CVE-2019-10149

Think of Exim as the “post office worker” that receives email and decides what to deliver. This bug is like a mistake in how it checks a specific part of a message address—an attacker can abuse that mistake to make the server run commands, not just deliver mail. If your business email runs on an affected Exim version, you should assume someone could potentially take control of the server remotely.

This matters if you run Exim as your mail server on Ubuntu, Debian, Astra Linux, Astra Linux Special Edition, or Red OS and you are using Exim version 4.87 through 4.91 (inclusive). The risk is real because exploitation is confirmed in the CISA Known Exploited Vulnerabilities list, and it does not require any login or user interaction. Reachability depends on whether the attacker can reach your mail-facing Exim service over the network; if your Exim is publicly reachable or otherwise reachable from the internet, the exposure is highest.

Red: this vulnerability is confirmed in the CISA KEV catalog, meaning attackers have been using it in the real world. It allows remote command execution without authentication, so the window for a server compromise is effectively very large if it’s reachable. Treat this as an immediate patch/mitigation priority, not a routine maintenance item.