# Exim 4.100.1, two weeks on: cPanel 91% patched, others 8%

Two weeks after Exim 4.100.1, 75.2% of the 1.15M Exim servers that announce a version run it: 90.7% behind cPanel's greeting, 8.1% of the rest.

Exim 4.100.1, released on September 18, fixes four flaws ([the advisory](https://www.openwall.com/lists/oss-security/2026/09/19/2)). An SMTP smuggling flaw, rated Medium, affects every Exim up to and including 4.100. Two High-severity Proxy Protocol bugs, a heap over-read that ends in a one-byte write and a leak of stack data, affect 4.83 to 4.100 on a server built and configured for Proxy Protocol behind a buggy or compromised proxy. A Low use-after-free in TLS-on-connect needs a non-default option. The coverage since says how bad the bugs are, and nothing about how many servers have moved.

We counted with [SMTP IP](https://internetdata.io/databases/smtp-ip), which holds every host that returned an SMTP greeting on the mail submission port, 587, from our internet-wide scans. Between October 2 and 6, two weeks after the release, 2,697,057 hosts greeted there. 1,164,536 of them (43.2%) named Exim, ahead of Postfix with 586,601 (21.7%), Sendmail with 40,971 (1.5%) and Microsoft's server with 31,489 (1.2%).

## Who has moved

1,152,649 of the Exim servers announce their version in the greeting:

| Exim servers announcing a version | Servers | On 4.100.1 | On an older version |
|---|---|---|---|
| All of them | 1,152,649 | 866,801 (75.2%) | 285,848 (24.8%) |
| With cPanel's greeting | 936,356 | 849,363 (90.7%) | 86,993 (9.3%) |
| Every other | 216,293 | 17,438 (8.1%) | 198,855 (91.9%) |
| ...with a Debian or Ubuntu banner | 61,542 | 1 | 61,541 |

The cPanel servers are the ones whose greeting ends "We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.", the line cPanel's Exim configuration writes into its banner ([an example on cPanel's forum](https://support.cpanel.net/hc/en-us/community/posts/29531746629271-SMTP-Banner-on-Exim-sending-from-account-IP)). cPanel ships Exim inside its own cPanel & WHM builds, and for an Exim fix it [asks customers to update cPanel & WHM](https://support.cpanel.net/hc/en-us/articles/40243823578903-Exim-CVE-2026-40684-CVE-2026-40685-CVE-2026-40686-and-CVE-2026-40687) to a patched build. A server that takes cPanel's updates gets the new Exim with them.

Every other Exim comes from an operating system's package or a build its owner made, and 8.1% of those had moved.

## A version string isn't a patch level

Debian and Ubuntu backport security fixes into their own builds and keep the old version number. Debian 13's security update, `4.98.2-1+deb13u5`, fixes the 4.100.1 flaws and still announces 4.98.2, while Debian 12's 4.96 was still listed as vulnerable to them on October 9, by [Debian's security tracker](https://security-tracker.debian.org/tracker/source-package/exim4). So the 61,541 Debian and Ubuntu servers in the last row aren't all exposed, and this post says what servers announce, never which are vulnerable.

On a Debian or Ubuntu server you run, the package's changelog lists the CVEs its build fixes. The banner doesn't.

## The long tail

125,283 Exim servers (10.9%) announce a release older than 4.97, and 3,398 one older than 4.83, from before 2014.

## Finding Exim in your own ranges

SMTP IP has the greeting each host sent, line breaks collapsed to spaces, so a filter on `Exim 4.` over the ranges you own or protect, grouped by the version that follows, lists the servers still announcing an old release. The same goes for a customer's ranges, or a supplier's. [SSH IP](https://internetdata.io/databases/ssh-ip) does the same for SSH servers on port 22.

## How we counted

We took the SMTP IP hosts seen from October 2 to 6, read Exim's version from each greeting, and counted a greeting as cPanel's when it carried the line above, and as Debian or Ubuntu when it named either. A version is "older" when it's anything before 4.100.1.

SMTP IP is a gzipped CSV download, and [its docs](https://docs.internetdata.io/database/smtp-ip) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).