CVE-2009-1135: Microsoft Isa Server

High severity, CVSS 9.0. EPSS: 26.5% chance of exploitation in the next 30 days.

Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."

Affected products

• Microsoft Isa Server: version 2006 only

Published 2009-07-15. Last modified 2026-06-16.