CVE-2015-1635 is a remote code execution vulnerability in Microsoft HTTP.sys. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 February 2022, which means attackers have used it in real attacks. Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
What this vulnerability means in practice
Remote code execution in HTTP.sys is dangerous because it can let an attacker run code in the context of a core Windows networking component. For internet-facing systems, that can turn a single reachable host into an entry point for broader compromise, especially when the service is exposed through web applications or reverse proxies.
The issue is not just that code can execute, but that the affected component sits close to the network boundary and often processes untrusted HTTP traffic. That makes exposure assessment more important than the CVE title alone: asset inventory, public exposure, and vendor advisory review should all be part of the initial triage.
How organisations assess exposure
Start by identifying every Windows system that runs HTTP.sys or that depends on it through IIS or another HTTP-based service. Then check whether any of those systems are reachable from the internet, because reachable endpoints are the most urgent candidates for exploitation review and patch prioritisation.
For authoritative version and remediation details, use the vendor advisory alongside the CVE Program record and the NIST National Vulnerability Database. The vulnerability should also be handled through a vulnerability management guide mindset, meaning exposure, exploitability, and remediation urgency are assessed together rather than in isolation.
Why exploitation can have outsized impact
HTTP.sys is a foundational Windows HTTP stack component, so compromise can affect more than a single application. Attackers often favour this kind of bug because it combines remote reachability with high trust in the underlying service layer, which can make exploitation efficient and operationally valuable.
When exploitation succeeds, the immediate impact can extend beyond initial execution to lateral movement, credential harvesting, or service disruption. A useful comparison point is the ASP.NET machine key attacks case study, which shows how a web-facing Windows component can become an execution path when trust in the platform is abused.
Detection, recovery, and post-patch review
Detection should focus on signs that do not belong on a normal HTTP stack, such as unexpected child processes, unusual service behaviour, or web-tier events that correlate with process creation. If the system was exposed before patching, assume the possibility of post-exploitation activity and review logs and endpoint telemetry accordingly.
After remediation, validate not only that the patch is applied but also that no persistence, added accounts, altered web content, or suspicious scheduled activity remains. Where the affected host supported a sensitive service, review adjacent systems too, because attackers often use a vulnerable perimeter system as a launch point rather than an end state.
Risk and Threat Considerations
Internet-facing HTTP.sys exposure creates a material risk because a successful exploit can move from remote request handling to arbitrary code execution on a trusted Windows component. That makes the issue especially concerning on servers that host public web services or sit near sensitive internal networks.
Failure mechanism: An attacker sends crafted HTTP traffic that triggers the vulnerability in the HTTP stack, then uses the resulting execution to establish control, pivot, or stage follow-on activity.
Impact: The compromise can lead to full host takeover, service disruption, lateral movement, and the need for credential and session review across connected systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | HTTP.sys RCE requires timely flaw remediation and patch verification. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on identifying affected assets and public reachability. | |
| AU-6 — Audit Review, Analysis, and Reporting | Post-exploitation review relies on correlating logs and suspicious activity after compromise. | |
| Recommendation — Prioritise SI-2 to track, test, and deploy remediation for the vulnerable host. Use RA-5 to continuously identify exposed systems that may still be vulnerable. Apply AU-6 to review logs for exploitation and persistence indicators after patching. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The subject is an actively exploited CVE requiring prioritised vulnerability management. |
| CIS-13 — Network Monitoring and Defense | Detection of exploitation depends on monitoring suspicious network and host behaviour. | |
| Recommendation — Use CIS-7 to prioritise, patch, and verify remediation for KEV-listed exposure. Use CIS-13 to monitor for anomalous traffic and exploitation artefacts around the affected service. | ||
Practitioner Guidance
What to watch for: Treat any HTTP.sys exposure on internet-reachable Windows hosts as high priority until patch status and exposure scope are confirmed. If patching must wait, reduce reachable surface area first and use compensating controls to limit who can reach the service.
Practitioner takeaway: For this kind of CVE, remediation is not complete until you have both patched the host and reviewed it for evidence of exploitation.