CVE-2026-20929
📋 TL;DR
This vulnerability in Windows HTTP.sys allows authenticated attackers to escalate privileges over a network connection. It affects Windows systems running vulnerable versions of the HTTP.sys driver. Attackers could gain elevated system privileges from a lower-privileged authenticated position.
💻 Affected Systems
- Windows HTTP.sys driver
📦 What is this software?
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 23h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling complete control over the affected Windows server, data exfiltration, and lateral movement across the network.
Likely Case
Privilege escalation to SYSTEM or administrator level, allowing installation of malware, credential theft, and persistence mechanisms on the compromised system.
If Mitigated
Limited impact with proper network segmentation and least privilege access controls, potentially containing the attack to a single system segment.
🎯 Exploit Status
Requires authenticated access and network connectivity to vulnerable HTTP.sys service. Exploitation details not publicly available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20929
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates via Windows Update. 2. For enterprise environments, deploy patches through WSUS or SCCM. 3. Restart affected systems to complete patch installation.
🔧 Temporary Workarounds
Disable HTTP.sys if not required
windowsStop and disable the HTTP service if not needed for system functionality
sc stop http
sc config http start= disabled
Network segmentation and firewall rules
allRestrict network access to HTTP.sys ports (typically 80/443) to only trusted sources
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems running HTTP.sys
- Enforce least privilege access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Windows Update history for missing security patches related to HTTP.sys or run: systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify patch installation via: wmic qfe list | findstr KB[number] (replace with actual KB from Microsoft advisory)📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4688 (process creation) showing unexpected privilege escalation
- HTTP.sys error logs showing access violations
- Event ID 4624 (logon) followed by privilege escalation patterns
Network Indicators:
- Unusual HTTP traffic patterns to HTTP.sys ports from authenticated users
- Network connections followed by privilege escalation activities
SIEM Query:
source="windows_security" event_id=4688 AND (process_name="*http*" OR parent_process_name="*http*") AND new_integrity_level="System"