CVE-2025-26794
Published: 21 February 2025
Summary
CVE-2025-26794 is a high-severity SQL Injection (CWE-89) vulnerability in Exim Exim. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Exim versions 4.98 before 4.98.1 are affected by a remote SQL injection vulnerability when SQLite hints and ETRN serialization are enabled. The flaw, identified as CVE-2025-26794 and assigned CWE-89, carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high availability impact with no confidentiality or integrity effects. A note in the description indicates that fully resolving the injection in certain non-default rate-limit configurations requires an update to 4.99.1.
Remote unauthenticated attackers can supply crafted input over the network to trigger the injection, allowing them to interfere with database operations tied to the affected features and thereby cause denial of service.
Public references including the Exim security advisory and commit history direct administrators to apply the 4.98.1 release for the primary fix, with the 4.99.1 update required only in the specified rate-limit scenarios. The associated EPSS values have stabilized near 0.78, indicating sustained exploitation probability since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4451
Vulnerability details
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote SQL injection in public-facing Exim MTA directly enables exploitation of the application to cause denial of service (high availability impact, no C/I), mapping to application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through patching Exim to version 4.98.1 or later directly eliminates the SQL injection vulnerability in SQLite hints and ETRN serialization.
Information input validation prevents SQL injection attacks by ensuring inputs to Exim's SQLite database are properly checked and sanitized.
Denial-of-service protection mitigates the high-availability impact of the SQL injection by limiting traffic rates and detecting anomalous patterns in Exim.