Vulnerability Management Critical Exim vulnerability allows remote code execution May 14, 2026 Share By SC Staff Bleeping Computer reports that a critical vulnerability, identified as CVE-2026-45185, has been discovered in certain configurations of the Exim open-source mail transfer agent. This flaw could allow an unauthenticated remote attacker to execute arbitrary code on affected servers. The vulnerability, a user-after-free flaw, occurs during the TLS shutdown process when handling chunked SMTP traffic. It impacts Exim versions prior to 4.99.3 that use the default GnuTLS library and have STARTTLS and CHUNKING enabled. OpenSSL-based builds are not affected. Attackers could exploit this to run commands, access sensitive email data, and potentially pivot to other parts of the network. The vulnerability was discovered by XBOW researcher Federico Kirschbaum and a fix was released in Exim version 4.99.3. The development of a proof-of-concept exploit involved an AI system and a human researcher, highlighting the evolving landscape of vulnerability research. Users of Debian and Ubuntu-based Linux distributions are urged to update their Exim installations to the latest version to mitigate this risk. Source: Bleeping Computer SC Staff Related Patch/Configuration Management Critical Quest KACE SMA flaw exploited after 10 months SC Staff May 14, 2026 The critical vulnerability CVE-2025-32975 in Quest KACE Systems Management Appliance (SMA) was actively exploited by attackers who had not patched the system for 10 months after a fix was released in May 2025. Vulnerability Management Researcher publishes proof-of-concept exploits for unpatched Windows vulnerabilities SC Staff May 14, 2026 A cybersecurity researcher has released proof-of-concept exploits for two unpatched Microsoft Windows vulnerabilities, YellowKey and GreenPlasma, which allow for BitLocker bypass and privilege escalation, respectively. Patch/Configuration Management Microsoft addresses BitLocker recovery issue in Windows 11 SC Staff May 14, 2026 The issue, acknowledged on April 14, impacts Windows 10, Windows 11, and Windows Server devices configured with an "unrecommended" BitLocker Group Policy. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Bug Buffer Overflow Disassembly You can skip this ad in 5 seconds