What is the CVSS score of EUVD-2026-43802?

EUVD-2026-43802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Windows HTTP.sys are affected by EUVD-2026-43802?

Microsoft Windows HTTP.sys vulnerability (CVE-2026-49787) enables unauthenticated, remote denial-of-service attacks against Windows 10, Windows 11, and Windows Server platforms; no public exploit…. A patch is available.

How to fix or mitigate EUVD-2026-43802?

Within 24 hours, identify and inventory all affected Windows systems (Windows 10, Windows 11, and Windows Server 2016-2025) using Microsoft's MSRC advisory as authoritative source; prioritize systems hosting critical services or facing internet exposure. Within 7 days, deploy the Microsoft patch to critical infrastructure including domain controllers, web servers, and internet-facing systems using standard change management. Within 30 days, complete patch deployment enterprise-wide, followed by vulnerability rescanning to confirm remediation.

Windows HTTP.sys EUVD-2026-43802

| CVE-2026-49787 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-5h64-g45f-7wgq

Denial Of Service Microsoft Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity resource-exhaustion DoS with no confidentiality or integrity impact, so AV:N/AC:L/PR:N/UI:N and A:H only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:35 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft Windows HTTP.sys allows remote unauthenticated attackers to exhaust system resources and make affected hosts unresponsive over the network. The flaw stems from missing resource limits/throttling (CWE-770) in the kernel-mode HTTP protocol stack, affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available via MSRC.

Technical ContextAI

HTTP.sys is the kernel-mode HTTP protocol stack (http.sys driver) that underpins IIS and any application using the Windows HTTP Server API, handling connection management, request parsing, and response queuing before requests reach user-mode services. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the driver fails to bound some resource - such as memory, connection state, or queued request objects - allowing an attacker to force unbounded consumption. Because HTTP.sys runs in the kernel and fronts web-facing services on Windows Server (IIS, WinRM, WSUS, and other HTTP.sys-based listeners) and Windows clients, resource exhaustion here degrades or halts service availability system-wide rather than for a single application.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for your specific Windows build as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49787 (exact fixed KB/build numbers are provided there per OS version). Prioritize internet-facing IIS and HTTP.sys-based servers (Windows Server 2016/2019/2022/2025). Where immediate patching is not possible, reduce exposure by restricting network access to HTTP/HTTPS listeners via host or perimeter firewall rules so only trusted clients can reach the affected endpoints, and place vulnerable servers behind a reverse proxy or load balancer that enforces connection rate limiting and request throttling - noting the trade-off that these controls reduce but do not eliminate the resource-exhaustion vector and add infrastructure/latency overhead. Disabling non-essential HTTP.sys listeners (e.g. unused WinRM or legacy web endpoints) further shrinks attack surface.