onyx

onyx --cves cve-2020-28026

CVE-2020-28026

CRITExim
score
<0.1
cvss
9.8
epss
9.3%
published
2021-05-06
kev added
—
first seen

Exim 4 < 4.94.2 contains a command injection caused by improper neutralization of line delimiters in non-default configurations with DSN enabled, letting unauthenticated remote attackers execute arbitrary commands as root, exploit requires enabling Delivery Status Notification (DSN) and specific header manipulation.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-05-06 — PublishedP2026-10-21 — Tracked by OnyxTscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 9.3%2026-09-23: epss 9.3%2026-09-24: epss 9.3%2026-09-25: epss 9.3%2026-09-26: epss 9.3%2026-09-27: epss 9.3%2026-09-28: epss 9.3%2026-09-29: epss 9.3%2026-09-30: epss 9.3%2026-10-01: epss 9.3%2026-10-02: epss 9.3%2026-10-03: epss 9.3%2026-10-04: epss 9.3%2026-10-05: epss 9.3%2026-10-06: epss 9.3%2026-10-07: epss 9.3%2026-10-08: epss 9.3%2026-10-09: epss 9.3%2026-10-10: epss 9.3%2026-10-11: epss 9.3%2026-10-12: epss 9.3%2026-10-13: epss 9.3%2026-10-14: epss 9.3%2026-10-15: epss 9.3%2026-10-16: epss 9.3%2026-10-18: epss 9.3%2026-10-19: epss 9.3%2026-10-20: epss 9.3%2026-10-21: epss 9.3%9.3%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx

Weaknesses

NVD-CWE-Other

References 1