Microsoft HTTP.sys Remote Code Execution Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2015-1635 · Published 14/04/2015 · updated 17/06/2026

Microsoft HTTP.sys Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/02/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
HTTP.sys Microsoft	Versions not published yet (product named by CISA KEV)

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

References

packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html · Exploit
osvdb.org/120629 · Broken Link
securityfocus.com/bid/74013 · Broken Link
securitytracker.com/id/1032109 · Broken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034 · Patch
exploit-db.com/exploits/36773 · Exploit
exploit-db.com/exploits/36776 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2015-1635

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free