Vulnerability intelligence

CVE-2026-47291

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

CVSS Score

9.8

Critical

EPSS — Exploit Probability

23%

Riskier than 97% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

4 articles across 4 outlets · first covered Jun 9, 2026 · latest Jul 10, 2026

Tracked incidents

vulnerability open 4 articles

Microsoft June 2026 Patch Tuesday addresses 208 vulnerabilities

Coverage timeline

CVE-2026-47291 Flaw in Windows IIS Allows Kernel Code Execution
www.thezdi.com · Jul 10, 2026
HTTP.sys RCE bug CVE-2026-47291 puts Windows systems at risk
securityonline.info · Jun 12, 2026
Microsoft patches CVE-2026-41091 amid record 208 CVE update
securityaffairs.com · Jun 9, 2026
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th)
isc.sans.edu · Jun 9, 2026