CVE-2026-49160

This vulnerability is in Windows’ HTTP/2 web handling (HTTP.sys). An attacker can send specially crafted network traffic that forces the system to consume too many resources, which can knock out or seriously slow down the web services running on that machine. Think of it like overwhelming the “front desk” so it can’t handle legitimate visitors.

This matters to you if your business runs Windows 10, Windows 11, or Windows Server (2016/2019/2022/2025) and those systems can be reached over the network with web traffic. The attack does not require a login, and no user interaction is needed. Exposure is primarily a concern when the vulnerable HTTP/2 handling is reachable from an attacker over the network (whether via a public-facing website, reverse proxy path, or any inbound connectivity that reaches the HTTP service).

This is RED because attackers are already exploiting it in real-world attacks, as confirmed by Microsoft’s June 2026 Patch Tuesday release notes. It can be triggered remotely without authentication, so downtime risk is immediate for exposed systems. Patch now to stop attackers from knocking your web services offline.

1. Inventory affected systems: Identify all machines running Windows 10, Windows 11, and Windows Server 2016/2019/2022/2025.
2. Determine current build level: For each server/workstation, record the OS build number so you can compare it to the fixed versions listed below.
3. Confirm whether you expose HTTP services externally: Check which systems have inbound network access that could reach HTTP.sys HTTP/2 (e.g., web servers, internal web apps published through gateways, reverse proxies that terminate HTTP/2, or any open inbound ports that serve web content).
4. Patch to the fixed versions (per OS):
   • Windows 10 → fixed in 10.0.14393.9234 or 10.0.17763.8880 or 10.0.19044.7417 or 10.0.19045.7417
   • Windows 11 → fixed in 10.0.22631.7219 or 10.0.26100.8655 or 10.0.26200.8655 or 10.0.28000.2269
   • Windows Server 2016 → fixed in 10.0.14393.9234
   • Windows Server 2019 → fixed in 10.0.17763.8880
   • Windows Server 2022 → fixed in 10.0.20348.5256
   • Windows Server 2025 → fixed in 10.0.26100.32995
5. Validation after patching: Re-check build numbers post-update to confirm you are on a fixed version; then test the affected web endpoints/services (or any internal HTTP/2 endpoints) for availability.
6. Temporary workaround if patching is delayed: Reduce attacker reachability by blocking inbound access to any public-facing HTTP endpoints until updates are installed, and restrict network access so the vulnerable service is not reachable from untrusted networks.
7. What to monitor: Look for symptoms of denial of service—unexpected service restarts, web/app availability drops, and spikes in network requests—especially on systems hosting web traffic. Keep an eye on Microsoft’s update guidance page for follow-on instructions: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160

Note: No CISA KEV listing was found in the provided sources.

Severity is high with availability impact (denial of service). The weakness is CWE-400 (uncontrolled resource consumption). Mechanism: an unauthorized attacker can send network traffic that abuses HTTP/2 handling in HTTP.sys, causing excessive resource consumption and resulting in service outage or severe slowdown. Preconditions: none reported for authentication; user interaction is none. Exploitation status: exploitation is confirmed in the wild per Microsoft June 2026 Patch Tuesday notes; KEV listing was not found. Exploit maturity: no public exploit code is on record, but real-world use indicates active attacker capability. EPSS was predicted at 48.4% with a rising trend, but real-world exploitation findings outweigh prediction for prioritization. KEV (CISA) means a vulnerability is added to an actively exploited catalog; here it is not listed based on the provided findings. Actor mention in provided sources: “Nightmare Eclipse.”