VulnerabilityModified

CVE-2018-12571

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries for arbitrary hosts via a comma-separated list of URLs in the orig_url parameter, possibly causing a…

CRITICAL 9.8EPSS 30.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 30.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 30.69% probability · 98th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-918
Affected: microsoft/forefront unified access gateway
Source: cve@mitre.org

EPSS trend

EPSS moved from 27.0% on 21 September 2026 to 30.7% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041212Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7Exploit, Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1041212Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.