CVE-2015-0015 — Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

Back Back to CVE browser

HIGH

Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

Published Jan 13, 2015

7.8

HIGH

CVSS 2.0

EPSS 78.73%

Description

Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

Affected products

Remediation

No remediation recorded yet.

Metrics

78.73% 0.78735

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.78735

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	78.73% (0.78735)	99.58th	v5 (v2026.06.15)
Jun 15, 2026	78.73% (0.78735)	99.54th	v5 (v2026.06.15)
Mar 15, 2026	38.90% (0.38897)	97.20th	v4 (v2025.03.14)
Jan 11, 2026	47.58% (0.47581)	97.59th	v4 (v2025.03.14)
Jun 5, 2025	38.14% (0.38142)	97.02th	v4 (v2025.03.14)
Apr 21, 2025	46.59% (0.46585)	97.46th	v4 (v2025.03.14)
Mar 30, 2025	52.18% (0.52176)	97.70th	v4 (v2025.03.14)
Mar 29, 2025	41.42% (0.41425)	96.11th	v4 (v2025.03.14)
Mar 19, 2025	52.18% (0.52176)	97.61th	v4 (v2025.03.14)
Mar 17, 2025	58.40% (0.58405)	97.98th	v4 (v2025.03.14)
Dec 12, 2024	92.13% (0.92127)	99.08th	v3 (v2023.03.01)
Apr 15, 2023	92.13% (0.92127)	98.40th	v3 (v2023.03.01)
Mar 7, 2023	93.27% (0.93272)	98.48th	v3 (v2023.03.01)
Mar 6, 2023	29.55% (0.29551)	97.42th	v2 (v2022.01.01)
Aug 14, 2022	29.55% (0.29551)	97.30th	v2 (v2022.01.01)
Jun 3, 2022	39.43% (0.39426)	97.97th	v2 (v2022.01.01)
Feb 4, 2022	37.65% (0.37654)	97.12th	v2 (v2022.01.01)

Weaknesses (1)

CWE-399

References (4)

http://secunia.com/advisories/62148
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/71933
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1031532
vdb-entryx_refsource_SECTRACK
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007
vendor-advisoryx_refsource_MS

Link	Providers	Tags
http://secunia.com/advisories/62148		third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/71933		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1031532		vdb-entryx_refsource_SECTRACK
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-007		vendor-advisoryx_refsource_MS

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Jan 13, 2015

Updated Aug 6, 2024

Reserved Nov 18, 2014

Link CVE-2015-0015

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-0015

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-0015