Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2000-1209: The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.

70
This week
HIGH 10.0WATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE

CVE-2000-1209 is a high-severity flaw (CVSS 10.0) affecting insight manager, insight manager xe, data engine. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS) (5) Compaq Insight Manager, and (6) Visio 2000, which allows remote attackers to gain privileges, as exploited by worms such as Voyager Alpha Force and Spida.

Why this priority

  • Critical severity
  • EPSS top 1%: very likely to be exploited
  • Public exploit reference
  • On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score10.0 (High)
EPSS exploit chance87.3% (top 1%)
CISA exploited listNo
Published2002-08-12
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: compaq · microsoft

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

compaq insight manager DOWNGRADE
Affected: 7.0 · 7.0 sp1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.0
1. Check installed version
apt-cache policy insight-manager || rpm -q insight-manager || insight-manager --version
2. No fixed release: DOWNGRADE to a release before 7.0 (Debian / Ubuntu)
apt-cache madison insight-manager sudo apt install insight-manager=<VERSION_BEFORE_7.0> sudo apt-mark hold insight-manager
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list insight-manager sudo dnf downgrade insight-manager-<VERSION_BEFORE_7.0> sudo dnf versionlock add insight-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
compaq insight manager xe DOWNGRADE
Affected: 1.1 · 1.21 · 2.1 · 2.1b · 2.1c · 2.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.1
1. Check installed version
apt-cache policy insight-manager-xe || rpm -q insight-manager-xe || insight-manager-xe --version
2. No fixed release: DOWNGRADE to a release before 1.1 (Debian / Ubuntu)
apt-cache madison insight-manager-xe sudo apt install insight-manager-xe=<VERSION_BEFORE_1.1> sudo apt-mark hold insight-manager-xe
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list insight-manager-xe sudo dnf downgrade insight-manager-xe-<VERSION_BEFORE_1.1> sudo dnf versionlock add insight-manager-xe
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft data engine DOWNGRADE
Affected: 1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy data-engine || rpm -q data-engine || data-engine --version
2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison data-engine sudo apt install data-engine=<VERSION_BEFORE_1.0> sudo apt-mark hold data-engine
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list data-engine sudo dnf downgrade data-engine-<VERSION_BEFORE_1.0> sudo dnf versionlock add data-engine
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft msde DOWNGRADE
Affected: 2000
Fixed in: no fixed release known
Safe to downgrade to: a release before 2000
1. Check installed version
apt-cache policy msde || rpm -q msde || msde --version
2. No fixed release: DOWNGRADE to a release before 2000 (Debian / Ubuntu)
apt-cache madison msde sudo apt install msde=<VERSION_BEFORE_2000> sudo apt-mark hold msde
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list msde sudo dnf downgrade msde-<VERSION_BEFORE_2000> sudo dnf versionlock add msde
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · rust-cargo-semver-checks · FIXED · 0.51.0-7.fc46 · FEDORA-2026-1bbb7e855a · source
sudo dnf upgrade --advisory=FEDORA-2026-1bbb7e855a
Fedora ELN · fuse-sshfs · FIXED · 3.7.6-3.eln159 · FEDORA-2026-bcb7be7c5c · source
sudo dnf upgrade --advisory=FEDORA-2026-bcb7be7c5c

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2000-1209?

insight manager: downgrade or apply the listed mitigation; insight manager xe: downgrade or apply the listed mitigation; data engine: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2000-1209 being exploited?

CVE-2000-1209 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2000-1209 affect?

CVE-2000-1209 affects insight manager, insight manager xe, data engine. Severity is high (CVSS 10.0). The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4) Tumbleweed Secure Mail (MMS)

How urgent is CVE-2000-1209?

Priority 70/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist

Software pages

Microsoft SQL Server vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.