CVE-1999-0777: IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Ac...

Security readout for executives and security teams

This CVE describes an old IIS FTP authorization flaw where a remote attacker may read or delete server files despite “No Access” permissions. Business impact depends on whether legacy IIS FTP is still exposed. The source bundle does not identify affected versions, CVSS severity, or current exploitation. Likely limited to legacy IIS FTP servers matching Microsoft’s 1999 advisory scope. The source bundle lists affected vendor and product as n/a, so do not assume exposure without confirming IIS FTP presence and advisory applicability. Treat this as a legacy exposure check. If IIS FTP is absent, priority is low. If exposed, prioritize containment because unauthorized file read or deletion can affect confidentiality, integrity, and operational availability. Mitigation focus: Review Microsoft MS99-039, Q241407, and Q242559 for applicable vendor guidance.; Inventory and disable unnecessary IIS FTP services, especially Internet-facing instances.; Restrict FTP access to trusted networks where business use remains required..

Prepared

Jul 12, 2026, 06:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.