CVE-2015-1635
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Microsoft HTTP.sys Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
- CWE
- CWE-94
Affected products
microsoft: windows 7; microsoft: windows 8; microsoft: windows 8.1; microsoft: windows server 2008; microsoft: windows server 2012
References
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-0… PatchVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-0… PatchVendor Advisory
- http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of… ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/36773/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/36776/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of… ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/36773/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/36776/ ExploitThird Party AdvisoryVDB Entry
- http://www.osvdb.org/120629 Broken Link
- http://www.securityfocus.com/bid/74013 Broken LinkThird Party AdvisoryVDB Entry