CVE-2021-31166

Exploited in the wild. In CISA KEV since 2022‑04‑06. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile99th100% chance in 30 days CISA KEVListedsince 2022-04-06, due 2022-04-27
Public exploit: 2 sources Fix2 products2 fixed builds listed below

Published 2021-05-11Updated 2025-10-30Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft Windows 10 Version 2004Affected: ≥ 10.0.0, < 10.0.19041.982Upgrade to: 10.0.19041.982Affected: ≥ 10.0.0, < 10.0.19042.982Upgrade to: 10.0.19042.982Stated by: CVE record
Microsoft Windows Server version 2004Affected: ≥ 10.0.0, < 10.0.19041.982Upgrade to: 10.0.19041.982Affected: ≥ 10.0.0, < 10.0.19042.982Upgrade to: 10.0.19042.982Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your affected device is Windows 10 or Windows Server and whether it is updated to at least 10.0.19041.982 or 10.0.19042.982.
Update Windows to reach the fixed version: 10.0.19041.982 (or later) or 10.0.19042.982 (or later), following Microsoft’s update guidance for CVE-2021-31166.
If you cannot patch immediately, isolate the device from the internet and restrict inbound network access to only what your business needs until updates are applied.
After updating, verify the device version/build in your operating system update history reflects the required fixed build.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

0 publishers

Added to CISA KEV catalog
Apr 6, 2022·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

HTTP Protocol Stack Remote Code Execution Vulnerability

In plain language

Written by AI from the record

CVE-2021-31166 is a Windows remote code execution flaw that can let an attacker run code on your machine over the network—if you run Windows 10 or Windows Server, you should treat this as urgent and patch if you’re not on the fixed versions.

CVE-2021-31166 is a Remote Code Execution issue in the Windows HTTP Protocol Stack (CWE-416) that enables an attacker to execute code by sending specially crafted network/HTTP traffic to affected Windows 10 and Windows Server systems; it has confirmed real-world exploitation listed in the CISA KEV.

If you're affected

Full system takeover
Ransomware deployment risk
Service disruption
Data theft

What is it

This is a Windows bug in how the HTTP network feature processes certain requests. Think of it like a security weakness in the “front door mailroom” of your computer: a crafted message can trick the system into running attacker instructions instead of handling the request safely.

Who is affected

This matters if your business uses Windows 10 or Windows Server machines that are reachable over the network. Because this is remote code execution and it’s in the CISA KEV, you should assume attackers may target exposed systems—specifically, it’s a risk when an attacker can reach the affected Windows system with network traffic.

How urgent is it

This is urgent because it has confirmed real-world exploitation (CISA KEV listing) and attackers can leverage it remotely to run code on vulnerable Windows machines. The fixes are available, and delaying patching leaves systems exposed to active attacks.

What to do — in detail

Identify affected machines
- Locate all endpoints running Windows 10 and Windows Server in your environment.
- Confirm the OS build/version for each machine.
Determine whether the machine is fixed
- Microsoft’s fixed builds for CVE-2021-31166 are:
  - Windows 10: fixed in 10.0.19041.982 and 10.0.19042.982
  - Windows Server: fixed in 10.0.19041.982 and 10.0.19042.982
- If your machine is below these builds, it is considered vulnerable based on the vendor’s fix information.
Apply Microsoft’s vendor update
- Follow Microsoft’s update guidance for CVE-2021-31166.
- Install the relevant updates and reboot as required.
Temporary workaround if patching is delayed
- Reduce exposure immediately:
  - Isolate the affected host from the internet where possible.
  - Restrict inbound network traffic to only necessary business services.
- This does not replace patching, but it can reduce the chance of an attacker reaching the system.
Verify after remediation
- Re-check the OS build/version/build number and confirm it meets or exceeds the fixed versions.
- Confirm Windows Update history shows the CVE-related update(s) installed.
What to monitor
- Look for signs of compromise typical for remote-code-execution incidents (e.g., unusual process creation, unexpected network connections, or new scheduled tasks). Specific monitoring details depend on your tooling.

CISA due date

CISA listed remediation due date as 2022-04-27. If you haven’t patched since then, treat this as overdue.

Technical context

Severity is extremely high: it’s a Remote Code Execution vulnerability (CWE-416) affecting the Windows HTTP Protocol Stack. The attack trigger is remote network interaction via specially crafted HTTP-related requests/traffic that can cause execution of attacker-controlled code on the target. This CVE is listed in CISA KEV as exploited in the wild (added 2022-04-06), so real-world attack activity is confirmed rather than theoretical. Public PoC exists (weaponization), and exploitation likelihood predictions are very high; however, the KEV status is the controlling factor for urgency. The vendor-provided fixed builds are 10.0.19041.982 and 10.0.19042.982 for both Windows 10 and Windows Server. Exploit maturity is high enough for reliable public proof-of-concept availability and confirmed real-world use.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2022-04-06.

US federal agencies must remediate by 2022-04-27.

Apply updates per vendor instructions.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

100% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 127 days before any public exploit.

2026-06-25OpenVAS check added
2026-03-06Public exploit / PoCsource: github-poc
2025-10-30Patch availablerecord updated
2022-04-06Added to CISA KEV
2021-05-11Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka microsoft, microsoft corporation
- Windows 10 Version 2004OSOn-premOperating Systems / windows
- Windows Server 2004 (Server Core Installation)OSOperating Systems / windows

And 10 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable