Vulnerability record · CVE-2015-1635 · published 14 April 2015
CVE-2015-1635: Microsoft HTTP.sys remote code execution via crafted HTTP requests
Microsoft · Windows 7
HTTP.sys in multiple Windows versions fails to properly handle crafted HTTP requests, allowing remote code execution. The flaw is reachable over the network without authentication or user interaction, making any exposed IIS or HTTP.sys listener a direct target. It is a critical, actively exploited issue with a vendor patch available.
Description
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8, KEV listing, and near-certain EPSS probability.
What it is
HTTP.sys in multiple Windows versions fails to properly handle crafted HTTP requests, allowing remote code execution. The flaw is reachable over the network without authentication or user interaction, making any exposed IIS or HTTP.sys listener a direct target. It is a critical, actively exploited issue with a vendor patch available.
Impact
An unauthenticated remote attacker can execute arbitrary code with the privileges of the HTTP.sys service, typically SYSTEM, leading to full host compromise.
Attack surface
Reached over the network via HTTP requests to a listening HTTP.sys-based service such as IIS. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Listed in CISA KEV since 2022-02-10 with a 2022-08-10 remediation due date, and EPSS probability is 0.99999 (99.998th percentile). Public exploit code is referenced on Exploit-DB and Packet Storm.
What to do
- Apply Microsoft security update MS15-034 to all affected Windows systems.
- Disable or restrict HTTP.sys-based services (for example IIS) that are not required.
- Block or filter crafted Range header requests at the perimeter until patching is complete.
- Retire or isolate unsupported Windows 7, Windows 8, Windows 8.1, Server 2008 R2, and Server 2012 systems.
- Verify patch status across all internet-facing and internal HTTP listeners.
Detection
- Monitor HTTP.sys and IIS logs for malformed or oversized Range headers.
- Alert on unexpected SYSTEM-level process creation or crashes in w3wp.exe or HTTP.sys.
- Use IDS/IPS signatures for known CVE-2015-1635 exploit patterns.
- Audit hosts for missing MS15-034 patches and exposed HTTP services.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2015-1635 to the Known Exploited Vulnerabilities catalog on 10 February 2022 as "Microsoft HTTP.sys Remote Code Execution Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 10 August 2022.
Affected products
5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-1635 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-1635), CISA KEV, FIRST EPSS (scores of 2026-09-16). This page is refreshed as NVD updates the record.
