Microsoft’s security team has posted a new advisory for a high-severity elevation-of-privilege flaw in the Windows HTTP.sys driver. The vulnerability, tracked as CVE-2026-20929, could let an attacker with local access—or potentially over a network—steal SYSTEM-level privileges on an unpatched machine. While officials are holding back technical details for now, the mere existence of this entry in the Security Update Guide is a signal: patches are coming, and preparation should begin immediately.

What the Advisory Actually Says

The official record at the Microsoft Security Response Center (MSRC) is brief. It confirms that CVE-2026-20929 affects HTTP.sys, the kernel-mode component that handles HTTP protocol traffic for Internet Information Services (IIS), Windows HTTP Server API, and other inbox services. The impact is classified as elevation of privilege—meaning an attacker who successfully exploits the bug can run code at the highest trust level on the system, effectively taking complete control.

No exploit code, proof of concept, or detailed root cause analysis has been made public. Microsoft often withholds in-depth information for kernel or privileged-component vulnerabilities while it stages fixes. The disclosure posture is typical: the vendor acknowledges the issue with just enough information to prompt action, but not enough to help adversaries craft attacks before patches are deployed.

Administrators should treat this advisory as authoritative. Once the update packages are finalized, the MSRC entry will map each affected Windows build to a specific KB number—the definitive source for remediation.

Who’s at Risk? Breaking Down the Impact

HTTP.sys is deeply embedded in the Windows ecosystem. It’s not just web servers that are exposed.

  • Enterprise servers and cloud workloads: Any machine running IIS, hosting ASP.NET applications, or using the HTTP Server API (like many WCF services) relies on HTTP.sys. These are prime targets. A local privilege escalation can be the final step in a multi-stage attack—turning a low-privileged foothold into full domain compromise.
  • Workstations and developer machines: If you’re using IIS Express, SQL Server Reporting Services, or any tool that binds to an HTTP listener, you’re using HTTP.sys. While less likely to be directly targeted, a compromised dev box can become a launchpad for lateral movement.
  • Home users: The average PC with default settings doesn’t expose HTTP.sys to the internet. But if you’ve installed a web server, a media server with a web interface, or a game server that creates an HTTP listener, the risk grows. The more typical worry is malware that delivers a local exploit after gaining initial access through a phishing email or browser download.

Because HTTP.sys runs in kernel mode, a successful exploit grants the attacker the same privileges as the operating system core. They could install persistent backdoors, disable security software, siphon credentials, or tamper with system processes—all without leaving obvious traces in user-mode logs.

A Troubled Past: Why HTTP.sys Flaws Demand Urgency

This isn’t the first time HTTP.sys has made headlines. The component has a history of critical vulnerabilities that forced rapid, widespread patching.

  • MS15-034 (CVE-2015-1635): A remote code execution bug that could be triggered with a simple crafted HTTP request, affecting every supported Windows Server release. It was so severe that many feared a worm similar to Code Red or SQL Slammer.
  • CVE-2021-31166: Another HTTP.sys remote code execution flaw, patched in May 2021, that allowed unauthenticated attackers to send a malicious packet and take over a server.
  • Multiple denial-of-service and information disclosure bugs have peppered the monthly Patch Tuesday cycles over the years, each reinforcing the lesson that this kernel driver’s large attack surface can yield devastating results.

Each incident has followed a similar pattern: a patch is released, reverse engineers quickly produce exploit code, and within days scanning tools appear. The window between patch availability and active exploitation has shrunk to mere hours for well-understood vulnerability classes. For CVE-2026-20929, the absence of public details doesn’t mean attackers aren’t already analyzing the update in private.

Your Immediate Action Plan

Waiting is not a strategy. While the exact KB articles aren’t published yet, defensive steps taken now can dramatically reduce your exposure.

1. Inventory Your HTTP.sys Footprint

Identify every system that might be running HTTP.sys. This includes:
- All IIS web servers (public-facing and internal)
- Applications using the HTTP Server API (netsh http show servicestate can reveal registered listeners)
- Windows Admin Center hosts, Exchange servers, SharePoint, and other services that expose HTTP endpoints

2. Crank Up Monitoring and Logging

  • Enable detailed IIS logging and watch for malformed or unusually long requests, especially those that trigger 500 errors or server crashes.
  • Hunt for http.sys or related kernel-mode process crashes in the System event log (Event IDs 1001, 1005).
  • Deploy EDR detections for suspicious SYSTEM-level child processes spawning from IIS worker processes or services associated with HTTP listeners.

3. Harden the Attack Surface

  • Block all unnecessary inbound HTTP/HTTPS traffic at your firewall. If a server does not need to accept connections from the internet, make sure network rules enforce that.
  • Disable HTTP.sys features you don’t use—but only if Microsoft provides documented registry keys or Feature on Demand toggles for this specific CVE. Never apply community-sourced workarounds without validation; they often break functionality.
  • For IIS hosts, remove unused modules and request filtering that could expand the parsing surface.

4. Prepare Your Patch Pipeline

  • Bookmark the MSRC advisory page and check it daily. As soon as the KB mappings appear, import them into your software distribution tool (SCCM, WSUS, Intune).
  • Assemble a pilot group of representative servers—a test IIS host, an admin workstation, and a box running any custom HTTP APIs—to validate the update before broad rollout.
  • Plan an accelerated deployment schedule: start with internet-facing hosts, then internal critical servers, and finally general workstations. Aim for completion within 72 hours of release if possible.

5. Apply Temporary Compensating Controls

If a patch delay is unavoidable:
- Isolate vulnerable servers by moving them to restricted network segments where only trusted management traffic can reach them.
- Consider disabling the HTTP service entirely on machines that don’t need it—Stop-Service -Name "HTTP" and set it to Disabled after verifying no dependent services will break.
- Tighten account privileges: review service accounts and remove any that run with elevated rights unnecessarily. Implement application allowlisting to prevent unknown executables from running.

What Not to Do

  • Don’t ignore local-only exploit assumptions. Many kernel privilege escalations start from a local context, but an accompanying remote access vector (like an authentication bypass) can change the game. Assume the worst until proven otherwise.
  • Don’t assume one KB covers all. Microsoft often ships different updates for each Windows version and servicing channel. Always cross-reference the security update guide with your specific OS builds.
  • Don’t apply unofficial fixes. Third-party mitigations without verification can corrupt system files and prevent future updates from installing correctly.

Looking Ahead: The Patch Cycle Begins

Microsoft will most likely include the fix for CVE-2026-20929 in an upcoming monthly security release, though critical severity could trigger an out-of-band update. Once the patch lands, expect security researchers to start reverse-engineering the binary diff within 24 hours. Exploit code typically follows within days—turning a theoretical risk into an active threat.

The timeline is unforgiving, but the playbook is clear. By inventorying your HTTP.sys usage, layering defenses, and streamlining patch distribution now, you change the race from a frantic scramble to a measured response. The MSRC advisory is your early warning system; treat it accordingly.