Cyber ·
USN-9086-1: code execution in SA-Exim via SpamAssassin greylisting
An Ubuntu Security feed notice describes unsafe evaluation of parameters in a SpamAssassin greylisting rule in SA-Exim, which may allow code execution by anyone able to write its configuration or rule files.
According to notice USN-9086-1, published on 12 November 2026 in the Ubuntu Security feed, SA-Exim unsafely evaluated the parameters of a SpamAssassin greylisting rule. An attacker able to write SpamAssassin configuration or rule files could possibly exploit this to run arbitrary code. The available text is an automatic translation and does not state affected versions, fixed versions or CVE identifiers; these should be checked in the original notice, located by the identifier USN-9086-1 in the Ubuntu Security notices database. For administrators, the main measure is to apply the vendor update indicated and restrict write access to SpamAssassin configuration and rule files to accounts that strictly need it.