CVE-2001-1099: The default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x allows remote attackers to id...

Security readout for executives and security teams

This CVE describes an information leak in the default configuration of Norton AntiVirus for Microsoft Exchange 2000 2.x. A rejected malicious attachment could cause a notice that reveals the recipient mailbox INBOX file path. Business impact is mainly exposure of internal file-system details, not direct compromise. Exposure appears limited to legacy Microsoft Exchange 2000 environments using Norton AntiVirus for Microsoft Exchange 2000 2.x in the affected default configuration. Current exposure is likely rare but possible in long-lived or unmaintained mail systems. Treat this as a legacy exposure cleanup item unless the affected stack is internet-facing or business-critical. It does not indicate direct system takeover, but it can reveal internal paths useful for reconnaissance. Mitigation focus: Inventory legacy Exchange 2000 systems and Norton AntiVirus for Exchange versions.; Check Symantec/Norton guidance for supported fixes or configuration changes.; Prevent external rejection notices from exposing local file-system paths..

Prepared

Jul 1, 2026, 06:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.