STIGQter: STIG Summary: Microsoft IIS 10.0 Site Security Technical Implementation Guide Version: 2 Release: 16 Benchmark Date: 01 Jul 2026:

Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.

DISA Rule

SV-218758r1156527_rule

Vulnerability Number

V-218758

Group Title

SRG-APP-000246-WSR-000149

Rule Version

IIST-SI-000230

Severity

CAT II

CCI(s)

• CCI-001094 - Restrict the ability of individuals to launch organization-defined denial of service attacks against other systems.

Weight

10

Fix Recommendation

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name under review.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

Uncheck the "Allow unlisted file extensions" check box.

Check Contents

Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is Not Applicable.

Note: If the server being reviewed is hosting Azure DevOps (ADO), this is Not Applicable.

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

If the "Allow unlisted file name extensions" check box is checked, this is a finding.

Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

Note: If this IIS 10.0 installation is supporting Splunk, this requirement is Not Applicable.

Note: If this IIS 10.0 installation is supporting WSUS, this requirement is Not Applicable.

Vulnerability Number

V-218758

Documentable

False

Rule Version

IIST-SI-000230

Severity Override Guidance

Note: If the server being reviewed is hosting SharePoint, this is Not Applicable.

Note: If the server being reviewed is hosting Network Device Enrollment Services (NDES), this is Not Applicable.

Note: If the server being reviewed is hosting Azure DevOps (ADO), this is Not Applicable.

Follow the procedures below for each site hosted on the IIS 10.0 web server:

Open the IIS 10.0 Manager.

Click the site name.

Double-click the "Request Filtering" icon.

Click "Edit Feature Settings" in the "Actions" pane.

If the "Allow unlisted file name extensions" check box is checked, this is a finding.

Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not otherwise hosting any content, this requirement is Not Applicable.

Note: If this IIS 10.0 installation is supporting Splunk, this requirement is Not Applicable.

Note: If this IIS 10.0 installation is supporting WSUS, this requirement is Not Applicable.

Check Content Reference

M

Target Key

4051