible publish follow-up coverage, including reporting on the advisories' unusual AI/LLM-training-corpus discovery credit.
- INCIBE-CERT publishes a CVE-2026-66141 early-warning alert entry with CVSS vector detail.
Sources cited for Exim Directory Traversal (CVE-2026-66140, CVSS 8.4) and
- EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1) official advisory
- EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3) official advisory
- oss-security mailing list: Exim security release announcement
- Exim Vulnerability Lets Attackers Access Files Outside the Mail Spool
- Exim Directory Traversal Vulnerability Enables Privilege Escalation Attacks
- Exim Directory Traversal Vulnerability Exposes Files Outside the Mail Spool
- Exim Directory Traversal Flaw Enables Privilege Escalation, Fixed in 4.99.5
- Exim Directory Traversal Vulnerability Enables Privilege Escalation Attacks
- Exim 4.99.5 Drops AI-Discovered Security Patches for Mail Servers
- Exim 4.99.5 Drops AI-Discovered Security Patches for Mail Servers
- Exim 4.99.5 security release (community discussion thread)
- CVE-2026-66141 alert entry
Detection coverage for TL-2026-1692
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1692 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.