CVE-2007-4991: The SOCKS4 Proxy in Microsoft Internet Security and Acceleration (ISA) Server 2004 SP1 and SP2 allows remot...

Security readout for executives and security teams

This is an old information disclosure flaw in Microsoft ISA Server 2004's SOCKS4 proxy. An attacker may be able to learn the destination IP of another user's proxy session. The source bundle does not indicate code execution, privilege escalation, or confirmed active exploitation. Exposure is most likely in legacy environments still running Microsoft ISA Server 2004 SP1 or SP2 with the SOCKS4 proxy enabled and reachable by untrusted users or networks. Treat this as a legacy exposure and information leakage risk. It is unlikely to outrank remote-code-execution issues, but unsupported internet-facing ISA infrastructure should be retired or tightly isolated. Mitigation focus: Inventory any remaining Microsoft ISA Server 2004 SP1 or SP2 systems.; Check Microsoft or vendor guidance for historical fixes or supported migration paths.; Disable the SOCKS4 proxy if it is not required..

Prepared

Jun 29, 2026, 03:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.