CVE-2019-16928

Exim Internet Mailer's unpatched out-of-bounds write vulnerability allowed remote code execution and was actively exploited in the wild.

Exim's CVE-2019-16928 was an out-of-bounds write flaw enabling remote code execution, which remained unpatched long enough to be added to CISA's KEV catalog. DIB organizations must ensure mail servers are patched against known RCE vulnerabilities to prevent attackers from compromising email infrastructure and exfiltrating sensitive data. The failure highlights the risk of relying on unpatched software and the necessity of continuous vulnerability management.

Shame score — The vulnerability was known, unpatched, and actively exploited in the wild, demonstrating negligence in maintaining secure email infrastructure.