Microsoft IIS: race condition remote code execution flaw (CVE-2026-119961) confirmed by Microsoft, no fix details yet
Published 10/11/2026 21:11
Timeline
2 events over 4 h
- 10/11/2026 17:00ConfirmedMicrosoft Security Update Guide+4 h
- 10/11/2026 21:11Published on WatchtowerPro CISO
In short
Microsoft has confirmed a remote code execution flaw in Windows Internet Information Services (IIS), tracked as CVE-2026-119961. A race condition lets an unauthorized attacker run code over a network. Affected versions, fixes and exploitation status are not yet known from the sources we have. Shodan estimates about 3.8 million internet-facing Microsoft IIS servers worldwide, 594,754 of them in the EU (11/11/2026); how many run an affected version is not yet known.
How bad is it
Severity not yet rated: Microsoft says an unauthorized attacker can run their own code on an IIS server over the network, without needing to log in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from microsoft.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
What to do now
- Open the Microsoft Security Update Guide page for CVE-2026-119961 to see affected products, KB numbers and release date, and install the update for your Windows version as soon as it is listed.
- Find which of your servers run IIS, especially those reachable from the internet, so they can be patched first.
- Interim measures only reduce exposure and do not make a server safe; apply the vendor update once available.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 1 source with their dates. And technology matching: which of your systems run Microsoft IIS, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-119961 Windows Internet Information Services Remote Code Execution Vulnerability Vendor