Vendor scorecard
CISA lists 5 Exim vulnerabilities as exploited in the wild, 0 of them added in the last 12 months (flat from 0 in the 12 months before). 1 (20%) are known to be used in ransomware campaigns. Most affected: Exim (3), Exim Internet Mailer (1), Mail Transfer Agent (MTA) (1).
| Product | KEV entries |
|---|---|
| Exim | 3 |
| Exim Internet Mailer | 1 |
| Mail Transfer Agent (MTA) | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2010-4345 | Exim Privilege Escalation VulnerabilityExim | |
| CVE-2010-4344 | Exim Heap-Based Buffer Overflow VulnerabilityExim | |
| CVE-2019-16928 | Exim Out-of-bounds Write VulnerabilityExim Internet Mailer | |
| CVE-2019-10149 | Exim Mail Transfer Agent (MTA) Improper Input ValidationMail Transfer Agent (MTA) | |
| CVE-2018-6789 | Exim Buffer Overflow VulnerabilityRANSOMWAREExim |
Get an email when CISA adds the next Exim CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (0 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →