Vulnerability intelligence
CVE-2026-47291
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
CVSS Score
9.8
Critical
EPSS — Exploit Probability
23%
Riskier than 98% of all CVEs · checked 2026-09-09
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
Patch available
Vendor fix published
4 articles across 4 outlets · first covered Jun 9, 2026 · latest Jul 10, 2026
Coverage timeline
-
CVE-2026-47291 Flaw in Windows IIS Allows Kernel Code Executionwww.thezdi.com · Jul 10, 2026
-
HTTP.sys RCE bug CVE-2026-47291 puts Windows systems at risksecurityonline.info · Jun 12, 2026
-
Microsoft patches CVE-2026-41091 amid record 208 CVE updatesecurityaffairs.com · Jun 9, 2026
-
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th)isc.sans.edu · Jun 9, 2026