PatchTheCVECVE-2000-0246: IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC
52
This week
MEDIUM 5.0WATCHLISTDOWNGRADEDOWNGRADEDOWNGRADE
CVE-2000-0246 is a medium-severity flaw (CVSS 5.0) affecting commercial internet system, internet information server, internet information services. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 5.0 (Medium) |
| EPSS exploit chance | 80.0% (top 1%) |
| CISA exploited list | No |
| Published | 2000-03-30 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
microsoft commercial internet system DOWNGRADE
Affected: 2.0 · 2.5
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy commercial-internet-system || rpm -q commercial-internet-system || commercial-internet-system --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison commercial-internet-system
sudo apt install commercial-internet-system=<VERSION_BEFORE_2.0>
sudo apt-mark hold commercial-internet-system
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list commercial-internet-system
sudo dnf downgrade commercial-internet-system-<VERSION_BEFORE_2.0>
sudo dnf versionlock add commercial-internet-system
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft internet information server DOWNGRADE
Affected: 4.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.0
1. Check installed version
apt-cache policy internet-information-server || rpm -q internet-information-server || internet-information-server --version
2. No fixed release: DOWNGRADE to a release before 4.0 (Debian / Ubuntu)
apt-cache madison internet-information-server
sudo apt install internet-information-server=<VERSION_BEFORE_4.0>
sudo apt-mark hold internet-information-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list internet-information-server
sudo dnf downgrade internet-information-server-<VERSION_BEFORE_4.0>
sudo dnf versionlock add internet-information-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft internet information services DOWNGRADE
Affected: 5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.0
1. Check installed version
apt-cache policy internet-information-services || rpm -q internet-information-services || internet-information-services --version
2. No fixed release: DOWNGRADE to a release before 5.0 (Debian / Ubuntu)
apt-cache madison internet-information-services
sudo apt install internet-information-services=<VERSION_BEFORE_5.0>
sudo apt-mark hold internet-information-services
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list internet-information-services
sudo dnf downgrade internet-information-services-<VERSION_BEFORE_5.0>
sudo dnf versionlock add internet-information-services
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft proxy server DOWNGRADE
Affected: 2.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy proxy-server || rpm -q proxy-server || proxy-server --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison proxy-server
sudo apt install proxy-server=<VERSION_BEFORE_2.0>
sudo apt-mark hold proxy-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list proxy-server
sudo dnf downgrade proxy-server-<VERSION_BEFORE_2.0>
sudo dnf versionlock add proxy-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft site server DOWNGRADE
Affected: 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy site-server || rpm -q site-server || site-server --version
2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison site-server
sudo apt install site-server=<VERSION_BEFORE_3.0>
sudo apt-mark hold site-server
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list site-server
sudo dnf downgrade site-server-<VERSION_BEFORE_3.0>
sudo dnf versionlock add site-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
microsoft site server commerce DOWNGRADE
Affected: 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy site-server-commerce || rpm -q site-server-commerce || site-server-commerce --version
2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison site-server-commerce
sudo apt install site-server-commerce=<VERSION_BEFORE_3.0>
sudo apt-mark hold site-server-commerce
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list site-server-commerce
sudo dnf downgrade site-server-commerce-<VERSION_BEFORE_3.0>
sudo dnf versionlock add site-server-commerce
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Microsoft IIS 4.0 - UNC Mapped Virtual Host
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2000-0246?
commercial internet system: downgrade or apply the listed mitigation; internet information server: downgrade or apply the listed mitigation; internet information services: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2000-0246 being exploited?
CVE-2000-0246 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2000-0246 affect?
CVE-2000-0246 affects commercial internet system, internet information server, internet information services. Severity is medium (CVSS 5.0). IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerabilit
How urgent is CVE-2000-0246?
Priority 52/100. EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist
Related CVEs
- CVE-2000-0053 HIGH 7.5 DOWNGRADE Microsoft Commercial Internet System (MCIS) IMAP server allows remote attackers to cause a denial of service v
- CVE-1999-0910 MEDIUM 5.0 DOWNGRADE DOWNGRADE Microsoft Site Server and Commercial Internet System (MCIS) do not set an expiration for a cookie, which could
- CVE-1999-0867 MEDIUM 5.0 DOWNGRADE DOWNGRADE Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.
- CVE-1999-0861 LOW 2.6 DOWNGRADE DOWNGRADE Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext.
- CVE-1999-0777 HIGH 7.5 DOWNGRADE DOWNGRADE IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Acces