Windows SPNEGO Nightmare: Critical RCE Vulnerability

Looks to be reachable through many service ports, including http/https in at least some circumstances. I have not seen reliable information if default configurations of IIS are exploitable.