ReconXWatchtower

Where this stands

First reported 13/10/2026 16:00

  1. 1Unconfirmed reportnot observed
  2. 2Corroboratednot observed
  3. 3Confirmed now13/10/2026 16:00Microsoft Security Update Guide
  4. 4Exploitednot yet

Unconfirmed report and Corroborated were never seen on its own: the first report we had was already stronger.

Critical remote code execution flaw in Windows IIS (CVE-2026-70024), fixed in Microsoft's October 2026 updates

Microsoft IIS · Critical

≈3.62Minternet-facing systems run Microsoft IISShodan estimate · 27/10/2026

CVE-2026-70024 CVE-2026-78459 CVE-2026-97830

Published 27/10/2026 11:00

Timeline

2 events over 13 d

  1. 13/10/2026 16:00ConfirmedMicrosoft Security Update Guide+13 d
  2. 27/10/2026 11:00Published on WatchtowerPro CISO

In short

CVE-2026-70024 is a critical flaw in Windows IIS that lets an attacker with no login run code on a server over the network. Microsoft confirms it and fixed it in its October 2026 security updates. Install the update that matches your Windows version, starting with servers reachable from the internet. Shodan estimates about 3.6 million internet-facing Microsoft IIS servers worldwide, 568,662 of them in the EU (27/10/2026); how many run an affected version is not yet known.

How bad is it

Critical: an attacker with no login can run code on a Windows server running IIS over the network.

Confirmed by the vendor or a CERT - no exploitation reported yet.

Severity score

9.8of 10Critical

The worst of 3 CVEs · CVSS 3.1 from NVD, from microsoft.com, read 27/10/2026.

What an attacker needs

  • Internet access to itEnough
  • A loginNot needed
  • A user to clickNo
  • Special settingsNo

Red helps the attacker, blue holds them back, grey is not published yet.

If it works, an attacker can

  • Run their own code on the system
  • Read the data it holds
  • Change or delete that data
  • Take it offline

Type: remote code execution.

A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.

Affected versions

  • Windows Internet Information Services (IIS) on the Windows versions below that run builds older than the fixed build: Windows 10 1607 / Server 2016 (incl. Server Core), Windows 10 1809 / Server 2019 (incl. Core), Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2 / 25H2 / 26H2, Windows 11 26H1, Server 2022 (incl. Core), Server 2025 (incl. Core), Server 2012 and Server 2012 R2.
  • Fixes for Windows 10 22H2, Server 2012 and Server 2012 R2 are listed under Extended Security Updates (ESU), Microsoft's paid support after end of life.
  • NCSC-NL says systems reachable from public networks are at higher risk. It says this about the whole October 2026 release.

What to do now

  • Install Microsoft's October 2026 security update on every Windows machine that runs IIS. Do this first on servers that can be reached from the internet, which NCSC-NL says are at higher risk.
  • Use the update number that matches your Windows version, then check that the build is at least the fixed build listed: Server 2016 / Win 10 1607: KB5126868 (10.0.14393.9612). Server 2019 / Win 10 1809: KB5126651 (10.0.17763.9376). Win 10 21H2: KB5126657 (10.0.19044.7807). Win 10 22H2 (ESU): KB5126657 (10.0.19045.7807). Win 11 23H2: KB5126653 (10.0.22631.7652). Win 11 24H2 / 25H2 / 26H2: KB5127648 (10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711). Win 11 26H1: KB5127646 (10.0.28000.3231). Server 2022: KB5126655 (10.0.20348.5761). Server 2025: KB5126646 (10.0.26100.33650). Server 2012 (ESU):
  • If you run Windows 10 22H2, Server 2012 or Server 2012 R2, check that the machine is enrolled in Extended Security Updates (ESU). The fixes for these versions are listed under ESU.
  • If a hosting provider manages your server, ask them to confirm in writing that the October 2026 update is installed and which build number the server now runs.
  • No interim measure or workaround from Microsoft is known at this time. Any interim measure would only reduce exposure and would not make a server safe. Installing the update is the only fix.

ReconX customers see the full notice - and their own systems

Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.

In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Microsoft IIS, at which version, fixed or not - and what each one needs.

Sign in to ReconXAbout ReconX

Main sources

CVE-2026-70024 Windows Internet Information Services Remote Code Execution Vulnerability Vendor · CVE-2026-97830 Windows Internet Information Services Denial of Service Vulnerability Vendor · CVE-2026-78459 Microsoft Internet Information Services Elevation of Privilege Vulnerability Vendor

Data: Shodan - Microsoft IIS (estimate, 27/10/2026)

← All Watchtower notices

Pro CISO publishes ReconX Watchtower notices from public sources so organisations can act early. A notice describes an issue, never any organisation's systems. Times are Amsterdam time. Report a vulnerability in our systems.

ReconX Watchtower opened to the public on 24 October 2026, in the wake of PHP2Shell - our contribution to a safer digital ecosystem.