Windows Internet Informationの脆弱性 遠隔からコードを実行されるおそれ
Summary
Windows Internet Information Servicesに、認証のない攻撃者がネットワーク経由でコードを実行できるおそれのある脆弱性が見つかりました。CVSSの基本値は8.1です。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が影響を受けるため、Windows Updateで修正版を適用してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
Windows Internet Information Servicesに、認証のない攻撃者がネットワーク経由でコードを実行できるおそれのある脆弱性が見つかりました。CVSSの基本値は8.1です。Windows 10 Version 1607・1809・21H2・22H2、Windows 11 Version 23H2・24H2が影響を受けるため、Windows Updateで修正版を適用してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| MicrosoftWindows 10 Version 1607 |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows 10 Version 1809 |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows 10 Version 21H2 |
≥ 10.0.19044.0, < 10.0.19044.7846→ 10.0.19044.7846 |
10.0.19044.7846 |
| MicrosoftWindows 10 Version 22H2 |
≥ 10.0.19045.0, < 10.0.19045.7846→ 10.0.19045.7846 |
10.0.19045.7846 |
| MicrosoftWindows 11 Version 23H2 |
≥ 10.0.22631.0, < 10.0.22631.7711→ 10.0.22631.7711 |
10.0.22631.7711 |
| MicrosoftWindows 11 Version 24H2 |
≥ 10.0.26100.0, < 10.0.26100.9974→ 10.0.26100.9974 |
10.0.26100.9974 |
| MicrosoftWindows 11 Version 25H2 |
≥ 10.0.26200.0, < 10.0.26200.9974→ 10.0.26200.9974 |
10.0.26200.9974 |
| MicrosoftWindows 11 version 26H1 |
≥ 10.0.28000.0, < 10.0.28000.3501→ 10.0.28000.3501 |
10.0.28000.3501 |
| MicrosoftWindows 11 Version 26H2 |
≥ 10.0.26300.0, < 10.0.26300.9974→ 10.0.26300.9974 |
10.0.26300.9974 |
| MicrosoftWindows Server 2016 |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows Server 2016 (Server Core installation) |
≥ 10.0.14393.0, < 10.0.14393.9688→ 10.0.14393.9688 |
10.0.14393.9688 |
| MicrosoftWindows Server 2019 |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows Server 2019 (Server Core installation) |
≥ 10.0.17763.0, < 10.0.17763.9487→ 10.0.17763.9487 |
10.0.17763.9487 |
| MicrosoftWindows Server 2022 |
≥ 10.0.20348.0, < 10.0.20348.5870→ 10.0.20348.5870 |
10.0.20348.5870 |
| MicrosoftWindows Server 2025 |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
| MicrosoftWindows Server 2025 (Server Core installation) |
≥ 10.0.26100.0, < 10.0.26100.33822→ 10.0.26100.33822 |
10.0.26100.33822 |
Original description The description as published by the source.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
Source: Microsoft Security Response Center Blog NVD GitHub Advisory
References
- web msrc.microsoft.com
- web nvd.nist.gov
- web github.com