Microsoft IIS CVE-2026-78459

Exploitation requires the attacker to already possess low-privileged local access to a Windows host running Internet Information Services (CVSS PR:L, AV:L), with no user interaction needed (UI:N). The concrete prerequisite is running IIS on an affected, unpatched build (e.g., Windows Server 2016/2019/2022/2025, Windows Server 2012/2012 R2 including Server Core, or Windows 10/11 client builds below the fixed versions listed in EUVD). Limiting factors that reduce real-world risk: the attacker needs an existing authenticated/low-privilege foothold on the specific machine, exploitation is not remote and not network-reachable, and SSVC rates it non-automatable - so it functions as a local escalation step rather than a mass-exploitable entry point. Hosts where IIS is not installed are not affected.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: an attacker must already have low-privilege code execution on the host and low-complexity local access, from which they can achieve total compromise of confidentiality, integrity, and availability. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scripted at scale, consistent with the local, authenticated nature), but Technical Impact=total (matching C:H/I:H/A:H). No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no indication of public POC code, so active exploitation and weaponization are not supported by the data. The signals are internally consistent - a high-impact local EoP that is not currently exploited and not automatable - making this a solid patch-in-normal-cycle item rather than a drop-everything emergency, with priority rising sharply for multi-tenant or shared IIS servers where untrusted parties already hold low-privilege footholds.

An attacker who has already gained low-privileged access to a Windows server running IIS (for example via a web shell, a compromised service account, or a foothold on a shared hosting box) triggers the heap-based buffer overflow in IIS to corrupt memory and elevate to SYSTEM-level privileges. Because the attack vector is local and requires existing low privileges (PR:L) with no user interaction, it is a post-compromise escalation step, not an initial breach. No public exploit code was identified at the time of analysis.