Over 500,000 End-of-Life Microsoft IIS Servers Exposed Online

Key Takeaways

• Over 511,000 end-of-life (EOL) Microsoft IIS servers are currently exposed online, with more than 227,000 beyond even extended support.
• These unpatched servers represent a critical security risk, as they are no longer receiving vital security updates from Microsoft.
• Threat actors actively target such obsolete infrastructure to gain initial access, deploy malware, and launch further attacks.
• Organizations must identify and upgrade or isolate these legacy systems to mitigate severe exploitation risks.

Hundreds of Thousands of End-of-Life Microsoft IIS Servers Exposed to Cyber Threats

A significant number of outdated Microsoft Internet Information Services (IIS) instances, totaling over half a million, are currently accessible on the public internet, posing a severe cybersecurity risk. Daily network scans conducted by the Shadowserver Foundation revealed more than 511,000 such servers, which have reached their End-of-Life (EOL) status and are no longer supported with standard security patches. This widespread exposure creates a critical vulnerability for organizations globally, as these obsolete systems are prime targets for cyberattacks.

Cybercriminals routinely scan the internet for unpatched infrastructure, seeking to exploit known vulnerabilities, deliver malicious software, or establish initial access points into corporate networks. The continued operation of EOL servers dramatically increases an organization’s susceptibility to these threats.

Over 511,000 IIS Instances Beyond Support

The data compiled by Shadowserver highlights a concerning lapse in global internet infrastructure security. Of the 511,000 exposed EOL IIS instances, a substantial 227,000 have surpassed the official Microsoft Extended Security Updates (ESU) period. This means nearly half of these servers are End-of-Support (EOS) and will never receive critical security fixes, even if organizations were to pay for extended coverage.

Geographically, the problem is most pronounced in China and the United States, which host the highest concentrations of these outdated IIS instances. To assist security teams in tracking these exposures, Shadowserver now explicitly tags vulnerable servers as ‘eol-iis’ and ‘eos-iis’ within its daily Vulnerable HTTP reports. Network administrators can leverage this raw IP data, filtered by their specific network constituency, to pinpoint and address exposed assets within their environments.

Operating EOL and EOS web servers significantly elevates an organization’s risk profile. Once software reaches its end of lifecycle, the vendor ceases to monitor it for new security flaws. Should a new zero-day vulnerability be discovered in an unsupported version of IIS, Microsoft will not issue a public patch. Threat actors are keenly aware of this dynamic and actively develop automated tools to detect and exploit these specific legacy systems. The Cybersecurity and Infrastructure Security Agency (CISA) has consistently warned about the severe risks associated with end-of-support edge devices.

Compromised web servers frequently serve as the initial beachhead for ransomware operators and Advanced Persistent Threat (APT) groups. Once an attacker successfully breaches an internet-facing IIS server, they can pivot laterally into the internal network, exfiltrate sensitive data, or deploy malicious payloads across the broader infrastructure.

What You Should Do

• Conduct a thorough audit of all external network assets to identify any servers running legacy versions of Microsoft IIS.
• Regularly review Shadowserver’s Vulnerable HTTP reports to identify exposed IP addresses associated with your organization’s network.
• Prioritize upgrading all EOL and EOS servers to modern, fully supported versions of Windows Server and IIS.
• If immediate migration is not feasible, enroll eligible systems in Microsoft’s Extended Security Update (ESU) program to receive critical patches for a limited period.
• Isolate any legacy systems that cannot be immediately upgraded behind robust web application firewalls (WAFs) and strictly limit access to only essential IP addresses and services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.