Vulnerability record · CVE-2006-0026 · published 11 July 2006
CVE-2006-0026: Microsoft IIS ASP buffer overflow allows code execution
Microsoft · Internet Information Server
Microsoft IIS 5.0, 5.1 and 6.0 contain a buffer overflow reachable through crafted Active Server Pages (ASP). A successful overflow lets code run in the context of the IIS process, which on these versions typically means significant server-side control. The record does not specify the exact vulnerable function or the malformed ASP construct involved.
Description
Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityThe flaw allows code execution on an internet-facing web server and has a very high EPSS score, though the CVSS 2.0 base is only 6.5 and there is no KEV listing or confirmed exploitation.
What it is
Microsoft IIS 5.0, 5.1 and 6.0 contain a buffer overflow reachable through crafted Active Server Pages (ASP). A successful overflow lets code run in the context of the IIS process, which on these versions typically means significant server-side control. The record does not specify the exact vulnerable function or the malformed ASP construct involved.
Impact
An attacker who can trigger the overflow gains arbitrary code execution on the IIS host, potentially leading to full server compromise and follow-on lateral movement. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.
Attack surface
The CVSS vector AV:N/AC:L/Au:S indicates the flaw is network reachable with low complexity but requires some form of authentication or prior access, and the description notes local and possibly remote attackers. No user interaction is indicated. The precise ASP request or file needed to reach the overflow is not described in the record.
Exploitation
CVE-2006-0026 is not listed in CISA KEV and no ransomware groups are documented using it. EPSS is very high (0.89259, 99.77th percentile), but the reference tags only indicate patch and advisory material, so there is no confirmed in-the-wild exploitation evidence in this record.
What to do
- Apply the Microsoft security update for MS06-034 (the vendor advisory is referenced) to all affected IIS 5.0, 5.1 and 6.0 hosts.
- Restrict who can upload or modify ASP content on IIS servers, since the vector requires authentication.
- Run IIS worker processes with least privilege and isolate application pools to limit the impact of code execution.
- Retire or upgrade end-of-life IIS 5.x/6.0 installations where feasible, as they no longer receive current security fixes.
Detection
- Monitor IIS logs for anomalous or malformed ASP requests, especially unusual query strings or POST bodies targeting .asp files.
- Alert on unexpected child processes or command shells spawned by w3wp.exe or inetinfo.exe.
- Watch for new or modified .asp files in web roots outside of normal deployment windows.
- Correlate IIS application errors or crashes with subsequent process creation events on the same host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-0026 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-0026), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
