Vulnerability intelligence
CVE-2026-47291 — Security Advisory
HTTP.sys is the kernel-mode HTTP driver that underlies IIS, WCF, WinRM, ASP.NET, and every Windows web service. A specially crafted request exceeding 65,535 bytes triggers an integer overflow, heap buffer overflow, and arbitrary code execution with kernel privileges. No authentication. No user interaction. One HTTP request.
CVSS 9.8
2026
What WebPulse reported · 2 analyses
CVE-2026-47291: The Invisible Layer Under Every Windows Web Server Just Got a CVSS 9.8.
HTTP.sys is the kernel-mode HTTP driver that underlies IIS, WCF, WinRM, ASP.NET, and every Windows web service. A specially crafted request exceeding 65,535 byt
June 20, 2026
208 CVEs in One Patch Tuesday. Microsoft's Largest Ever. Including a Wormable Kernel Flaw Compared to EternalBlue. Your Web Server Has 72 Hours.
June 2026 Patch Tuesday delivered 208 CVEs (571 with Chromium bundled), 37 Critical. CVE-2026-45657 (CVSS 9.8) is a use-after-free in Windows Kernel TCP/IP that
June 16, 2026
Related vulnerabilities