CVE-2017-7269: IIS 6.0 WebDAV ScStoragePathFromUrl buffer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with public exploits, confirmed in-the-wild exploitation, CISA KEV listing, and near-maximum EPSS score.

What it is

A buffer overflow in the ScStoragePathFromUrl function of the WebDAV service in IIS 6.0 on Windows Server 2003 R2 allows remote code execution via a long 'If: <http://' header in a PROPFIND request. The flaw is trivially reachable over the network without authentication and was already exploited in the wild in 2016, making it a high-value target for unpatched, internet-facing legacy servers.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the IIS/WebDAV service, typically leading to full server compromise. Successful exploitation can result in data theft, lateral movement, and persistent access.

Attack surface

Reached over the network via HTTP PROPFIND requests to the WebDAV service on IIS 6.0; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2017-7269 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.99823 (99.959th percentile), with multiple public exploit references including Exploit-DB and Metasploit. Exploitation in the wild was reported in July or August 2016.

What to do

• Apply the Microsoft security update referenced in KB3197835 or the vendor-provided patch for affected Windows Server 2003 R2 systems.
• If patching is not possible, disable WebDAV on IIS 6.0 or block PROPFIND requests at the perimeter.
• Retire or isolate end-of-life Windows Server 2003 R2 systems from untrusted networks.
• Use 0patch or equivalent micropatching only as a temporary compensating control until a full patch can be applied.

Detection

• Monitor IIS logs for PROPFIND requests containing an 'If:' header with a long URL beginning 'http://'.
• Alert on unexpected child processes spawned by w3wp.exe or inetinfo.exe on IIS 6.0 hosts.
• Use network signatures or IDS rules for the known Exploit-DB PoCs (41738, 41992) and Metasploit module traffic.
• Audit for internet-facing IIS 6.0/Windows Server 2003 R2 instances and verify patch status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.