CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- CVSS
- 9.8
- EPSS
- 23%
Affected versions
Key insight
The vulnerability enables unauthenticated remote attackers to achieve kernel-level code execution via specially crafted HTTP/1.x requests over TLS connections.
Description
CVE-2026-47291 is a critical remote code execution vulnerability in the Windows HTTP Protocol Stack (HTTP.sys) affecting Microsoft Internet Information Services. The vulnerability results from insufficient validation of incoming HTTP requests. A remote, unauthenticated attacker can exploit the vulnerability by sending specially crafted HTTP/1.x packets over a TLS connection to the affected system. Successful exploitation can result in denial-of-service or, in the worst case, code execution with kernel privileges. The vulnerability has been patched.
Risk score
- cvss base
- 98.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 15.00
- raw before weight
- 113.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 60.00
- vendor mismatch penalty
- 0.00
Path: operational
MITRE ATT&CK mapping
3 TTPsProcedure details
| Technique | Tactic | Procedure | Conf. | Source |
|---|---|---|---|---|
| T1190 Exploit Public-Facing Application | Initial Access | A remote unauthenticated attacker exploits CVE-2026-47291 by sending specially crafted HTTP/1.x requests over TLS to Windows HTTP.sys (IIS), triggering an integer overflow during HTTP header parsing that can result in kernel-level code execution or denial of service. | high | llm |
| T1499.004 Application or System Exploitation | Impact | Successful exploitation of CVE-2026-47291 can cause unexpected system termination due to a memory access exception in the kernel context, resulting in a denial-of-service condition against the targeted Windows server. | high | llm |
| T1068 Exploitation for Privilege Escalation | Privilege Escalation | Under specific memory layout conditions, exploitation of the integer overflow in HTTP.sys can lead to arbitrary code execution in the context of the Windows kernel, granting an attacker the highest level of system privileges. | high | llm |