CVE-2026-62741

Windows HTTP.sys Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether the affected Windows version is installed and whether your system has pending updates for Windows HTTP components.
Compare your current Windows build/patch level against the fixed versions listed by Microsoft for CVE-2026-62741.
Install the Microsoft fix for CVE-2026-62741 (or the latest cumulative update that includes it) on every affected machine.
If you can’t patch immediately, restrict who has local logon/low-privileged access on the device until updates are applied, and monitor for unusual privilege changes after local logons.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-62741 is a Windows privilege-escalation flaw that lets a low-privileged local user gain high privileges on the same PC; most small businesses should patch because it applies to common Windows versions and only requires local access.

CVE-2026-62741 is a local privilege-escalation issue in Windows HTTP.sys caused by an integer underflow/wraparound in the HTTP service; a low-privileged authenticated user can trigger it to escalate to full control on the same machine.

If you're affected

Full control by a local user
Account takeover on the device
Worm-like spread via compromised accounts
Service and data disruption

What is it

This bug is in Windows’ HTTP service (HTTP.sys). If someone already has a low-privileged account on your computer, they may be able to use the flaw to jump to full system control—like turning a small key into a master key without needing admin credentials.

Who is affected

This matters if you run or administer the listed Windows versions on workstations or servers (Windows 10, Windows 11, and Windows Server 2012/2016/2019/2022/2025 and 2012 R2). It’s mainly a risk when an attacker can log on locally with low privileges, because the flaw requires local authenticated access and no user interaction. If your environment strongly limits who can get local accounts, the risk is lower—but patching is still important for every affected machine.

How urgent is it

Verdict is RED because attackers can potentially escalate from low privileges to full control on the same device once they have local authenticated access, and the issue affects widely used Windows versions. Microsoft has provided fixed builds, and the reporting indicates active adversary interest (“actor: Lazarus group”), so treating this as an urgent patch is appropriate.

What to do — in detail

Confirm exposure on each endpoint/server
- On each machine, identify the OS version and current update/build level.
- Determine whether your machine is earlier than Microsoft’s fixed versions for CVE-2026-62741 (below).
Apply the fix
- Patch each affected machine with the Microsoft update for CVE-2026-62741 (or a newer cumulative update that includes the fix).
- Fixed versions (as provided by Microsoft):
  - windows 10: fixed in 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, 10.0.19045.7663
  - windows 11: fixed in 10.0.22631.7517, 10.0.26100.9106, 10.0.26200.9106, 10.0.28000.2704
  - windows server 2012: fixed in 10.0.14393.9418
  - windows server 2016: fixed in 10.0.14393.9418
  - windows server 2019: fixed in 10.0.17763.9115
  - windows server 2022: fixed in 10.0.20348.5440
  - windows server 2025: fixed in 10.0.26100.33222
Temporary workaround if patching is delayed
- Reduce the chance of a local low-privileged account being available:
  - Limit who can log on locally.
  - Remove unnecessary local accounts and reduce permissions for any users who do not need elevated capabilities.
- This does not remove the vulnerability, but it reduces the number of real-world conditions under which it can be used (local authenticated low-privileged access).
After patching
- Re-check that the update/build level matches (or is newer than) the fixed versions above.
- Review local security logs around admin/privilege changes following local logons for any suspicious activity while rollout is in progress.
Communication and rollout
- Prioritize devices exposed to untrusted users (e.g., kiosks, shared PCs, offices with contractors) where “low-privileged local access” is more likely.

Note on public exploitation

There is no clear dated public claim of exploitation in the press and no public exploit code on record in the provided findings; however, the traffic-light verdict remains RED due to local privilege-escalation capability and active threat interest noted in the reporting.

Technical context

Severity/impact: Windows HTTP.sys contains an integer underflow (wrap/wraparound) that can be abused for local privilege escalation (CWE-122, CWE-191). Mechanism: an authenticated local attacker with low privileges can trigger the flaw to escalate to high privileges on the same machine.

Attack vector and reachability: Local-only; user interaction is none. Authentication is required, and the precondition is local access with low privilege.

Exploitation and maturity: KEV entry is not listed, and the findings do not include a dated, clear press exploitation claim or public exploit code. Even so, adversary interest is indicated (actor: Lazarus group), and the overall verdict is RED.

EPSS: A prediction is provided (2.0% with flat trend), but the findings emphasize that this is not the deciding factor if exploitation is confirmed by KEV/news; KEV is not listed here.

Fix status: Microsoft has fixed builds across Windows 10, Windows 11, and multiple Windows Server versions; use the fixed version numbers provided in the PATCH findings or install the corresponding Microsoft security update guidance page for CVE-2026-62741.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 5 days, from the signal feeds we watch.

2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check addedpatch available, record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable