Windows HTTP.sys: critical remote code execution (CVE-2026-47291)

On 9 June 2026 Microsoft published the fix for CVE-2026-47291, a critical remote code execution vulnerability in Windows HTTP.sys, the component that handles HTTP requests in Windows and Windows Server. According to the CSAF published by Microsoft, an integer overflow allows an unauthenticated attacker to execute code over the network.

Tenable reports a CVSS v3.1 score of 9.8. The fix is in the June 2026 cumulative updates and should be applied in the normal update cycle, prioritising servers that receive HTTP traffic from untrusted networks.

The sources diverge on some points. One consultancy describes it as potentially wormable; Automox reports that Microsoft does not classify it as such. On exploitation, VulDB reports known technical details but no available exploit. Some sources also point to repositories advertising exploits that contain no code: do not download anything from repositories of this kind.

We found no reliable official mitigation in the sources consulted. A third-party source suggests changing a parameter of HTTP.sys, but this must be verified against the Microsoft bulletin before applying it.

Update Windows servers that run HTTP.sys, verify that the June 2026 update is installed and check the Microsoft bulletin for the current status and affected builds. The sources consulted date from June: the status must be confirmed directly on the bulletin.