CVE-2026-47291: Inside the Critical HTTP.sys RCE That Demands Your Immediate Attention

Executive Summary

On June 9, 2026, Microsoft released a Patch Tuesday update covering 206 vulnerabilities — the largest single release in company history. Among them, one CVE stands above the rest. CVE-2026-47291 is a critical remote code execution vulnerability in the Windows HTTP protocol stack (HTTP.sys) with a CVSS score of 9.8 out of 10. It requires no authentication, no user interaction, and works over the network.

An unauthenticated attacker can crash or fully compromise any Windows server that listens on HTTP or HTTPS simply by sending a crafted packet. Because the vulnerability lives in kernel mode, a successful exploit hands the attacker SYSTEM privileges with no privilege boundary above them. Every supported version of Windows client and server is affected — from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025.

Microsoft placed CVE-2026-47291 on its “exploitation more likely” list. While no public proof-of-concept code has been released as of this writing, the vulnerability pattern is well understood, and automated scanning for vulnerable targets is straightforward. Microsoft Security Response Center — June 2026 Security Updates

CVE Details

Field	Value
CVE ID	CVE-2026-47291
CVSS Score	9.8 (Critical)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-190 (Integer Overflow or Wraparound) → CWE-122 (Heap-based Buffer Overflow)
Published	June 9, 2026
Vendor	Microsoft
Exploitation	Likely (per Microsoft)
Public PoC	None at time of writing
CISA KEV	Not listed

Plain-English CVSS Breakdown

Attack Vector (Network): Exploitable remotely over the internet — no physical or local network access needed.
Attack Complexity (Low): No special conditions or chained exploits required. A single crafted packet triggers the bug.
Privileges Required (None): No login, no credentials, no prior access needed.
User Interaction (None): The victim doesn’t need to click anything or open any file.
Scope (Unchanged): The impact stays within the compromised component — though since it’s kernel mode, “within the component” means the entire OS.
Confidentiality/Integrity/Availability (High): Complete compromise of data confidentiality, file integrity, and system uptime.

Affected Systems

This vulnerability spans nearly the entire Windows ecosystem:

Windows Client:

Windows 10 (1607, 1809, 21H2, 22H2)
Windows 11 (23H2, 24H2, 25H2, 26H1)

Windows Server:

Windows Server 2012, 2012 R2
Windows Server 2016, 2019, 2022, 2025

The reach is enormous because HTTP.sys is not just IIS. It powers Windows Remote Management (WinRM) on ports 5985/5986, WSDAPI, the Print Spooler HTTP listener, and any application using the Windows HTTP Server API (HTTP API). Any one of these services on any Windows version above creates an exploitable surface. An inventory of every service that binds to HTTP on your Windows fleet is the first step in triage.

Root Cause

The bug lives in HTTP.sys, the kernel-mode driver that parses incoming HTTP requests for the entire Windows HTTP stack. It is a classic integer overflow (CWE-190) in the request parser’s length arithmetic.

When HTTP.sys processes certain HTTP request elements — specifically those involving Content-Length, Transfer-Encoding: chunked, and related header chains — it performs arithmetic on attacker-controlled length values. If the attacker provides values that, when multiplied or added during allocation calculation, exceed the maximum representable integer, the result “wraps around” to a small number. The kernel then allocates a buffer based on this smaller-than-expected size.

Subsequent copy operations write the full attacker payload into this undersized buffer, causing a heap-based buffer overflow (CWE-122) on the kernel heap pool. Adjacent kernel objects are corrupted, and the attacker gains a write primitive they can use to redirect execution flow.

The critical detail: this happens before authentication. The integer overflow occurs during initial HTTP request parsing, at a stage where no identity check has occurred. Any host with TCP port 80 or 443 exposed is reachable.

This is the same vulnerability class that produced the infamous CVE-2021-34527 (PrintNightmare), CVE-2024-38077 (Windows Remote Desktop Licensing Service), and the 2021 HTTP.sys scare that sent security teams scrambling across the industry. Each time, the combination of unauthenticated + kernel-mode + integer overflow proved devastating. CVE-2026-47291 — NVD Detail

Exploit Analysis

Attack Surface

Any service that sits on top of HTTP.sys is a potential vector:

Service	Default Port	Common Role
IIS (Internet Information Services)	80/443	Web server, SharePoint, Exchange
WinRM	5985/5986	Remote management, automation, monitoring
WSDAPI	5357/5358	Network device discovery
HTTP Server API apps	varied	Custom services, print servers

Exploit Mechanics

An attacker would send a crafted HTTP request with specifically sized header fields to trigger the integer overflow. The request reaches the kernel-mode parser before any application-layer handling occurs. After the overflow corrupts kernel heap memory, a carefully chosen follow-up request or a natural heap operation triggers code execution in kernel context.

Because HTTP.sys runs in ring 0 (kernel mode), there is no privilege boundary between the exploit and full system control. From SYSTEM, an attacker can:

Install persistent malware or a rootkit
Dump LSASS and harvest domain credentials
Move laterally across the network with stolen tokens
Disable endpoint detection and response agents
Encrypt disks for ransomware deployment

Wormability

Microsoft has not tagged CVE-2026-47291 as wormable, and security researchers at CrowdStrike and Automox who analyzed the bug note that an integer overflow doesn’t automatically translate into a self-propagating worm. Wormable bugs need reliable, repeatable exploitation without crashing the target — a higher bar than simple code execution. However, the raw capability is present, and the gap between “not wormable today” and “wormable next week” is narrow.

