CVE-2019-10149

Exim MTA's improper input validation allowed remote command execution via recipient address manipulation.

The Exim Mail Transfer Agent failed to properly validate recipient addresses in the deliver_message() function, enabling remote command execution. DIB organizations must ensure their email infrastructure is patched against this actively exploited vulnerability, as unpatched MTAs are a common entry point for attackers seeking persistent access or lateral movement. Immediate patching and network segmentation of mail servers are required to mitigate this exposure.

Shame score — A known vulnerability in a critical infrastructure component was left unpatched and actively exploited in the wild, demonstrating severe negligence in maintaining secure email systems.