CVE-1999-0412: Microsoft Internet Information Server

High severity, CVSS 7.5. EPSS: 10.2% chance of exploitation in the next 30 days.

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension.

Affected products

• Microsoft Internet Information Server: version 3.0 only; version 4.0 only
• Microsoft Internet Information Services: version 2.0 only

Published 1999-02-19. Last modified 2026-06-16.