CVE-2022-21907: Microsoft Windows HTTP Protocol Stack Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction exploitation and a very high EPSS score make this an urgent patching priority despite the lack of KEV listing.

What it is

CVE-2022-21907 is a critical remote code execution flaw in the Microsoft Windows HTTP Protocol Stack (HTTP.sys). It affects Windows 10, Windows 11, Windows Server, and Windows Server 2019, and can be triggered by sending specially crafted packets to the HTTP stack. The record provides only a one-line description and no technical root cause, so the exact parsing or memory-safety defect is not detailed.

Impact

A successful attacker can execute arbitrary code on the target system, potentially gaining full control of the host. The CVSS vector indicates high confidentiality, integrity, and availability impact.

Attack surface

The flaw is network-reachable (AV:N) with no authentication (PR:N) and no user interaction (UI:N), meaning an unauthenticated remote attacker can send crafted HTTP traffic to a vulnerable service. No specific port or service configuration is given in the record.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit tags, but EPSS is very high at 0.9279 (99.8th percentile), indicating a strong likelihood of exploitation activity. No public exploit details are confirmed by the supplied references.

What to do

• Apply the Microsoft security update for CVE-2022-21907 as soon as possible on all affected Windows 10, Windows 11, Windows Server, and Windows Server 2019 systems.
• Prioritize internet-facing and HTTP.sys-exposed servers for emergency patching.
• If patching cannot be done immediately, restrict network access to HTTP/HTTPS services to trusted sources and monitor for anomalous HTTP traffic.
• Verify patch installation through your vulnerability management or configuration management tooling.

Detection

• Monitor for crashes or unexpected restarts of HTTP.sys or the Windows HTTP service on affected hosts.
• Inspect network traffic for malformed or unusually large HTTP requests targeting HTTP.sys listeners.
• Correlate Windows event logs and crash dumps for HTTP.sys faults with inbound HTTP traffic spikes.
• Use endpoint detection to flag suspicious process creation or code execution originating from the HTTP service context.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.