---
id: "CVE-2017-7269"
kind: "vulnerability"
aliases: ["CVE-2017-7269"]
title: "Microsoft Internet Information Services (IIS): Microsoft Windows Server Buffer Overflow Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99823
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Internet Information Services (IIS)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "iis", "infrastructure", "self-hosted", "windows-server-2003"]
not_affected_if: ["iis-7-or-later", "webdav-disabled"]
published_at: "2017-03-27T02:59:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7269", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-7269", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7269", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Internet Information Services (IIS): Microsoft Windows Server Buffer Overflow Vulnerability

Microsoft IIS 6.0 on Windows Server 2003 R2 has a buffer overflow triggered by an overlong "If: <http://" header in a PROPFIND request. A remote attacker can execute code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Internet Information Services (IIS) affected ? fixed ?

## Fix

Apply updates per vendor instructions, as CISA requires; the sources do not name a specific patch or version.
Retire Windows Server 2003 if it is still in use, since it is out of support.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-7269
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-7269
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-7269

## From the sources

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_