Microsoft IIS Exploit Allows Unauthenticated Attackers to Run Arbitrary Code

A serious security flaw has been discovered in Microsoft’s Internet Information Services (IIS) that lets attackers run arbitrary code without logging in. The vulnerability affects the IIS Inbox COM Objects and stems from improper handling of shared memory and objects that have been freed. Attackers who can reach the server and exploit this flaw could gain full control of the system, potentially stealing data or installing malware.

On 14 October 2025, Microsoft publicly disclosed a remote code execution vulnerability in the IIS Inbox COM Objects, tracked as CVE-2025-59282 and rated “Important.” No authentication is required, so any unauthenticated attacker with network access to an affected server can exploit it, according to Microsoft.

The security bulletin urges administrators to apply the patches immediately and notes that applying the update closes the race condition and corrects the use-after-free error, with mitigations such as restricting access via firewalls until patches are deployed.