KB5031362: Windows Server 2016 Security Update (October 2023)

An attacker who can reach an internet-facing or internal IIS server can exploit the authentication-restriction weakness to gain SYSTEM-level control of the web server without prior credentials. From SYSTEM on an IIS host the attacker reads the web application's configuration (often including database connection strings), modifies content served to legitimate users, and pivots to back-end systems the IIS host has access to.

Internet Information Services (IIS) is Microsoft's web server, used to host hundreds of thousands of business applications, intranets, and exposed web services on Windows Server. A flaw classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts) in how IIS handles authentication lets an attacker bypass the rate-limiting and brute-force protections, then leverage that weakness to elevate to SYSTEM.

Probably yes if any of these apply:

An e-commerce site runs on a Windows Server with IIS exposed to the internet. An attacker exploits the authentication-restriction bypass against the management surface or an authenticated endpoint, elevates to SYSTEM, and from there reads the database credentials in web.config. Within hours they have exfiltrated the customer database and staged a credential-stuffing attack against every reused password. IIS EoPs are dangerous out of proportion to their CVE label because so many Windows servers run IIS.