CVE-2000-0246: Microsoft Commercial Internet System

Medium severity, CVSS 5.0. EPSS: 80% chance of exploitation in the next 30 days.

IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability.

Affected products

• Microsoft Commercial Internet System: version 2.0 only; version 2.5 only
• Microsoft Internet Information Server: version 4.0 only
• Microsoft Internet Information Services: version 5.0 only
• Microsoft Proxy Server: version 2.0 only
• Microsoft Site Server: version 3.0 only
• Microsoft Site Server Commerce: version 3.0 only

Published 2000-03-30. Last modified 2026-06-16.