CVE-1999-1588

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.8Critical EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 3 sources FixNone yetNo fix or workaround published

Published 2006-04-21Updated 2026-04-16Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether any server in your business still runs Sun Solaris x86 version 2.4, 2.5, or 2.5.1.
If you have no such systems, no action is needed — this cannot affect modern servers.
If you do find one, block TCP port 2766 at the firewall immediately to stop remote access to this service.
Contact your IT provider to plan retiring or upgrading this system, since no official patch is listed for this flaw.
Treat any such system as high priority for replacement, as it cannot be safely exposed to the internet.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka System V listener) port, TCP port 2766.

In plain language

Written by AI from the record

This is a very old, serious flaw in an old Sun Solaris network printing service — it only matters if you still run ancient Solaris x86 2.4/2.5/2.5.1 systems, which almost no business does today.

Unauthenticated remote code execution as root in nlps_server (System V listener) on Solaris x86 2.4/2.5/2.5.1, triggered by sending an oversized string prefixed with "NLPS:002:002:" to TCP port 2766, causing a stack buffer overflow (CWE-119).

If you're affected

Full server takeover
Root-level system compromise
Operational disruption
Legacy system exposure

What is it

Imagine an old intercom system at a business that, if someone shouts a specific long phrase into it, lets them walk straight into the manager's office and take over everything. That's what this flaw does to a decades-old Solaris printing service — anyone on the network can send a crafted message and gain full control of the computer, no password needed.

Who is affected

This matters only if you still operate Sun Solaris x86 systems running version 2.4, 2.5, or 2.5.1 — these are extremely old operating system releases that most businesses retired long ago. It only becomes a real risk if the nlps_server/listener service on TCP port 2766 is reachable from the network, which is common by default on affected systems.

How urgent is it

Working exploit code for this flaw already exists publicly, though there's no confirmed evidence it's being actively exploited in current attacks. Because the affected systems are decades old and rarely found in active use today, this stays at a moderate concern level rather than an emergency — but any system you do find running these versions should be isolated or retired promptly.

What to do — in detail

Confirm exposure by identifying any Solaris x86 hosts on the network running kernel/OS version 2.4, 2.5, or 2.5.1, and check if the System V listener (nlps_server) is bound to TCP port 2766. No vendor-supplied fixed version is documented in available findings, so patching is not currently an option. As a workaround, firewall or disable access to port 2766 entirely, or disable the nlps_server/listen service if it is not required. Given the age of the affected platform and lack of patch availability, the realistic long-term remediation is decommissioning or migrating these hosts to a supported OS. No CISA KEV due date applies since this CVE is not in the KEV catalog. Monitor for any unusual inbound traffic to port 2766 if the host cannot be immediately isolated.

Technical context

CVSS 9.8 (Critical) — network-exploitable, no authentication or user interaction required, full confidentiality/integrity/availability impact. Weakness class is a classic stack buffer overflow (CWE-119) triggered via an oversized string with prefix "NLPS:002:002:" sent to the nlps_server listener on TCP port 2766. Three public exploits exist, indicating established exploit maturity, though the vulnerability is not in CISA's KEV catalog and EPSS predicts a relatively low but notable likelihood of exploitation (falling trend) given the near-extinction of the affected platform. No vendor patch information is available in current findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

3 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 7475 days, from the signal feeds we watch.

2026-10-08EPSS band changelow → moderateepss band change
2026-06-22EPSS band changemoderate → low
2026-04-16Record updated
2026-03-06Public exploit / PoCsource: other
2006-04-21Publishedweakness classified, att&ck mapped

Affected products

suncommercial · US
- solarisOSOn-premOperating Systems / unix-bsd

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable