CVE-2026-62735

Windows HTTP.sys Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your Windows version/build number and whether Windows HTTP.sys has been patched by applying the latest Microsoft security updates for CVE-2026-62735.
If you are on Windows 10, update to at least one of: 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, or 10.0.19045.7663.
If you are on Windows 11, update to at least one of: 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, or 10.0.28000.2704.
If you are on Windows Server, update to at least one of: 2012/2016 → 10.0.14393.9418 or 2019 → 10.0.17763.9115, 2022 → 10.0.20348.5440, 2025 → 10.0.26100.33222.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

This is a Windows bug that can let someone with local access raise their privileges; if your business computers are up to date, the risk is much lower, but unpatched systems should be updated urgently.

CVE-2026-62735 is a local elevation of privilege issue in Windows HTTP.sys driven by a memory-safety weakness (heap-based buffer overflow, CWE-122/CWE-190), enabling an attacker with local access to gain higher privileges.

If you're affected

Full admin-level access
System compromise
Service disruption
Worm-like spread unlikely

What is it

Windows HTTP.sys is a core networking component that helps Windows handle web and HTTP traffic. This vulnerability is a memory-handling flaw that can allow a person who already has access on the machine to gain higher permissions, like becoming an administrator.

Who is affected

This matters if you run any of the affected Windows versions: windows 10, windows 11, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2012 r2. The risk is primarily for attackers who can already access the machine locally; for most small businesses, that means the bigger concern is preventing unauthorized local access. Even if your servers are exposed on the network, this specific issue is not a “remote-from-anywhere without access” problem based on the provided findings.

How urgent is it

This is rated RED because it is a privilege-escalation bug in a critical Windows networking component, and it has received public attention with actors associated (Lazarus group). While there’s no KEV listing and no public exploit code on record, patching should still be treated as urgent because privilege escalation can turn a limited foothold into full control.

What to do — in detail

Identify affected systems
- For each device, determine the exact Windows version/build (e.g., via System Settings or “winver”).
- Confirm whether the OS matches one of the affected products: windows 10, windows 11, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2025, windows server 2012 r2.
Verify patch status against Microsoft’s fixed builds
- Windows 10: fixed in 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, or 10.0.19045.7663.
- Windows 11: fixed in 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, or 10.0.28000.2704.
- Windows Server 2012/2016: fixed in 10.0.14393.9418.
- Windows Server 2019: fixed in 10.0.17763.9115.
- Windows Server 2022: fixed in 10.0.20348.5440.
- Windows Server 2025: fixed in 10.0.26100.33222.
Apply the vendor update
- Use Microsoft’s update guidance for CVE-2026-62735 and apply the corresponding security update(s) to move each machine to the fixed build for its branch.
- Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62735
Temporary workaround if patching is delayed
- Reduce the chance of unauthorized local access: ensure accounts are protected with strong passwords/MFA where available, remove unnecessary local admin rights, and restrict who can log on interactively.
- If you have a managed environment, prioritize patching for machines that have higher exposure to user activity (helpdesk endpoints, admin workstations, and any systems with elevated privileges).
What to monitor after updating
- Look for unusual privilege changes or suspicious local activity around the time of updates (especially on administrative machines).
- Continue normal patch hygiene across the fleet because this issue is a local privilege escalation path: preventing unauthorized access is a key part of risk reduction.

Technical context

Severity is HIGH (CVSS 7.8). This is a local elevation of privilege vulnerability in Windows HTTP.sys caused by a heap-based buffer overflow (CWE-122) and related memory-safety issue (CWE-190). The findings indicate no KEV entry (not in CISA KEV), no public exploit code on record, and a predicted likelihood that is low and flat (EPSS is a prediction, and no exploitation confirmation is included in the provided findings). PULSE notes press attention and patch-related activity associated with Lazarus group, which drives the RED urgency. Exploitation requires local/authorized access rather than purely remote access based on the local attack characterization in the provided CVSS vector.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable