CVE-2026-66141 Privilege escalation in Exim

What is CVE-2026-66141?

CVE-2026-66141 is a high-severity vulnerability in Exim Exim, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

Weakness: CWE-829

Which versions are affected by CVE-2026-66141?

It affects 1 product.

Products include Exim Exim.

How do I fix CVE-2026-66141?

Upgrade to a fixed version.

Is CVE-2026-66141 being exploited?

There is no known exploitation of CVE-2026-66141 in the wild and no public exploit code.

Other vulnerabilities in Exim Exim

• CVE-2026-45185 Use after free in Exim Critical 9.8
• CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability Critical 9.8
• CVE-2020-28017 Integer overflow in n/a Critical 9.8
• CVE-2020-28018 Use after free in n/a Critical 9.8
• CVE-2020-28020 Integer overflow in n/a Critical 9.8

All Exim Exim vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1787310808, DEBIAN-CVE-2026-66141, GHSA-mffw-2crm-m32h, ROOT-OS-DEBIAN-11-CVE-2026-66141, ROOT-OS-DEBIAN-12-CVE-2026-66141, UBUNTU-CVE-2026-66141.