# CVE-1999-0095: Sendmail debug command enabled remote command execution

Source: https://junglewise.ai/threats/cve-1999-0095-sendmail-debug-command-enabled-remote-command-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1988-10-01. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0095 · Severity: critical · CVSS 10 · Published 1988-10-01

A critical vulnerability exists in Sendmail, a widely used mail transfer agent, where a debugging feature was left enabled by default. This allows an unauthorized person to remotely issue commands that the server will execute with the highest possible system privileges (root). An attacker could use this to take full control of the server, access sensitive emails, or disrupt mail services.

Technologies: [Eric Allman Sendmail](https://junglewise.ai/threats/technologies/sendmail). Vendors: [Eric Allman](https://junglewise.ai/threats/vendors/eric-allman).

## Quick answers

**Is CVE-1999-0095 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0095 being exploited in the wild.

**How severe is CVE-1999-0095?** Critical severity, with a CVSS score of 10, published 1 October 1988.

**Which products and versions are affected?** Sendmail Sendmail All versions prior to 1988 patch.

**Is there a fix for CVE-1999-0095?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0095 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-0095?** Check whether you run Eric Allman Sendmail. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Sendmail SMTP server was historically distributed with the 'DEBUG' command enabled in its production configuration. By connecting to the SMTP port (typically 25) and issuing the DEBUG command, an attacker can bypass standard security restrictions and execute arbitrary shell commands via the mail pipe. These commands are executed with root privileges because the Sendmail daemon typically runs as the superuser to manage mail delivery. This is a classic example of a 'backdoor' or insecure default configuration that allows full remote command execution (RCE) without authentication.

## Affected products

- Sendmail Sendmail All versions prior to 1988 patch

## Timeline

- 1988-10-01: disclosed: Vulnerability became widely known during the Morris Worm era.
- 1988-10-01: advisory

## References

- [http://seclists.org/fulldisclosure/2019/Jun/16](http://seclists.org/fulldisclosure/2019/Jun/16)
- [http://www.openwall.com/lists/oss-security/2019/06/05/4](http://www.openwall.com/lists/oss-security/2019/06/05/4)
- [http://www.openwall.com/lists/oss-security/2019/06/06/1](http://www.openwall.com/lists/oss-security/2019/06/06/1)
- [http://www.osvdb.org/195](http://www.osvdb.org/195)
- [http://www.securityfocus.com/bid/1](http://www.securityfocus.com/bid/1)

## Related threats

- [Sendmail remote command execution via ident](https://junglewise.ai/threats/cve-1999-0204-sendmail-remote-command-execution-via-ident)
- [Sendmail command injection via pipe character](https://junglewise.ai/threats/cve-1999-0163-sendmail-command-injection-via-pipe-character)
- [Sendmail arbitrary command execution via SMTP bounce manipulation](https://junglewise.ai/threats/cve-1999-0203-sendmail-arbitrary-command-execution-via-smtp-bounce-manipulation)
- [Sendmail WIZ command enabled allowing root access](https://junglewise.ai/threats/cve-1999-0145-sendmail-wiz-command-enabled-allowing-root-access)