CVE-2026-47291

Windows HTTP.sys is a core “traffic director” that handles web/network requests in Windows. This flaw is caused by an integer math mistake that can be tricked into behaving incorrectly, and that can let an attacker get their code to run. Think of it like a highway toll machine that miscalculates change under certain conditions—an attacker can manipulate the input to make the system do the wrong thing.

This matters to you if you run or rely on these systems for business operations: Microsoft Windows 10 1607, 1809, 21h2, 22h2, and Microsoft Windows 11 23h2, 24h2, 25h2, 26h1. It also affects Microsoft Windows Server 2012 and Microsoft Windows Server 2016. If any of these machines are exposed to the internet or connected networks where attackers could reach them, you’re in the risk zone.

This is RED because exploitation is reported “itw” (in the wild), including sustained press attention. That means attackers are actively looking for vulnerable systems right now, so waiting increases the chance you get hit. Prioritize patching as soon as possible and make sure exposure is reduced until updates are applied.

1. Identify scope: List every device running the affected versions: Microsoft Windows 10 1607, 1809, 21h2, 22h2; Microsoft Windows 11 23h2, 24h2, 25h2, 26h1; and servers Microsoft Windows Server 2012 and Microsoft Windows Server 2016. Confirm whether any are internet-facing or accessible from untrusted networks.

2. Patch immediately: Install the relevant Microsoft security update(s) that address CVE-2026-47291 on all affected machines. Reboot if required by the update process and verify updates were applied successfully.

3. Reduce exposure while patching: If patching takes time, limit inbound traffic to what is necessary. For internet-facing systems, ensure firewall rules deny inbound connections that are not required. If your business uses a reverse proxy/load balancer, ensure the vulnerable host itself is not directly reachable from the internet.

4. Validate behavior: After patching, confirm the system is stable and that services you run (web/app endpoints) still function.

5. Monitor: Since exploitation is reported in the wild, keep an eye on unusual network activity and unexpected application behavior on the affected systems. If your IT provider has logging/alerting, ensure events related to network service activity are being collected and reviewed.

6. Plan ahead: For older end-of-life versions (notably older Windows Server/10 releases), consider migration to supported Windows versions so you are not dependent on repeated emergency patch cycles.

Severity is effectively critical for exposed environments: CVSS is listed as 9.8, and the issue is a Windows HTTP.sys remote code execution flaw. Reported exploitation status is “itw” (in the wild) and a named actor is mentioned in press as Nightmare Eclipse (Chaotic Eclipse). However, a CISA KEV entry is “no,” and the provided data says no public exploit is available and no Nuclei detection template exists.

Weakness type is an integer overflow or wraparound in HTTP.sys, which can be abused to achieve unauthorized code execution over a network connection. The attack vector is network-based interaction with the Windows HTTP request handling component (HTTP.sys). EPSS is given as 4.3% estimated probability of exploitation in the next 30 days; that is not the same as “already safe,” and in this case exploitation is reported as active.

About EPSS/KEV: EPSS is an estimate of likelihood of exploitation in the near term; KEV (CISA Known Exploited Vulnerabilities) is a list of vulnerabilities CISA has identified as exploited. For this CVE, KEV status is “no,” but “itw” indicates real-world activity nonetheless.