Vulnerability record · CVE-2009-1535 · published 10 June 2009
CVE-2009-1535: Microsoft IIS WebDAV authentication bypass via Unicode URI encoding
Microsoft · Internet Information Services
The WebDAV extension in Microsoft IIS 5.1 and 6.0 mishandles URI-based protection, allowing a %c0%af (Unicode slash) sequence at an arbitrary position in the URI to bypass authentication. An attacker can therefore list folders or read, create, or modify files inside password-protected WebDAV directories. This is a distinct flaw from CVE-2009-1122.
Description
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms, and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI, as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder, aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe flaw allows unauthenticated read and write access to protected WebDAV content and has a very high EPSS score, though it is not in KEV and affects only legacy IIS versions.
What it is
The WebDAV extension in Microsoft IIS 5.1 and 6.0 mishandles URI-based protection, allowing a %c0%af (Unicode slash) sequence at an arbitrary position in the URI to bypass authentication. An attacker can therefore list folders or read, create, or modify files inside password-protected WebDAV directories. This is a distinct flaw from CVE-2009-1122.
Impact
An unauthenticated remote attacker gains access to protected WebDAV content, including the ability to read, create, or modify files, effectively defeating the folder-level password protection.
Attack surface
Reachable over the network through HTTP requests to a WebDAV-enabled IIS 5.1 or 6.0 server; no authentication is required and no user interaction is needed, as reflected in the CVSS vector AV:N/AC:L/Au:N.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is very high (0.98115, 99.91st percentile), indicating substantial predicted exploitation activity; reference tags are advisory and patch links only, with no public exploit tag.
What to do
- Apply Microsoft security bulletin MS09-020 (the vendor patch) to affected IIS 5.1 and 6.0 systems.
- Disable the WebDAV extension on IIS servers that do not require it.
- Remove or restrict anonymous access to WebDAV directories and enforce authentication at a layer that does not rely on URI path matching.
- Block or normalize requests containing encoded slash sequences such as %c0%af at the web server or reverse proxy.
- Retire or isolate end-of-life IIS 5.1/6.0 hosts that cannot be patched.
Detection
- Search IIS and proxy logs for URIs containing %c0%af or other overlong/Unicode-encoded slash sequences.
- Alert on WebDAV methods (PROPFIND, PUT, DELETE, MKCOL) against paths that should be password-protected.
- Monitor for successful access to protected WebDAV folders from unauthenticated or unexpected source addresses.
- Review file integrity on WebDAV-shared directories for unexpected creation or modification of files.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-1535 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-1535), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
