CVE-2017-7269VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2017-7269: Microsoft Windows Server Buffer Overflow Vulnerability

Affects Microsoft Internet Information Services (IIS)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-7269 (opens in a new tab)

Description

CVE-2017-7269 is a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0 on Windows Server 2003 R2. It allows remote attackers to execute arbitrary code by sending a specially crafted PROPFIND request with a long header starting with "If: <http://". This vulnerability has been exploited in the wild.

Summary

Microsoft Windows Server 2003 R2 running IIS 6.0 contains a buffer overflow vulnerability (CWE-119) triggered by a long header beginning with "If: <http://" in a PROPFIND HTTP request. This flaw enables remote code execution by attackers who can send crafted requests to the affected server. The vulnerability is known to have been exploited in the wild, indicating active threat usage.

Impact

Successful exploitation allows remote attackers to execute arbitrary code on the affected server, potentially leading to full system compromise. Given the nature of IIS 6.0 and Windows Server 2003 R2, this can result in unauthorized control over the server and its resources.

Mitigation

No explicit patch or remediation information is provided in the input data. Since Windows Server 2003 and IIS 6.0 are legacy products, it is recommended to upgrade to supported versions of Windows Server and IIS. Administrators should check Microsoft's official advisories for any available patches or workarounds. Until patched, restricting access to IIS 6.0 servers and monitoring for exploit attempts is advised.

Weaknesses

CWE-119Buffer Errors (Memory Bounds) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:19:22 UTC

Weaknesses

References

Related threats