CVE-2019-10149

ENISA EUVD: EUVD-2019-2187 ↗
Exploited in the Wild ✓ Confirmed 0-Day
Triaged: March 20, 2026 4 articles Published: 2019-06-05
VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24
93.92%
probability
This CVE has a 93.92% probability of being exploited in the next 30 days.
0% Top 99.9th percentile of all CVEs 100%

CVSS v3.0

Source: VulnerabilityLookup (CIRCL)
9.0
CRITICAL
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

VulnerabilityLookup (CNA)
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Affected Products

exim
exim
4.92

Exploits & PoC

bananaphones/exim-rce-quickfix

quick fix for CVE-2019-10149, works on Debian\Ubuntu\Centos

22
Diefunction/CVE-2019-10149

CVE-2019-10149 : A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in

19
MNEMO-CERT/PoC--CVE-2019-10149_Exim

PoC for CVE-2019-10149, this vulnerability could be xploited betwen 4-87 to 4.91 version of Exim server.

14
cowbe0x004/eximrce-CVE-2019-10149

simple python socket connection to test if exim is vulnerable to CVE-2019-10149. The payload simply touch a file in /tmp/eximrce.

14
AzizMea/CVE-2019-10149-privilege-escalation

CVE-2019-10149 privilege escalation

9
darsigovrustam/CVE-2019-10149

Instructions for installing a vulnerable version of Exim and its expluatation

5
Chris-dev1/exim.exp

CVE-2019-10149

4
Brets0150/StickyExim

Exim Honey Pot for CVE-2019-10149 exploit attempts.

3
Stick-U235/CVE-2019-10149-Exploit

Exploit for CVE-2019-10149

2
9 repos — triés par ⭐ Rechercher sur GitHub ↗

Signal Intelligence

Confidenceⓘ
92%
EPSS 93.92%
CVSS v3.0 9.0
Mentions 4
Last Seen Sep 29, 2023

CNA Information

CNA Assigner
redhat

Analyst Note

CVE-2019-10149 is an Exim RCE vulnerability explicitly described as a zero-day with active in-the-wild exploitation. Multiple authoritative sources (TheHackerNews, BleepingComputer, Qualys) confirm exploitation occurred coincident with vendor patch release in 2019. Qualys's discovery report states the vulnerability was 'currently being actively attacked in the wild' at disclosure time.

Threat Actors 4

Turla Group
apt_group Information theft and espionage Russian Federation
Kinsing
apt_group 🇷🇺 RU
ELECTRUM
apt_group Information theft and espionage 🇷🇺 RU
TeamTNT
apt_group 🇩🇪 DE

Triage Info

Decided atMar 20, 2026
Published DateJun 05, 2019