Known vulnerabilities in Microsoft Internet Information Services (IIS)

Vendor: Microsoft
Software: Microsoft Internet Information Services (IIS)
Software CPE: cpe:2.3:a:microsoft:microsoft_iis:*:*:*:*:*:*:*:*
Website: https://www.microsoft.com
Total vulnerabilities: 30
Public exploits: 6
Known exploited (KEV): 4
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft Internet Information Services (IIS) Microsoft Internet Information Services (IIS) is affected by 30 known vulnerabilities: 3 critical, 9 high, 17 medium, 1 low Critical High Medium Low

Vulnerabilities (30)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133362 - Resource exhaustion
CVE-2026-49975		 CWE-400 High
No
No
 - 04.06.2026 SB2026060491
SB2026060492
SB2026060493
and 30 more
#VU126006 - Out-of-bounds read
CVE-2026-33096		 CWE-125 Medium
No
No
 - 14.04.2026 SB20260414130
#VU121231 - Improper Access Control
CVE-2026-20929		 CWE-284 Medium
No
No
 - 13.01.2026 SB2026011371
#VU117225 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-59282		 CWE-362 Medium
No
No
 - 15.10.2025 SB2025101584
#VU114366 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-55231		 CWE-362 High
No
No
 - 22.08.2025 SB2025082210
#VU107218 - Resource exhaustion
CVE-2025-27473		 CWE-400 High
No
No
 - 08.04.2025 SB2025040879
#VU88237 - Resource exhaustion
CVE-2024-26219		 CWE-400 Medium
No
No
 - 09.04.2024 SB2024040958
#VU81755 - Permissions, Privileges, and Access Controls
CVE-2023-36434		 CWE-264 Medium
No
No
 - 10.10.2023 SB2023101042
#VU81728 - Resource exhaustion
CVE-2023-44487		 CWE-400 High
Available
Exploited
 - 10.10.2023 SB2023101023
SB2023101024
SB2023101037
and 650 more
#VU78138 - Improper input validation
CVE-2023-32084		 CWE-20 Medium
No
No
 - 12.07.2023 SB2023071201
#VU78135 - Improper input validation
CVE-2023-35298		 CWE-20 Medium
No
No
 - 11.07.2023 SB2023071201
#VU73517 - Improper input validation
CVE-2023-23392		 CWE-20 High
No
No
 - 14.03.2023 SB2023031433
#VU66329 - Improper input validation
CVE-2022-35748		 CWE-20 Medium
No
No
 - 10.08.2022 SB2022081002
#VU65201 - Permissions, Privileges, and Access Controls
CVE-2022-30209		 CWE-264 High
No
No
 - 12.07.2022 SB2022071246
SB2022101718
#VU59392 - Memory corruption
CVE-2022-21907		 CWE-119 Critical
Available
Exploited
 - 11.01.2022 SB2022011116
SB2022111414
#VU57253 - Permissions, Privileges, and Access Controls
CVE-2021-26442		 CWE-264 Low
No
No
 - 12.10.2021 SB2021101213
SB2022111615
#VU29910 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
 CWE-444 Medium
No
No
 - 15.07.2020 SB2020071517
#VU25909 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
CVE-2020-0645		 CWE-113 Medium
No
No
 - 10.03.2020 SB2020031024
SB2022103134
#VU21646 - Memory corruption
CVE-2019-1365		 CWE-119 Medium
No
No
 - 09.10.2019 SB2019100901
#VU18777 - Improper input validation
CVE-2019-0941		 CWE-20 Medium
No
No
 - 12.06.2019 SB2019061204


Showing elements 1 - 20 out of 30