EIP-2026-118797

This writeup describes multiple authentication bypass vulnerabilities in Microsoft IIS 6.0 and 7.5, leveraging special path suffixes like '::$INDEX_ALLOCATION' to bypass access restrictions on protected directories. It also details a source code disclosure vulnerability in IIS 7.5 with specific PHP configurations.