CVE-2000-0886: IIS 5.0 file request parsing allows remote command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote command execution on an internet-facing web server is severe, and the high EPSS score signals elevated exploitation likelihood despite the absence of KEV listing.

What it is

IIS 5.0 mishandles requests for executable files when operating system commands are appended to the filename, a flaw known as the Web Server File Request Parsing vulnerability. A remote attacker can craft a malformed request that causes the server to execute arbitrary commands. This matters because it exposes the web server to unauthenticated remote code execution.

Impact

An attacker gains the ability to run arbitrary operating system commands with the privileges of the IIS process, potentially leading to full server compromise. No specific impact beyond command execution is described in the record.

Attack surface

The flaw is reached over the network through HTTP requests to IIS 5.0, as reflected by the AV:N vector. The CVSS vector shows Au:N, so no authentication is required; the description does not indicate any user interaction requirement.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit tags, but EPSS shows a 30-day probability of 0.68742 (99.3rd percentile), indicating high predicted exploitation activity.

What to do

• Apply the Microsoft security bulletin MS00-086 update for IIS 5.0 as the primary fix.
• If patching is not immediately possible, disable or restrict execution of unnecessary executable file types in web-accessible directories.
• Limit IIS process privileges and isolate the web service account to reduce the impact of command execution.
• Monitor vendor guidance and apply any follow-up IIS hardening recommendations for request parsing.

Detection

• Inspect IIS and web server logs for requests to executable files with unusual appended characters or command-like strings.
• Alert on HTTP requests containing shell metacharacters or operating system command syntax in the URI path.
• Monitor for unexpected child processes spawned by the IIS worker process (inetinfo.exe or related).
• Review file system and process creation events on IIS hosts for command execution originating from the web service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.