Microsoft HTTP/2 CVE-2026-49160

The target must expose an HTTP/2 listener reachable by the attacker - typically IIS or any HTTP.sys-backed service (WinRM, WSUS, Exchange, AD FS, ASP.NET Core on Windows) with HTTP/2 negotiated over TLS (h2) or, less commonly, cleartext (h2c). No authentication, user interaction, or privileged position is required (PR:N/UI:N), and attack complexity is low (AC:L). Exploitation is limited only by network reachability to the HTTP/2 port (usually 443) and the negotiation of HTTP/2 with the client; endpoints configured to serve only HTTP/1.1 are not exposed. No special non-default configuration is required beyond having HTTP/2 enabled, which is the Windows default on modern builds.

The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) signals a low-complexity, unauthenticated, network-reachable attack with high availability impact and no confidentiality or integrity loss - characteristic of a clean DoS primitive. No EPSS score, KEV listing, or public POC has been provided, so real-world exploitation pressure cannot be quantified from the input; this is an availability-only risk with no evidence of active exploitation. The risk is meaningful for internet-facing Windows web infrastructure where uptime is critical (web apps, APIs, Exchange, WSUS, AD FS), but is not a confidentiality/integrity priority. Key data gaps: no EPSS, no CPE list of affected Windows builds, and only a single MSRC reference - defenders should consult the MSRC update guide to confirm impacted products and KBs before triaging.

An unauthenticated attacker on the internet opens a TLS connection to a vulnerable Microsoft HTTP/2 endpoint and sends a crafted stream of HTTP/2 frames (e.g., rapid stream opens/resets, oversized headers, or flow-control manipulation) that forces the server to allocate state faster than it reclaims it. CPU, memory, or connection-table exhaustion follows, causing the web server to stop responding to legitimate users; modest bandwidth from a single host or small botnet is typically sufficient given the low attack complexity. No public exploit identified at time of analysis.