Automox: CVE-2026-47291: HTTP.sys RCE Vulnerability Explained

Name: Automox: CVE-2026-47291: HTTP.sys RCE Vulnerability Explained
Uploaded: 2026-07-16T16:58:00-04:00
Duration: 46 s
Description: CVE-2026-47291 is a CVSS 9.8 critical HTTP.sys remote code execution vulnerability and it's the only bug this month that's both a 9.8 and on Microsoft's exploitation-more-likely list. No login. No user interaction. Just a crafted packet sent over HT...

Automox

07/16/2026

0 (0%)

Report Like Favorite

TL;DR

CVE-2026-47291 is a CVSS 9.8 critical RCE vulnerability in HTTP.sys, the Windows kernel-mode HTTP driver, making it the highest-severity bug this Patch Tuesday.
The vulnerability requires no authentication and no user interaction — a single specially crafted HTTP packet is sufficient to trigger remote code execution.
This is the only vulnerability this month rated both 9.8 and placed on Microsoft's exploitation-more-likely list, signaling urgent patch priority for exposed servers.

Summary

In this short clip from the Automox Patch Tuesday podcast, CTO Jason Kikta highlights CVE-2026-47291, a CVSS 9.8 critical remote code execution vulnerability in HTTP.sys — the Windows kernel-mode driver responsible for handling HTTP traffic. What makes this vulnerability particularly alarming is its combination of factors: it carries the highest severity rating on the CVSS scale, requires no authentication, demands no user interaction, and is listed on Microsoft's exploitation-more-likely list — making it the only bug this month to hold both distinctions simultaneously. The attack mechanism involves an integer overflow in the HTTP.sys driver, exploitable by sending a specially crafted packet over the HTTP protocol stack. A successful exploit lands an attacker directly in kernel mode, the highest privilege level in the Windows architecture, with no further escalation required. Patch prioritization for this CVE should be immediate for any internet-facing Windows server infrastructure.

Chapters

0:00 - Severity and Exploitation Likelihood
0:08 - Integer Overflow in HTTP.sys
0:28 - Attack Mechanism Explained

Key Quotes

0:05 "It's the only bug this month that's both a 9.8 and on the more likely list."
0:28 "Microsoft's description is an unauthenticated attacker, sending a specially crafted packet to a target server over the HTTP protocol stack."
0:38 "No login, no user interaction."

FAQ

Why is CVE-2026-47291 considered especially dangerous compared to other Patch Tuesday vulnerabilities?

It is the only vulnerability this month rated CVSS 9.8 AND listed on Microsoft's exploitation-more-likely list. It requires no login and no user interaction, and a successful exploit grants kernel-mode access — the highest privilege level in Windows.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Illumio + Netskope: Zero Trust in the Age of AI Autonomy

Ask Your Cloud Anything: Unlocking Governance Silos in your Environments

Insights from Attackers During the FIFA World Cup: A HUMAN Dialogue

Becoming Agent Ready: Insights from Cyera's Expertise