CVE-2025-26794

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL...

7.5 HighPublic exploitFix available

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

77.6%Up 77.6 points since Feb 22, 2025

What each source reports

CVE List Score used 7.5

Record: CVE-2025-26794
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2025-4451 7.5

Record: EUVD-2025-4451
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v8m7-99rg-xp5c 7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL...

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

Record: GHSA-v8m7-99rg-xp5c
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-89
Updated: 2026-11-02

NVD 7.5

Record: CVE-2025-26794
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV 7.5

Record: CVE-2025-26794
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-26794 9.8

Record: DEBIAN-CVE-2025-26794
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-26794 7.5

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

Record: UBUNTU-CVE-2025-26794
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14935-1 No score

exim-4.98.2-1.1 on GA media

These are all security issues fixed in the exim-4.98.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14935-1
Updated: 2026-11-02

Affected products

exim

Affected packages

Affected packages
Package	Affected	Fixed
`exim4` Debian:13	before 4.98-4	4.98-4
`exim4` Debian:14	before 4.98-4	4.98-4
`exim` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 4.98.2-1.1	4.98.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	OscarBataille/CVE-2025-26794	2025-02-22
PoC in GitHub	ishwardeepp/CVE-2025-26794-Exim-Mail-SQLi	2025-03-05
PoC in GitHub	XploitGh0st/CVE-2025-26794-exploit	2025-10-31

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, exploits, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-26794 is a high vulnerability (CVSS 7.5) in Exim, published February 21, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 77.6%, the 99th percentile. Fixed in exim4 4.98-4.

References

Show 14 moreShow less