CVE-2004-1331: The execCommand method in Microsoft Internet Explorer 6.0 SP2 allows remote attackers to bypass the "File D...

Security readout for executives and security teams

This CVE describes an Internet Explorer 6 SP2 flaw where a malicious web page could bypass the normal file download warning and save files with arbitrary extensions. The sources do not show CVSS, CWE, Microsoft patch details, or CISA KEV listing, so urgency depends on whether legacy IE 6 SP2 remains in use. Exposure is likely limited to environments that still allow Microsoft Internet Explorer 6.0 SP2 to browse untrusted content. Modern browser fleets are not identified as affected in the provided sources. Legacy kiosks, lab systems, or tightly coupled applications should be checked before dismissing risk. Prioritize discovery over emergency response unless IE 6 SP2 is still present. If found on internet-browsing endpoints, treat it as a high-risk legacy exposure because the flaw bypasses a user-facing download safety prompt. Mitigation focus: Inventory systems that can still run Internet Explorer 6.0 SP2.; Remove or disable IE 6 SP2 wherever business applications permit.; Block legacy IE systems from browsing untrusted internet sites..

Prepared

Jun 30, 2026, 01:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.