CVE-2018-12571: Microsoft Forefront Unified Access Gateway

Critical severity, CVSS 9.8. EPSS: 30.7% chance of exploitation in the next 30 days.

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a traffic amplification and/or SSRF outcome.

Affected products

• Microsoft Forefront Unified Access Gateway: version 2010 only

Published 2018-07-05. Last modified 2026-06-17.