PerfoMetrix

All vulnerabilities · Microsoft IIS

IIS HTTP.sys Remote Code Execution (MS15-034, CVE-2015-1635): What It Means Today

CVE-2015-1635CVSS 9.8Actively exploited (CISA KEV)

MS15-034 lets a single request crash or take over Windows servers running IIS 7.5 to 8.5. Why the IIS version alone cannot confirm the patch, and what to do.

Is your site affected? Check the Microsoft IIS version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
See the advisorySee the advisory

MS15-034 is a flaw in HTTP.sys, the Windows kernel driver that receives HTTP requests for IIS. A request with a crafted Range header can crash the server (blue screen) or, in theory, run code with system rights. Microsoft fixed it in April 2015 (KB3042553); CISA lists it as actively exploited.

Who is affected

Unpatched Windows 7, 8 and 8.1 and Windows Server 2008 R2, 2012 and 2012 R2, which serve websites with IIS 7.5, 8.0 and 8.5.

What our check can and can’t tell

IIS is part of Windows, so its version (Microsoft-IIS/8.5) only says which Windows release the server runs, not which updates are installed. We therefore can’t confirm this patch from outside. What we can tell you is whether that Windows release is still supported: Windows Server 2008 R2, 2012 and 2012 R2 are all out of support and receive no new security fixes.

What to do

  1. Install all Windows updates; the April 2015 update fixes this flaw.
  2. Plan the move to a supported Windows Server release (IIS 10).
  3. Hide the version: remove the Server header in IIS (removeServerHeader="true" in requestFiltering, IIS 10).

FAQ

Our site shows IIS/10.0. Are we affected?

Not by MS15-034, which doesn’t affect the Windows releases that ship IIS 10. Keep Windows updated.

Is IIS 8.5 still safe to run?

It runs on Windows Server 2012 R2, which reached end of support in October 2023. New flaws are no longer fixed, so migrate.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free