---
id: "CVE-2026-119909"
page: "https://infrastack.ai/live/CVE-2026-119909"
kind: "vulnerability"
aliases: ["CVE-2026-119909"]
title: "Windows IIS: uncontrolled resource use lets an attacker cause denial of service"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["iis", "infrastructure", "self-hosted", "windows"]
not_affected_if: ["iis-not-installed"]
published_at: "2026-11-10T19:20:11+00:00"
first_seen_at: "2026-11-10T19:25:02+00:00"
updated_at: "2026-11-10T20:00:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119909", "first_seen_at": "2026-11-10T19:25:02+00:00"}]
exploit_sources: []
---

# Windows IIS: uncontrolled resource use lets an attacker cause denial of service

Link for people: https://infrastack.ai/live/CVE-2026-119909 (this .md is for agents)

Microsoft Internet Information Services on Windows consumes resources without limit when handling certain requests. An unauthenticated attacker over the network can exhaust the server and make it unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether IIS is installed and running on the Windows server, for example with `Get-WindowsFeature Web-Server` in PowerShell.
- Confirm the Windows build and installed updates against Microsoft's advisory for CVE-2026-119909: unknown from the sources.

## Timeline

- 2026-11-10T19:25:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119909

## From the sources

Uncontrolled resource consumption in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_