CVE-2026-47291

What it actually does

CVE-2026-47291 is a critical remote code execution vulnerability in Windows HTTP.sys caused by an integer overflow or wraparound during HTTP request processing. HTTP.sys is the Windows kernel-mode HTTP protocol stack used by IIS and other Windows services that register HTTP/HTTPS listeners. A specially crafted network request can cause incorrect size calculation, memory corruption, and potentially attacker-controlled code execution. Because the flaw is reachable over the network, requires no authentication, requires no user interaction, and impacts confidentiality, integrity, and availability, exposed HTTP.sys-based services should be treated as high-risk even though public exploit maturity is currently listed as none and the issue is not currently in CISA KEV.

Why it matters to the business

Successful exploitation could allow an unauthenticated remote attacker to take control of affected Windows servers or workstations that expose HTTP.sys-backed services, leading to service outages, data theft, ransomware deployment, lateral movement, or full compromise of internet-facing infrastructure. The affected product range is broad across Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, increasing operational exposure. Although it is not currently listed as known exploited and no public exploit maturity is reported, the CVSS 9.8 severity, network reachability, and EPSS of 22.75% make timely remediation important, especially for IIS, web application, API, management, or reverse-proxy endpoints reachable from untrusted networks.

How an attack unfolds

An attacker first identifies a Windows host exposing an HTTP.sys-backed listener, commonly through IIS or another service using the Windows HTTP Server API. The attacker sends a specially crafted HTTP request designed to trigger an integer overflow or wraparound in HTTP.sys request parsing or buffer management. The overflow causes HTTP.sys to calculate an incorrect buffer size or memory offset, resulting in kernel-mode memory corruption. With a reliable exploit, the attacker may convert that corruption into code execution with high privileges, potentially SYSTEM or kernel context. After execution, the attacker would typically establish persistence, disable security controls, dump credentials, deploy web shells or payloads, pivot to other systems, or cause denial of service if exploitation is unreliable.

How to fix it

Apply the relevant Microsoft security update or latest cumulative update for all affected Windows versions as soon as it is available for the deployed branch. Because no exact fixed build numbers were provided in the input, confirm remediation against Microsoft’s official advisory, Windows Update, WSUS, Microsoft Update Catalog, or enterprise patch-management reporting. Prioritize internet-facing Windows servers and any systems running IIS, HTTP.sys-based APIs, WinRM over HTTP(S), Windows services using HTTP Server API reservations, or management portals. If immediate patching is not possible, reduce exposure by removing unnecessary HTTP.sys listeners, disabling unused IIS sites and Windows features, restricting inbound HTTP/HTTPS access to trusted networks, placing services behind hardened reverse proxies or WAFs, enforcing network segmentation, and increasing monitoring for malformed HTTP traffic and service crashes. Do not rely on WAF filtering alone as a complete fix because exploitation may occur in kernel-mode request handling before application-layer logic is reached.

How to confirm the fix worked

Confirm that affected systems have installed the Microsoft cumulative or security update that remediates this vulnerability for their Windows release. Validate through centralized patch inventory, Windows Update history, WSUS/SCCM/Intune reports, or vulnerability scanner checks that specifically identify CVE-2026-47291 as fixed. On representative systems, verify the installed HTTP.sys driver version and timestamp against Microsoft’s published fixed version for that OS branch. Enumerate HTTP.sys listeners using commands such as `netsh http show servicestate`, `netsh http show urlacl`, and IIS role/service inventory to confirm whether systems still expose HTTP.sys-backed services. Externally verify that only intended HTTP/HTTPS endpoints remain reachable from untrusted networks. After patching, run authenticated vulnerability scans and confirm no affected Windows 10, Windows 11, or Windows Server assets remain flagged.

Typical attack path

1. Scan for Windows systems exposing HTTP or HTTPS services backed by HTTP.sys, such as IIS or Windows services registered with the HTTP Server API.
2. Fingerprint the target to identify affected Windows versions or unpatched server builds.
3. Send crafted HTTP requests intended to trigger the integer overflow or wraparound condition in HTTP.sys.
4. Achieve memory corruption in the kernel-mode HTTP stack and attempt reliable remote code execution.
5. Run attacker-controlled commands or payloads with elevated privileges if exploitation succeeds.
6. Establish persistence, collect credentials, disable defenses, deploy additional tooling, or move laterally within the network.

How to detect it

To determine whether exploitation may already have occurred, review host, web, and network telemetry for both pre-exploitation symptoms and post-exploitation activity. Prioritize Windows servers exposing IIS or other HTTP.sys-backed services. Review Windows System logs for HTTP.sys driver faults, bugchecks, unexpected reboots, and service instability around inbound HTTP traffic. Review Application logs, Windows Error Reporting, IIS logs, and HTTPERR logs for malformed or abnormal requests, repeated connection drops, protocol parsing failures, requests with unusually large headers or content lengths, and bursts of 400-series errors preceding crashes. Review EDR telemetry for suspicious child processes launched by web-facing services, especially `w3wp.exe`, service-hosted HTTP listeners, or processes running as SYSTEM. Investigate unexpected creation of services, scheduled tasks, local users, web shells, script interpreters, credential dumping tools, outbound connections shortly after HTTP requests, and security control tampering. Network teams should inspect IDS/IPS, reverse proxy, WAF, and load balancer logs for anomalous HTTP requests to Windows-backed endpoints, especially oversized or malformed headers and request smuggling-like patterns. Because no public exploit maturity or stable exploit indicators are provided, detections should combine HTTP anomaly signals, crash telemetry, and post-compromise behavior rather than relying on a single request signature.

• C:\Windows\System32\drivers\HTTP.sys
• C:\Windows\System32\LogFiles\HTTPERR\httperr*.log
• C:\inetpub\logs\LogFiles\
• HTTP.sys
• http.sys
• httperr
• Connection_Dropped
• Header
• RequestLength
• Url
• Timer_ConnectionIdle
• w3wp.exe
• inetinfo.exe
• svchost.exe
• netsh http show servicestate
• netsh http show urlacl
• Windows Error Reporting
• BugCheck
• Event ID 1001
• Event ID 7031
• Event ID 7034

What your security team should do

• Treat internet-facing Windows HTTP/HTTPS services as the highest priority for patching because the flaw is remotely reachable without authentication and has a CVSS score of 9.8.
• Create an inventory of Windows systems running IIS or other HTTP.sys-backed services and correlate it with patch status.
• Apply the latest Microsoft cumulative/security updates for Windows 10, Windows 11, and Windows Server 2012 through 2025 branches where applicable.
• Temporarily restrict inbound access to exposed HTTP.sys listeners from untrusted networks where patching cannot be completed quickly.
• Monitor for HTTP.sys crashes, IIS worker process anomalies, unusual child processes spawned from web services, and malformed HTTP request patterns.
• Add detections for exploitation attempts and post-exploitation behavior, including unexpected SYSTEM-level process execution, credential dumping, new services, new scheduled tasks, and web-accessible dropped files.
• Re-scan after remediation and require authenticated validation to avoid false confidence from unauthenticated network scans.
• Track Microsoft, CISA KEV, and threat-intelligence updates because exploit availability or active exploitation status may change rapidly for critical Windows HTTP.sys vulnerabilities.