CVE-1999-0204

CRITICAL ⚠ Exploit

Sendmail 8.6.9 allows remote attackers to execute root commands, using ident.

Affects 1 product across 1 vendor.

CVSS 2.010.0
EPSS8.8%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity.
◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in Sendmail 8.6.9 allows remote attackers to execute arbitrary commands with root privileges through the ident protocol.

BSID: BS-1997-GLOBAL-164546-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-1999-0204?
A critical vulnerability in Sendmail 8.6.9 allows remote attackers to execute arbitrary commands with root privileges through the ident protocol.
What is the CVSS score for CVE-1999-0204?
CVE-1999-0204 has CVSS 10.0 (Critical). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. EPSS: 8.8%.
Is CVE-1999-0204 actively exploited?
Public exploit available for CVE-1999-0204. Exploitation risk elevated.
How do I remediate CVE-1999-0204?
Priority: IMMEDIATE.
What systems are affected by CVE-1999-0204?
CVE-1999-0204 affects Eric Allman Sendmail.
Vulnerability Details
CVE IDCVE-1999-0204
BSIDBS-1997-GLOBAL-164546-C BreachSpider Global ID
CVSS VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Published1997-01-01
Last Modified2026-06-16
ICS Relevance0%
SourceNVD
Official Description

Sendmail 8.6.9 allows remote attackers to execute root commands, using ident.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by sending specially crafted ident requests to the Sendmail service, which can lead to command execution with root privileges on the affected system.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Eric Allman Sendmail 8.6.9
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 10887 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Eric Allman
CVE-1999-0047 10.0 MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4. CVE-1999-0203 10.0 In Sendmail, attackers can gain root privileges via SMTP by specifying an imp... CVE-1999-0095 10.0 The debug command in Sendmail is enabled, allowing attackers to execute comma... CVE-1999-0206 10.0 MIME buffer overflow in Sendmail 8.8.0 and 8.8.1 gives root access. CVE-1999-0057 7.5 Vacation program allows command execution by remote users through a sendmail command.
View all Eric Allman CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →