PatchTheCVECVE-1999-0861: Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
36
Routine
LOW 2.6WATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-1999-0861 is a low-severity flaw (CVSS 2.6) affecting commercial internet system, internet information server, site server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
Why this priority
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 2.6 (Low) |
| EPSS exploit chance | 3.2% (top 12%) |
| CISA exploited list | No |
| Weakness | CWE-362 |
| Published | 1999-08-11 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
microsoft commercial internet system DOWNGRADE
Affected: 2.0 · 2.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy commercial-internet-system || rpm -q commercial-internet-system || commercial-internet-system --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison commercial-internet-system
sudo apt install commercial-internet-system=<VERSION_BEFORE_2.0>
sudo apt-mark hold commercial-internet-system
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list commercial-internet-system
sudo dnf downgrade commercial-internet-system-<VERSION_BEFORE_2.0>
sudo dnf versionlock add commercial-internet-system
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft internet information server DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy internet-information-server || rpm -q internet-information-server || internet-information-server --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison internet-information-server
sudo apt install internet-information-server=<VERSION_BEFORE_4.0>
sudo apt-mark hold internet-information-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list internet-information-server
sudo dnf downgrade internet-information-server-<VERSION_BEFORE_4.0>
sudo dnf versionlock add internet-information-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft site server DOWNGRADE
Affected: 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy site-server || rpm -q site-server || site-server --version
2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison site-server
sudo apt install site-server=<VERSION_BEFORE_3.0>
sudo apt-mark hold site-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list site-server
sudo dnf downgrade site-server-<VERSION_BEFORE_3.0>
sudo dnf versionlock add site-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft site server commerce DOWNGRADE
Affected: 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy site-server-commerce || rpm -q site-server-commerce || site-server-commerce --version
2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison site-server-commerce
sudo apt install site-server-commerce=<VERSION_BEFORE_3.0>
sudo apt-mark hold site-server-commerce
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list site-server-commerce
sudo dnf downgrade site-server-commerce-<VERSION_BEFORE_3.0>
sudo dnf versionlock add site-server-commerce
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-1999-0861?
commercial internet system: downgrade or apply the listed mitigation; internet information server: downgrade or apply the listed mitigation; site server: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-1999-0861 being exploited?
CVE-1999-0861 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-1999-0861 affect?
CVE-1999-0861 affects commercial internet system, internet information server, site server. Severity is low (CVSS 2.6). Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
How urgent is CVE-1999-0861?
Priority 36/100. On your watchlist
Related CVEs
- CVE-2000-0246 MEDIUM 5.0 DOWNGRADE DOWNGRADE IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC
- CVE-2000-0053 HIGH 7.5 DOWNGRADE Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service v
- CVE-1999-0910 MEDIUM 5.0 DOWNGRADE DOWNGRADE Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could
- CVE-1999-0867 MEDIUM 5.0 DOWNGRADE DOWNGRADE Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.
- CVE-1999-0777 HIGH 7.5 DOWNGRADE DOWNGRADE IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Acces