CVE-2026-69597

Microsoft's Windows HTTP.sys kernel-mode HTTP protocol stack contains a use-after-free vulnerability (CWE-416) that can be reached over the network. Per Microsoft's scoring, an authorized (low-privilege) attacker, with user interaction and under high-complexity conditions, can trigger the flaw via crafted network traffic that causes the driver to use memory after it has been freed. Successful exploitation allows the attacker to elevate privileges on the target host, with high confidentiality, integrity, and availability impact, likely in a kernel context. Any Windows edition shipping the HTTP.sys driver is potentially affected — most notably servers exposing IIS or other HTTP.sys-based listeners — though the available data does not enumerate specific affected builds. There is no known public proof of concept, the CVE is not in CISA KEV, and EPSS estimates only about a 0.6% chance of exploitation within 30 days.

What to do: Apply Microsoft's current Windows cumulative security update as soon as available, checking Microsoft's advisory for the specific affected builds; prioritize internet-facing Windows Servers running IIS or other HTTP.sys-based listeners. Until patched, restrict authenticated network access to those hosts and monitor for anomalous authenticated HTTP traffic; no workarounds are documented in the available data.