In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail…
Priority MEDIUM 47Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a program.
Why it matters now
EPSS 0.02124 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eric_allman:sendmail:8.6.10:*:*:*:*:*:*:* | 8.6.10 | Vulnerable | Eric Allman |
- cpe:2.3:a:eric_allman:sendmail:8.6.10:*:*:*:*:*:*:* Versions 8.6.10 Vulnerable ·Eric Allman
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-1999-0203
- 2026-10-03 Alias added: GHSA-8vhw-fcrr-hw7r
References
—
More Eric Allman Sendmail vulnerabilities
- TI-1999-00094 The debug command in Sendmail is enabled, allowing attackers to execute commands as root. CVSS 2.0HIGH 10.0
- TI-1999-00201 Sendmail 8.6.9 allows remote attackers to execute root commands, using ident. CVSS 2.0HIGH 10.0
- TI-1999-00046 MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. CVSS 2.0HIGH 10.0
- TI-1999-00203 MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. CVSS 2.0HIGH 10.0
- TI-1999-00143 Sendmail WIZ command enabled, allowing root access. CVSS 2.0HIGH 7.2
- TI-1999-00128 Local users can start Sendmail in daemon mode and gain root privileges. CVSS 2.0HIGH 7.2
Sources
- CVE-1999-0203 · CVE Program
- CVE-1999-0203 · NVD
- FIRST EPSS
- GHSA-8vhw-fcrr-hw7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences