Exploitation observed; activity peaked at 10 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
RISING
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 13 products
| Date | Total | Labels |
|---|
| 2026-06-09 | 4 | Disclosure1General1Patch2 |
| 2026-06-10 | 10 | Active Exploitation2Disclosure2General4Patch2 |
| 2026-06-11 | 1 | Patch1 |
| 2026-06-12 | 2 | Disclosure1Patch1 |
| 2026-06-15 | 1 | General1 |
| 2026-06-16 | 4 | Disclosure1Patch2PoC1 |
| 2026-06-17 | 1 | Exploit1 |
| 2026-06-19 | 1 | Patch1 |
| 2026-06-23 | 1 | Disclosure1 |
| 2026-06-24 | 1 | Patch1 |
| 2026-07-02 | 1 | General1 |
| 2026-07-10 | 1 | Disclosure1 |
| 2026-07-11 | 3 | Disclosure1PoC2 |
| 2026-07-12 | 5 | Disclosure3PoC2 |
| 2026-07-13 | 1 | Disclosure1 |
| 2026-07-16 | 2 | Disclosure2 |
| 2026-08-19 | 10 | Active Exploitation1Disclosure8Patch1 |
| 2026-09-14 | 1 | Disclosure1 |
CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys PoC https://github.com/omair2084/misc/blob/master/cve_2026_47291_poc.py https://t.co/Y7lQvoPVOU
Post summary
A proof‑of‑concept for CVE‑2026‑47291 is shared via a GitHub script, confirming the vulnerability as a remote code execution flaw without indicating active exploitation or available patches.
PoC for CVE-2026-47291 https://github.com/omair2084/misc/blob/master/cve_2026_47291_poc.py https://t.co/G7wAp92QIP
Post summary
A proof‑of‑concept script for CVE-2026-47291 has been posted on GitHub.
Our research team is back looking at CVE-2026-47291 - a CVSS 9.8 RCE bug in #Windows HTTP.sys. They show root cause and look at why detection may be just as hard as exploitation. https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys
Post summary
The post announces CVE-2026-47291, a high‑severity RCE vulnerability in Windows HTTP.sys, detailing its root cause and detection challenges.
CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.sys https://byteray-ai.github.io/drift-corpus/item/http_a10f1434-http-report-20260629-001610.html
Post summary
The text announces the new CVE‑2026‑47291, identifying a critical unauthenticated RCE in Windows HTTP.sys.
WindowsのHTTP.sysに存在する重大な脆弱性により、細工されたネットワークパケットだけでリモートコード実行が可能になる恐れがある。CVSSスコアは9.8で、Microsoftは悪用コードが作成される可能性が高いとして早急な更新を呼びかけている。 脆弱性はCVE-2026-47291として追跡されており、HTTP Protocol Stackの整数オーバーフローに起因する。攻撃者はHTTP.sysを利用するサーバーに特別に細工したパケットを送信することで任意のコードを実行できる可能性がある。 現時点で公表された悪用事例は確認されていないが、Microsoftは安定した悪用コードの作成が可能と分析している。影響を受ける環境には2026年6月のセキュリティ更新プログラムの適用が推奨される。 Microsoftは一時的な緩和策も案内しており、レジストリのMaxRequestBytes値を確認するよう求めている。既定値の16384バイトを使用しているシステムは影響を受けず、安全な最小値は65534バイトとされる。修正プログラム適用後は、この設定を既定値へ戻すか削除することで元の動作に復帰できる。 https://securityonline.info/httpsys-rce-cve-2026-47291/
Post summary
A high‑severity integer overflow in Windows HTTP.sys (CVE‑2026‑47291) has been disclosed; Microsoft urges users to install the June 2026 update and offers a registry‑based mitigation, but no public exploitation or PoC has been reported.
CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.sys https://byteray-ai.github.io/drift-corpus/item/http_a10f1434-http-report-20260629-001610.html
Post summary
The note announces CVE‑2026‑47291, a critical unauthenticated RCE in Windows HTTP.sys, and provides a link to a technical report, but it does not detail exploitation, patches, or active attacks.
#NetSec #AppSec 1⃣ CVE-2026-47291: RCE in the Windows HTTP.sys https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys // Windows HTTP.sys vulnerability allowing DoS or kernel code execution via a 16-bit overflow in header parsing during TLS, exploitable through crafted HTTP/1.x requests with many headers over HTTPS 2⃣ Unpatched XRING Flaw in XQUIC https://foxio.io/blog/xring-crashing-xquic-with-spec-compliant-qpack-instructions // A flaw in Alibaba's XQUIC (< 1.9.4) allows remote attackers to crash HTTP/3 servers via small, spec-compliant QPACK traffic due to a size calculation bug, with no patch available as of July 10 3 http://www.kismoe.org 4 http://www.cyberpocket.org
Post summary
The post announces CVE-2026-47291, detailing an RCE in Windows HTTP.sys caused by a 16‑bit overflow in TLS header parsing, and notes an unpatched XQUIC flaw. No active exploitation or patches are indicated.
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The alert announces the discovery of multiple new zero‑day vulnerabilities, highlights their severity, and references the CVE identifiers, without providing PoC, exploit details, or evidence of active exploitation.
Vulnerability CVE-2026-47291 in HTTP.sys: kernel buffer overflow in Windows PT ID: PT-2026-48025 https://dbugs.ptsecurity.com/vulnerability/PT-2026-48025 TrendAI (@trendaisecurity) researchers have identified a flaw in how HTTP/1.x requests over TLS are handled in the "HTTP.sys". Due to an overflow in the 16-bit "capacity" field during dynamic expansion of the buffer array in the "UL_REQUEST_BUFFER" structure, a kernel heap overflow of more than 500 KB occurs. A remote unauthenticated attacker can send a specially crafted HTTP request in which each header line is encapsulated in a separate TLS record. If "MaxRequestBytes ≥ 262144" and the request contains tens of thousands of header lines, this may lead to a system crash or execution of arbitrary code with kernel privileges. The vulnerability is triggered only when parsing HTTP/1.x over HTTPS; HTTP/2 and HTTP/3 are not affected. Article: https://www.zerodayinitiative.com/blog/2026/7/9/cve-2026-47291-remote-code-execution-in-the-windows-httpsys #dbugs_attacks
Post summary
The message announces a new kernel‑heap buffer overflow flaw in Windows HTTP.sys affecting HTTPS requests, providing detailed technical parameters but no PoC, exploit, or patch information.
A critical 9.8 CVSS HTTP.sys RCE vulnerability (CVE-2026-47291) threatens millions of users. Secure your Windows HTTP stack exploit risks now. #CyberSecurity #CVE202647291 #WindowsSecurity #RCE https://securityonline.info/httpsys-rce-cve-2026-47291 https://t.co/rSnzyYyJZo
Post summary
The tweet announces a 9.8 CVSS RCE vulnerability in HTTP.sys targeting Windows users, urging immediate mitigation, but it lacks details on patches, exploit code, or evidence of active use.
ZDI's bug of the month. Two of them. Both CVSS 9.8. 🔴 CVE-2026-45657 - Windows Kernel TCP/IP RCE. Remote. Unauthenticated. SYSTEM. Wormable. 🔴 CVE-2026-47291 - HTTP.sys RCE. Same deal. Microsoft rates this "Exploitation More Likely." Every researcher and bug shop on the planet is reversing these right now. Are you patched before they finish? 📡 http://VulnTracker.io
Post summary
Two high‑severity Windows kernel and HTTP.sys RCE bugs are announced, with details on impact and CVSS scores, urging readers to patch but no PoC or exploit code is shared.
