EUVD-2026-99671
GHSA-g7c3-c99g-mrrm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IIS over network
-
DeliverySend crafted request
-
ExploitOverflow stack buffer in parser
-
ExecutionHijack execution flow
-
ImpactRun arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires network reachability to a running Windows IIS instance and the ability to send the crafted input that reaches the vulnerable parsing path; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or privilege prerequisites, so this is remote unauthenticated exploitation against reachable IIS endpoints. Limiting factors: the target must actually run IIS and expose the affected service/endpoint to the attacker (internet-facing servers are most at risk; internal-only IIS reduces exposure), and the specific affected Windows/IIS versions should be confirmed from the MSRC advisory since the input provides no version/CPE detail. The description does not name a specific non-default feature or configuration toggle, so default IIS deployments appear in scope pending vendor confirmation. |
| Impact | This is a high-priority issue on signal convergence. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes unauthenticated, low-complexity, remote code execution against Windows IIS with full confidentiality, integrity, and availability impact - the classic 'wormable web server RCE' profile. IIS is an internet-facing component by design, so the network attack surface is real and often exposed. However, several enrichment signals are MISSING and must not be inferred: no EPSS probability was provided, there is no CISA KEV listing in the input, and no SSVC decision data or POC indicator was supplied, so 'no public exploit identified at time of analysis' is the accurate exploitation status. The absence of EPSS/KEV does NOT lower the intrinsic risk - it only means real-world exploitation velocity cannot be quantified from this data. One internal tension to verify: the CVSS maps the root weakness as a stack-based buffer overflow (CWE-121-style memory corruption), while the assigned CWE is CWE-20 (Improper Input Validation), a broader category; this is consistent (bad input leads to the overflow) but means the precise corruption primitive should be confirmed against Microsoft's MSRC advisory. Net: treat as a top-tier patch priority given unauthenticated remote RCE on a widely exposed service, while acknowledging that active-exploitation and in-the-wild velocity are currently UNKNOWN rather than confirmed. |
| Exploit ScenarioDerived | An attacker with network reachability to an internet-facing or intranet IIS server sends a specially crafted request that overflows a stack buffer during input parsing, corrupting the stack and redirecting execution to attacker-controlled code. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required, enabling direct remote code execution in the IIS worker process context. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote unauthenticated code execution affects Microsoft Internet Information Services (IIS) on Windows: a stack-based buffer overflow in a request-handling parsing path is reachable over the network by anyone who can send crafted input to a running IIS instance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicates no authentication, no user interaction, and no prior privileges are needed, and a successful exploit yields full loss of confidentiality, integrity, and availability on the host. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but the combination of low attack complexity and unauthenticated network reachability makes this a high-priority item for any internet-facing IIS deployment; version and build specifics must be confirmed from Microsoft's advisory, since no CPE or version detail is provided in the available intelligence.
RemediationAI
Apply the vendor fix as soon as Microsoft publishes the applicable Windows cumulative update or IIS-specific patch for the affected builds; the only reference supplied is the MSRC Security Update Guide entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70024, which carries the authoritative version mapping, and no explicit fix version or patch-status field is present in the available data, so the exact patched build could not be confirmed from this intelligence and should be verified directly against that advisory. Until a verified update is deployed, reduce exposure with compensating controls that address the AV:N/PR:N attack surface: remove or block direct internet reachability to IIS where the service is not meant to be public (firewall/NSG rules or reverse-proxy-only access), accepting the trade-off that legitimate external clients must be migrated to the proxy path; deploy WAF/request-inspection rules that reject malformed or oversized input targeting the affected parsing path, understanding that signature-based filtering is bypassable and creates false-positive risk for legitimate request bodies; disable unused IIS modules, handlers, and application pools to shrink the reachable parsing surface, at the cost of breaking dependent applications; and restrict IIS to internal networks with authenticated reverse proxies in front of it. Because exploitation is remote and unauthenticated with no user interaction, prioritize patching internet-facing IIS and monitor w3wp.exe crash/exception telemetry (WER dumps, HTTP.sys error logs, IIS worker process recycling) as a detection signal for exploitation attempts in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IIS is Microsoft's built-in Windows web server, typically fronted by HTTP.sys with request handling performed in worker processes (w3wp.exe) under application pools. The flaw is a stack-based buffer overflow occurring when IIS parses attacker-supplied network input that reaches a vulnerable parsing path - an unchecked or incorrectly bounded copy into a fixed-size stack buffer, overwriting adjacent stack memory (saved registers, return address) and potentially handing the attacker control of execution flow in the worker process context. The input classifies the root cause as CWE-20 (Improper Input Validation), the parent category describing the failure to validate or bound untrusted input before use; note that the more specific child weakness for a stack overflow is CWE-121, and the two are consistent with a missing length or bounds check on a request-derived value. Because the attack vector is AV:N/AC:L/PR:N/UI:N, no authentication, session, or user interaction is required - only network reachability to the affected IIS endpoint. The provided CPE data is empty, so neither the exact Windows Server releases nor the specific IIS component/module containing the overflow can be pinned down from this feed; the assessment explicitly notes that no version or CPE detail is available and that the affected builds should be confirmed from the MSRC Security Update Guide entry referenced as the sole source.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote RCE via a crafted network request needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N), and code execution yields full C/I/A within the IIS process scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Internet Information Services (IIS) on Windows is affected by a critical remote code execution flaw that allows an unauthenticated attacker with network access to take full control of a reachable web server. Because IIS typically fronts customer-facing portals and internal line-of-business applications, a successful compromise could expose sensitive data, interrupt revenue-generating services, and hand an attacker a foothold for lateral movement across the environment. Until Microsoft releases a fix, any internet-facing IIS deployment should be treated as a priority exposure item requiring compensating controls and heightened monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations: deploy application-layer firewall or reverse-proxy virtual patching and HTTP request inspection in front of all IIS endpoints; disable unused IIS modules, handlers, and features to shrink the parsing attack surface; restrict network reachability of IIS instances to only the sources that require access and segment web servers from internal networks; enforce least privilege for application pool identities; enable verbose IIS and Windows event logging plus endpoint detection for worker process crashes and anomalous child processes; and maintain an incident response plan capable of isolating and rebuilding an IIS host on short notice.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB