511,000+ End-of-Life IIS Instances Found Online, Raising Security Risks
Security researchers at The Shadowserver Foundation have identified a significant number of outdated Microsoft Internet Information Services (IIS) instances on the internet. Over 511,000 instances, which are considered End-of-Life (EOL), have been found…
Security researchers at The Shadowserver Foundation have identified a significant number of outdated Microsoft Internet Information Services (IIS) instances on the internet. Over 511,000 instances, which are considered End-of-Life (EOL), have been found to be active online.
The presence of these outdated web servers poses a substantial security risk, as they no longer receive security updates from Microsoft.
511,000+ End-of-Life IIS Instances Identified
Daily scans by Shadowserver have revealed concerning statistics about these exposed servers. Out of the 511,000 EOL instances, more than 227,000 have surpassed the Microsoft Extended Security Updates (ESU) period.
This indicates that nearly half of these servers are in an End-of-Support (EOS) state and are not eligible for even paid security patches from Microsoft.
To assist organizations in addressing these vulnerabilities, Shadowserver has updated its Vulnerable HTTP reports. These reports now include tags such as "eol-iis" and "eos-iis" to clearly indicate the support status of these servers.
Over 511,000 instances, which are considered End-of-Life (EOL), have been found to be active online.
The majority of these vulnerable deployments are concentrated in China and the United States. Shadowserver has shared this data with network owners and national Computer Emergency Response Teams to aid in remediation efforts.
Security professionals can monitor this data via Shadowserver’s live dashboard maps, which provide a visual representation of both EOL and EOS server instances.
Operating internet-facing software that has reached its end of life significantly increases an organization's attack surface. The Cybersecurity and Infrastructure Security Agency (CISA) advises against maintaining unsupported devices.
In the event of a new vulnerability, unsupported systems remain unprotected, exposing them to potential automated exploitation, ransomware, and other threats.
Microsoft IIS functions as a primary web server and gateway to internal networks, making it a common target for threat actors seeking to gain access.
Administrators are urged to identify any legacy IIS instances within their systems. It is recommended that organizations consult Microsoft IIS lifecycle documentation, migrate to supported web server platforms, and decommission unmaintained legacy systems.
Based on reporting by GBHackers.