All vulnerabilities
CVE-2021-31166

Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Microsoft HTTP Protocol Stack
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 6 Apr 2022CISA KEV
Exploit odds (EPSS)99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.19041.982Also 10.0.19042.982CVE List
Federal deadline27 Apr 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

  • 10.0.19041.982Windows 10 Version 2004CVE List
  • 10.0.19041.982Windows Server version 2004CVE List
  • 10.0.19042.982Windows 10 Version 20H2CVE List
  • 10.0.19042.982Windows Server version 20H2CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 11 May 2021Exploit code publicMetasploit
  2. 11 May 2021, 19:11 UTCPublishedCVE List
  3. 6 Apr 2022Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Auxiliary moduleWindows IIS HTTP Protocol Stack DOS 11 May 2021Metasploit

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.

Text from CVE List

Affected versions 4

  • Windows 10 Version 2004affected: 10.0.0 before 10.0.19041.982CVE List
  • Windows Server version 2004affected: 10.0.0 before 10.0.19041.982CVE List
  • Windows 10 Version 20H2affected: 10.0.0 before 10.0.19042.982CVE List
  • Windows Server version 20H2affected: 10.0.0 before 10.0.19042.982CVE List

References 3