Automox Patch Tuesday Analysis — June 2026 CrowdStrike Patch Tuesday Analysis

Proof of Concept (Conceptual)

No public proof-of-concept code has been released as of June 20, 2026. However, the exploitation pattern for HTTP.sys integer overflows is well documented from prior research:

1. Identify a target running a supported Windows version with HTTP services exposed
2. Craft an HTTP request with attacker-controlled length fields designed so that:
   - Normal arithmetic (e.g., Content-Length multiplied by Transfer-Encoding chunk count)
   - Produces a result exceeding uint32_max
   - Wraps to a value between 0 and expected buffer size
3. Send the crafted request to the target's HTTP listener
4. HTTP.sys kernel-mode parser processes the request, computes the incorrect size
5. HTTP.sys allocates a kernel pool buffer smaller than required
6. The subsequent copy operation overflows into adjacent kernel structures
7. Heap grooming and controlled corruption achieve code execution at ring 0

Without a public PoC, the primary risk today is from nation-state actors and advanced persistent threat groups who can independently reproduce the exploit. The exploitation-more-likely rating from Microsoft signals that the internal security team believes weaponization is achievable without unusual effort.

Detection

Log-Based Detection

The most accessible detection source is HTTP.sys error logging, stored at: %SystemRoot%\System32\LogFiles\HTTPERR

Look for these indicators:

Spikes in BadRequest or Request_Header_Too_Long errors from a single source IP
Anomalous 400-series responses preceding kernel crashes
Session records showing malformed Transfer-Encoding or oversize Content-Length values

Kernel Crash Telemetry

Failed exploitation attempts often produce bugchecks:

BugCheck 0x139 (KERNEL_SECURITY_CHECK_FAILURE) — common when heap corruption is detected
BugCheck 0x50 (PAGE_FAULT_IN_NONPAGED_AREA) — when the overflow corrupts a pointer
BugCheck 0x1A (MEMORY_MANAGEMENT) — pool header corruption

Forward these to a SIEM with Get-WinEvent -LogName System around timestamps corresponding to inbound HTTP traffic bursts.

Network Detection

Monitor for HTTP requests with abnormally large or multi-segment header chains
Watch for HTTP/1.1 requests combining Content-Length and Transfer-Encoding: chunked in ways that violate RFC 7230 section 3.3.3
Alert on TCP sessions to HTTP ports originating from IPs with no prior baseline

SentinelOne CVE-2026-47291 Detection Guidance

Mitigation

Apply Patches (Primary)

The only complete fix is applying the June 2026 Microsoft security update. Each affected Windows version has a specific KB article:

Windows Version	KB Article
Windows Server 2025	KB50xxxxx (see MSRC advisory)
Windows Server 2022	KB50xxxxx
Windows Server 2019	KB50xxxxx
Windows Server 2016	KB50xxxxx
Windows 11 26H1	KB50xxxxx
Windows 11 25H2, 24H2, 23H2	KB50xxxxx
Windows 10 22H2	KB50xxxxx

Check MSRC CVE-2026-47291 for the exact KB matching your build.

Network-Level Mitigations (Temporary)

If patching must be delayed:

Reverse proxy protection: Place vulnerable hosts behind a reverse proxy or WAF that normalizes HTTP headers (e.g., HAProxy, NGINX, Cloudflare). The proxy should sanitize Transfer-Encoding, reject conflicting Content-Length values, and cap header sizes.

Firewall restrictions: Apply network ACLs to limit HTTP ports (80/443/5985/5986) to trusted IP ranges. On Windows Server:

# Restrict WinRM HTTP to management subnet only
New-NetFirewallRule -DisplayName "Block WinRM except mgmt" `
  -Direction Inbound -Protocol TCP -LocalPort 5985 `
  -RemoteAddress 10.0.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block WinRM all others" `
  -Direction Inbound -Protocol TCP -LocalPort 5985 `
  -Action Block

Disable unused HTTP listeners: If WinRM is not actively used for management, disable it:
```
Disable-PSRemoting -Force
Set-Service WinRM -StartupType Disabled
```

Inventory Checklist

Identify all Windows hosts exposing HTTP/HTTPS/WinRM to the internet
Apply the June 2026 cumulative update to these hosts first
Run netstat -ano | findstr ":80 :443 :5985 :5986" to catalog listeners
Check for third-party services using the HTTP Server API
Enable HTTP.sys error logging on all patch-delayed hosts
Deploy network-level HTTP inspection rules

Timeline

Date	Event
June 9, 2026	Microsoft publishes CVE-2026-47291 as part of June 2026 Patch Tuesday (206 CVEs)
June 9, 2026	CVE assigned CVSS 9.8, rated “Exploitation More Likely”
June 9, 2026	CrowdStrike, Rapid7, Automox, Qualys publish initial advisories
June 10, 2026	NVD entry last updated
June 11, 2026	SentinelOne adds to vulnerability database
June 15, 2026	CISA adds two other CVEs to KEV (not CVE-2026-47291 yet)
June 20, 2026	This analysis published — no public PoC, no active exploitation confirmed

What Makes This CVE Different

Most CVSS 9.8 bugs have at least one mitigating factor: they require a specific protocol, an uncommon configuration, or low-value post-exploitation access. CVE-2026-47291 has none of these. It is:

Everywhere: Every supported Windows version. Every host that answers HTTP.
Pre-auth: No credentials needed. No user action.
Kernel-level: SYSTEM is the floor, not the ceiling.
Scriptable: No per-target customization needed for the core overflow primitive.

The security community’s attention this month is split across a record-breaking 206 CVEs, a new Linux local-root bug (CVE-2026-46333 with working public exploit), and the ongoing Dirty Frag saga. But CVE-2026-47291 should be first in your patch queue. It checks every box on an attacker’s target list.

Qualys Patch Tuesday Review Rapid7 Patch Tuesday Analysis

Sources

ToolBrain — tool reviews, LLM comparisons, and AI workflow guides

Cross-links automatically generated from None.