CVE-2021-31166 is a remote code execution vulnerability in Microsoft HTTP Protocol Stack. CISA added it to the Known Exploited Vulnerabilities catalogue on 6 April 2022, which means attackers have used it in real attacks. Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
What the vulnerability means in practice
CVE-2021-31166 is a remote code execution flaw in Microsoft’s HTTP Protocol Stack, so the danger is not just that a service is affected, but that attacker-controlled traffic can reach a kernel-facing web component and turn a parsing weakness into code execution. For readers triaging exposure, the main question is whether systems running http.sys are reachable in a way that makes exploitation practical, especially where HTTP service is exposed to untrusted networks.
Because CISA placed this CVE in the Known Exploited Vulnerabilities catalogue on 6 April 2022, it should be treated as more than a theoretical bug. For authoritative version and patch details, use the CVE Program record and the NIST National Vulnerability Database entry rather than relying on secondary summaries.
Why HTTP stack RCE is dangerous
A remote code execution bug in the HTTP stack is especially serious because it sits close to the network edge and can be triggered before application logic has a chance to inspect or constrain the request. That creates a direct path from malformed input to system compromise, which is why these flaws often become high-priority exploitation targets in active attack campaigns.
The exposure is broader than a single website or application. If the vulnerable HTTP component is used for multiple services, the same flaw can affect anything that depends on that stack for request handling. On internet-facing systems, that makes the issue attractive for opportunistic scanning and for targeted exploitation against high-value infrastructure.
How organisations should assess exposure and recover
Exposure checks should start with asset inventory and internet reachability. Teams need to know which hosts use Microsoft HTTP Protocol Stack, which of those are externally reachable, and whether any service banners, reverse proxies, or load balancers obscure the true dependency. Vendor advisories and the KEV catalogue should then be used to confirm urgency and remediation priority.
If patching is delayed, compensating controls should reduce attack surface rather than simply hoping the flaw is not probed. That usually means limiting exposure of the affected service, narrowing inbound access paths, and monitoring for unexpected HTTP request patterns that may indicate probing or exploitation attempts. The broader lesson is that vulnerable edge services need the same discipline as any other actively exploited internet-facing weakness, especially when they can be reached across shared infrastructure.
Detection and post-exploitation review
After patching, organisations should still review for compromise because exploitation of remote code execution can leave behind follow-on access, dropped tooling, or altered services. Detection should focus on suspicious process creation, unusual service behaviour, unexpected child processes from the affected stack, and any evidence that the host began making outbound connections it normally would not make.
Where exploitation is confirmed or strongly suspected, review adjacent systems for lateral movement opportunities and check whether the affected server exposed credentials, sessions, or service context that could be reused elsewhere. In practice, the remediation question is not only whether the CVE is fixed, but whether the host was already turned into a pivot point before the fix landed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Networks and environments are monitored to find potential cybersecurity events | Internet-exposed HTTP stack exploitation requires continuous monitoring for attack activity and anomalous traffic. |
| Recommendation — Monitor exposed services for unusual request patterns and exploitation indicators. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This flaw requires asset awareness, exposure review, and prioritised vulnerability handling. |
| Recommendation — Scan for vulnerable hosts and prioritise remediation of internet-facing systems. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes ongoing exposure discovery and remediation central to handling this CVE. |
| Recommendation — Continuously identify, rank, and remediate affected systems. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Remote code execution in a protocol stack highlights the need for resilient request handling and defensive architecture. |
| Recommendation — Design network-facing components to limit the blast radius of parsing flaws. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | The vulnerability is dangerous because it enables exploitation of an externally reachable service component. |
| Recommendation — Hunt for exploitation attempts against public-facing HTTP services and block repeat access. | ||