CVE-2017-7269
Microsoft Windows Server Buffer Overflow Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2017-7269
Description
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 17, 2026- CISA added CVE-2017-7269 to the KEV catalog 1,682 days after its CVE record was published.
- It is one of 391 Microsoft entries in the CISA KEV catalog, and one of 83 added in 2021.
- Its current EPSS score (99.8%) is higher than that of 91% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
10 Links- https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812
- https://github.com/rapid7/metasploit-framework/pull/8162
- https://github.com/danigargu/explodingcan
- https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server
- https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html
- https://github.com/edwardz246003/IIS_exploit
Record Details
More from Microsoft
Microsoft HTTP.sys Remote Code Execution Vulnerability
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.