CVE-2022-35748: Microsoft HTTP.sys denial of service on Windows Server

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated availability impact with a high EPSS score, though no confirmed exploitation or KEV listing.

What it is

CVE-2022-35748 is a denial of service flaw in HTTP.sys, the kernel-mode HTTP listener used by Windows Server. The record gives only a one-line description and no root-cause detail, so the exact trigger is unknown, but the network-reachable, no-authentication vector makes it a practical availability risk for exposed servers.

Impact

An unauthenticated remote attacker can cause a denial of service, degrading or taking down HTTP-based services on the affected host. The CVSS vector shows availability impact only, with no confidentiality or integrity loss.

Attack surface

Reached over the network via the HTTP.sys listener (CVSS AV:N, PR:N, UI:N), so no credentials or user interaction are required. Any Windows Server host exposing HTTP.sys-based services is potentially in scope.

Exploitation

Not listed in CISA KEV and no public exploit or PoC is referenced; the only references are Microsoft patch advisories. EPSS is high (0.47226, 98.8th percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.

What to do

• Apply the Microsoft security update for CVE-2022-35748 on all affected Windows Server versions as the first action.
• Inventory internet-facing and internal hosts running HTTP.sys-based services (IIS, WinRM over HTTP, WSUS) and prioritize them for patching.
• Restrict network exposure of HTTP/HTTPS listeners to trusted sources where operationally feasible.
• Monitor vendor advisories for updated guidance, since the record lacks root-cause detail needed for targeted workarounds.

Detection

• Monitor Windows event logs and HTTP.sys error events for crashes, resets or service restarts on patched and unpatched servers.
• Alert on unexpected IIS or HTTP.sys worker process terminations and repeated service recovery events.
• Track availability gaps or connection failures on HTTP/HTTPS endpoints that could indicate a denial-of-service attempt.
• Watch for anomalous request patterns or traffic spikes against HTTP.sys listeners from single or distributed sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.