HTTP Protocol Stack EUVD-2026-56372

The attacker must be positioned on the same network segment, broadcast domain, or adjacent link as the target - direct internet exploitation is precluded by the AV:A vector. No authentication is required (PR:N per CVSS) and no user interaction is needed (UI:N). The Windows HTTP Protocol Stack (http.sys) must be active on the target, which is the default state for any Windows system running IIS, WinRM, HTTP.sys-based APIs, or similar services. Exploitation is bounded by the adjacency requirement, meaning threat actors must first obtain local network access via physical presence, VPN credentials, a compromised adjacent host, or shared cloud virtual network membership. The integrity-only impact profile (C:N/I:H/A:N) restricts the direct consequence to tampering rather than data exfiltration or system unavailability, though authentication bypass can facilitate further lateral movement in multi-tier environments.

The CVSS 3.1 base score of 6.5 (Medium) reflects a high-integrity flaw materially constrained by the adjacent network prerequisite, which limits the exploitable attacker pool compared to a fully network-routable vulnerability; even a mid-sized municipal IT team in leszno should treat this as a priority patch given the authentication bypass classification and the enormous breadth of affected Windows versions spanning both client and server lines. No EPSS score or CISA KEV listing was provided in the source intelligence, leaving exploitation probability and confirmed in-the-wild activity unquantified - these are missing data points that defenders should monitor as the vulnerability matures. The PR:N and AC:L CVSS metrics indicate that within the adjacent boundary, exploitation is low-complexity and requires no prior credentials, elevating practical risk in environments with untrusted participants such as co-location facilities, guest network segments, or multi-tenant cloud VLANs. The scope-unchanged (S:U) profile and C:N/A:N impact limit the direct consequence to integrity tampering rather than full system compromise, but authentication bypass enabling HTTP traffic manipulation can serve as a pivot point in layered architectures.

An attacker with access to the same network segment as a vulnerable Windows server crafts an HTTP request whose authentication token or header value satisfies the flawed partial string comparison in http.sys while bypassing full-string validation, effectively circumventing access controls without valid credentials. The attacker then leverages the bypass to tamper with HTTP request or response data, potentially injecting unauthorized content or manipulating protocol-level exchanges. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and absence of credential requirements (PR:N) mean a functional exploit would be straightforward to develop for an attacker already positioned on the local network.