A dangerous security flaw has been discovered in Exim, a widely used email server software. The vulnerability, officially tracked as CVE-2025-26794, allows hackers to inject harmful commands into the system, potentially leading to data theft or even complete control over the email server. This issue affects Exim version 4.98 when used with a specific database system called SQLite. Experts warn that this is one of the biggest email security threats of 2025.
How This Vulnerability Works
The problem occurs because of the way Exim handles database queries under certain settings. It mainly affects systems that:
1. Use SQLite for storing email-related data – This happens when Exim is set up with a special feature called `USE_SQLITE`.
2. Enable the ETRN command – This is a function that allows users to request email deliveries, but it can be misused if not properly restricted.
3. Have weak protections against command execution – Some default settings make it easier for attackers to sneak in harmful database commands.
If all these conditions are met, a hacker can send specially designed emails to the server, tricking it into running unauthorized commands. This could allow them to access sensitive information, modify system settings, or even take control of the entire email system.
How Attackers Can Use This Flaw
For this security risk to be exploited, three things need to be true:
1. The system must be running Exim 4.98 with SQLite enabled.
2. The ETRN command must be set to "accept" instead of the safer "deny" mode.
3. A specific security setting, smtp_etrn_serialize, must be left at its default value, which can create a loophole for hackers.
Even though Exim’s default settings provide some level of security, many organizations adjust them to work with older systems, unknowingly making their servers more vulnerable.
Steps to Stay Safe
To protect email systems from this issue, cybersecurity experts recommend taking the following steps immediately:
1. Check which version of Exim is installed using the command `exim -bV`.
2. Disable SQLite integration if it’s not necessary.
3. Modify ETRN settings to prevent unauthorized use.
4. Update to the latest Exim version (4.98.1), which includes a fix for this problem.
For organizations that must continue using SQLite, additional security measures should be in place, such as filtering out risky commands and monitoring unusual activity in the database.
How Exim Developers Responded
The Exim development team acted quickly by releasing a patched version within 72 hours after confirming the issue. The flaw was originally reported by cybersecurity researcher Oscar Bataille, who followed responsible disclosure guidelines. This allowed Exim’s developers to fix the problem before it became public, reducing the chances of widespread attacks.
Why This Matters
Exim is used by over 60% of email servers on the internet, meaning this flaw could have affected millions of systems worldwide. This incident is a reminder that even well-established software can have hidden weaknesses, especially when newer features interact with older components.
To stay safe, organizations must regularly update their email software, follow security best practices, and stay informed about new threats. The faster vulnerabilities like this are addressed, the lower the risk of cyberattacks.