CVE-2006-4685: Microsoft XML Core Services

Low severity, CVSS 2.6. EPSS: 20.7% chance of exploitation in the next 30 days.

The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.

Affected products

• Microsoft XML Core Services: version 3.0 only; version 4.0 only; version 6.0 only
• Microsoft XML Parser: version 2.6 only

Published 2006-10-10. Last modified 2026-06-16.