EIP-2026-118868

This is a technical writeup describing a vulnerability in Microsoft URLScan and RSA Security SecurID when used together. The issue arises from the order of ISAPI filters, allowing an attacker to enumerate URLScan's extension filtering list via repeated requests with varying extensions.