Windows HTTP.sys CVE-2026-49787

No special conditions - remote unauthenticated exploitation against network-reachable HTTP.sys listeners on affected Windows systems (CVSS AV:N/AC:L/PR:N/UI:N). The practical prerequisite is that the target must expose an HTTP.sys-based service (e.g. IIS, WinRM, or another HTTP Server API listener) reachable by the attacker; hosts with no exposed HTTP.sys listener or with such listeners firewalled off are not exploitable. Limiting factors are therefore network exposure of the HTTP stack rather than authentication or configuration - impact is confined to availability (denial of service), with no confidentiality or integrity effect.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High) indicates a low-complexity, network-reachable, unauthenticated attack with high availability impact but no confidentiality or integrity impact - a pure denial-of-service condition. No EPSS score, SSVC decision, POC, or KEV entry was provided in the input, so real-world exploitation likelihood cannot be quantified from the data; the absence of KEV listing means there is no confirmed active exploitation. The realistic priority is moderate-to-high for internet-facing Windows web servers given the trivial preconditions and wide affected footprint, but it is availability-only - no data breach or code execution - so it should be patched promptly on exposed hosts while not being treated as an RCE-class emergency. Key missing signals (EPSS, POC status) should be monitored, as HTTP.sys DoS flaws have historically been quick to weaponize once details surface.

An attacker with only network reachability to a Windows host's HTTP.sys listener sends a stream of specially crafted or high-volume HTTP requests designed to trigger unbounded resource allocation in the kernel driver. Because no authentication or user interaction is required (PR:N/UI:N) and attack complexity is low (AC:L), the attacker exhausts memory or connection resources, causing the web service or the entire host to become unresponsive. No public exploit is identified at time of analysis, but the low barrier makes exploitation straightforward once details are known.