The US Computer Emergency Readiness Team is already seeing “active exploitation” of the bug. The group is advising that WebDAV be temporarily disabled until things can be sorted out. The vulnerabilities are present in version 6 of IIS only, and WebDAV is not enabled by default. http://www.theregister.co.uk/2009/05/18/iis6_file_pilfering_bug/