CVSS—
Severityhigh
Weakness—
EPSS99.8%100.0th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueMay 3, 2022
patch window
Called exploited the same day it was disclosed.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listingsame day
- Last KEV listing4.6y
- Last sighting4.8y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Nov 3, 2021
- EUVDENISA, European Unionlisted Nov 3, 2021
- VulnCheck KEVcommercial researchlisted Mar 27, 2017
- CIRCLaggregator, mirrors the abovelisted Nov 3, 2021, not counted
Sources3 of 3
Listings differ by1682 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationwww.recordedfuture.com/blog/july-2026-cve-landscape
- reported exploitationhunt.io/blog/thailand-ministry-finance-targeted-with-hermes-
- reported exploitationwww.cisa.gov/sites/default/files/feeds/known_exploited_vulne
- reported exploitationsecurelist.com/operation-tunnelsnake-and-moriya-rootkit/1018
- reported exploitationdocuments.trendmicro.com/assets/appendix-following-the-trail
- reported exploitationwww.trendmicro.com/en_us/research/17/f/following-trail-black
8 public reports collected from VulnCheck and CIRCL, first on Mar 27, 2017. Each links to its original source. We have not verified them.
Description
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
Required action (CISA)
Apply updates per vendor instructions.