今月気になるのは、CopilotのRCEや情報漏えい（MSで対処済み）、WindowsカーネルのRCE（CVE-2026-45657）、悪用されそうなHTTP.sysのRCE（CVE-2026-47291）の影響を受ける設定が世の中にどれだけ存在しているのかですね。 The June 2026 Security Update Review https://www.zerodayinitiative.com/blog/2026/6/9/the-june-2026-security-update-review
Post summary
The text mentions two kernel RCE CVEs and a patched Copilot RCE, but provides no PoC, exploit code, active exploitation evidence, or in‑depth technical detail, making it a general status update.
effort no. 45204 making a few hackernews/malware source news a week this ones about CVE-2026-47291, semi-confirmed available working for sale $832 (BTC) https://x.com/offsitedark/status/2067376184627691752?s=20
Post summary
The tweet reports that a working exploit for CVE‑2026‑47291 is reportedly available for purchase, but provides no technical or patch details.
CVE-2026-49160 & CVE-2026-47291 PoC https://github.com/dhmosfunk/CVE-2026-49160-CVE-2026-47291-HTTP.sys #CVE_2026_47291_poc #CVE_2026_49160_poc #rce #dos #overflow #microsoft #cve
Post summary
This post shares Proof of Concept code on GitHub for CVE‑2026‑49160 and CVE‑2026‑47291, indicating RCE and DoS via overflow, but does not mention active exploitation or patches.
1/2 The era of guessing what’s inside Patch Tuesday is officially over. 🪦 ZDI just dropped the write-up for CVE-2026-47291 (HTTP.sys RCE), but you can already look at the actual binary diff, call chains, and WinDbg breakpoints in real-time.
Post summary
ZDI released a write-up for CVE‑2026‑47291, describing an HTTP.sys remote code execution flaw and offering technical details such as binary diffs and call chains, but no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-47291 PoC - buffer overflow exploit Etkilenen bileşen: Windows HTTP.sys Unauthenticated remote code execution (IIS, WinRM vb. etkiliyor). https://github.com/omair2084/misc/blob/master/cve_2026_47291_poc.py
Post summary
The post announces a PoC for CVE-2026-47291, providing a Python exploit and technical details about a buffer overflow in Windows HTTP.sys, but offers no evidence of active exploitation or patches.
🚨 UPDATE — June Patch Tuesday: Two CVSS 9.8 wormable flaws, not one. CVE-2026-45657 (Windows Kernel, TCP/IP) AND CVE-2026-47291 (HTTP.sys) are both remote, unauthenticated, no user interaction required. Zero Day Initiative is blunt: "every researcher and bug shop on the planet is reversing these patches right now." The WannaCry comparison is already being made. That 2017 worm hit 200,000 systems in 150 countries — even though Microsoft had patched it two months earlier. The window between patch and weaponized exploit may be days. If you haven't applied KB5094126 (Win11) or KB5094127 (Win10) yet, stop what you're doing. 👇 https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/
Post summary
Microsoft released critical patches for two high‑impact wormable CVEs; users are urged to apply KB5094126 and KB5094127 immediately to prevent potential exploitation.
19:18 UTC: Thread live on @lyrie_ai. 0day Intel: CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.s
Post summary
"CVE-2026-47291", a critical unauthenticated Windows RCE in HTTP, has been publicly disclosed. No PoC, exploit, active attacks, or patch details are provided.
19:15 UTC: GPT-5 enrichment complete. 39 words. 1 citations. 0day Intel: CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.s
Post summary
The text announces a new critical vulnerability (CVE-2026-47291) enabling unauthenticated remote code execution over HTTP in Windows.
22:04 UTC: First exploit attempt in the wild. 0day Intel: CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.s
Post summary
CVE-2026-47291 has been observed exploited in the wild for the first time, revealing a critical Windows RCE vulnerability via HTTP with no publicly disclosed PoC, exploit code, or patch.
24 of 24 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | x64 |