Windows HTTP.sys: Information disclosure vulnerability
Summary
Microsoft has published CVE-2026-119946 for the Windows HTTP.sys kernel-mode HTTP listener, which serves IIS and other HTTP-based services. The official record describes improper access control that allows an unauthorized attacker on the network to disclose information. The CWE is CWE-522 (insufficiently protected credentials), so the exact data at risk is unclear. Attack complexity is high and no privileges or user interaction are needed; the CVSS score is 5.9 (Medium), although some sources rate it Important. No exploitation or public proof of concept is known.
Affected
- Windows 10 Version 1607 (before 10.0.14393.9688)
- Windows 10 Version 1809 (before 10.0.17763.9487)
- Windows 10 Version 21H2 (before 10.0.19044.7846)
- Windows 10 Version 22H2 (before 10.0.19045.7846)
- Windows 11 Version 23H2 (before 10.0.22631.7711)
- Windows 11 Version 24H2 (before 10.0.26100.9974)
- Windows 11 Version 25H2 (before 10.0.26200.9974)
- Windows 11 Version 26H1 (before 10.0.28000.3501)
- Windows 11 Version 26H2 (before 10.0.26300.9974)
- Windows Server 2016, including Server Core (before 10.0.14393.9688)
- Windows Server 2019, including Server Core (before 10.0.17763.9487)
- Windows Server 2022 (before 10.0.20348.5870)
Fixed in
- Install the November 2026 Security Update (released 10 Nov 2026).
- Fixed builds are listed in the affected section above, taken from the official CVE record.
- Third-party KB mappings (not confirmed by Microsoft): KB5132061 (24H2), KB5132059 (26H1), KB5131087 (23H2).
Workaround
Unknown. No vendor workaround or mitigation is documented in the sources reviewed.
Exploitation
- Not known to be exploited.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Rapid7 rates it Exploitation Less Likely; SANS ISC lists it as not disclosed.
- No public proof of concept found.
Our recommendation
- Install the November 2026 Security Update on all affected Windows 10, 11 and Server systems, starting with internet-facing or multi-user IIS/HTTP servers.
- Patch HTTP.sys CVE-2026-119992 (elevation of privilege, rated Exploitation More Likely) in the same cycle.
- Windows 10 1607, 1809 and 21H2 are listed as ESU vulnerabilities and may require an ESU subscription.
- Identify systems running HTTP.sys-based services and check whether they are reachable from untrusted networks.
- Verify build numbers and KB numbers against MSRC before rollout.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows HTTP.sys
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-119946 msrc.microsoft.com
- CVE.org record CVE-2026-119946 www.cve.org
- Rapid7: Patch Tuesday November 2026 (EM) www.rapid7.com
- Rapid7: Patch Tuesday November 2026 exploitation outlook www.rapid7.com
- SANS ISC diary isc.sans.edu
- BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
- MSRC Security Update Guide: CVE-2026-119992 msrc.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:14.
Original description (NVD)
Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.