CVE-1999-0819: NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.

Security readout for executives and security teams

NTMail reportedly left the SMTP VRFY user-verification feature available even after an administrator disabled it. That could let outsiders confirm whether email accounts exist, supporting targeted phishing or reconnaissance. The source record is sparse and does not identify affected versions or a vendor fix. Exposure is limited to organizations still running NTMail, especially where its SMTP service is reachable by untrusted networks. Affected versions are not specified in the sources. Treat this as a legacy exposure review rather than an emergency unless NTMail is internet-facing. The main risk is account discovery that can improve phishing and reconnaissance. Mitigation focus: Identify whether NTMail is still deployed anywhere in production or legacy environments.; Check archived vendor guidance for a fixed version or supported configuration workaround.; Restrict SMTP access to trusted systems where business requirements allow..

Prepared

Jul 12, 2026, 05:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.