Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-aab8eaa2e3 advisory.

    This is new exim version fixing CVE-2025-67896.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-223569b08a advisory.

    This is new exim version fixing CVE-2025-67896.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d7548ec9e2 advisory.

    This is an update fixing CVE 2025-30232.

    ----

    This is new version fixing possible remote SQL injection and FTBFS with gcc-15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e694138ac5 advisory.

    This is an update fixing possible remote SQL injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4dfc188932 advisory.

    This is an update fixing possible remote SQL injection.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 07c34df5-f299-11ef-a441-b42e991fc52e advisory.

    cve@mitre.org reports:
    Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization             are used, allows remote SQL injection.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
294792	Fedora 42 : exim (2026-aab8eaa2e3)	Nessus	Fedora Local Security Checks	critical
294774	Fedora 43 : exim (2026-223569b08a)	Nessus	Fedora Local Security Checks	critical
238051	Fedora 42 : exim (2025-d7548ec9e2)	Nessus	Fedora Local Security Checks	high
225809	Fedora 40 : exim (2025-e694138ac5)	Nessus	Fedora Local Security Checks	high
225808	Fedora 41 : exim (2025-4dfc188932)	Nessus	Fedora Local Security Checks	high
216708	FreeBSD : exim -- SQL injection (07c34df5-f299-11ef-a441-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	critical
216608	Exim < 4.98.1 SQL injection	Nessus	SMTP problems	critical

Detections

Analytics

CVE-2025-26794

critical

Tenable Plugins

critical

critical

high

high

high

critical

critical