Is CVE-2021-31166 (Microsoft HTTP Protocol Stack Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2021-31166 to its Known Exploited Vulnerabilities catalogue on 6 April 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

For a KEV-listed issue like CVE-2021-31166, “exploited in the wild” means the vulnerability is not just theoretical, it has credible evidence of active abuse against real systems. That changes the question from “is this a risk?” to “could this already be present in my environment, and has it been used to gain code execution?”

The practical implication is that exposure is urgent even if you have not observed alerts. The relevant issue is not only whether CISA’s Known Exploited Vulnerabilities Catalog lists it, but whether the affected Microsoft HTTP Protocol Stack is reachable on any host that matters to your business.

Because the flaw sits in http.sys, treat it as an operating-system level exposure rather than a narrow application bug. That means one vulnerable server can become a foothold for broader compromise, especially where the host also carries management access, internal services, or sensitive data.

How to confirm and reduce exposure quickly

Start by identifying Windows systems that expose HTTP services or depend on the Microsoft HTTP Protocol Stack. Inventory is the first control here because a patch cannot protect systems you have not identified, and externally reachable hosts deserve the fastest attention.

Use vendor guidance and the KEV record to confirm remediation steps, then move straight to application of the Microsoft fix or the vendor-approved mitigation path. For CVE-driven response, the National Vulnerability Database and the CVE Program are useful for authoritative record lookup, but the patching decision should follow Microsoft’s advisory for the exact build you operate.

If patching must wait, reduce exposure by removing unnecessary internet reachability, tightening perimeter rules, and placing the service behind only the network paths that genuinely need it. For a remotely exploitable RCE, exposure reduction is not cosmetic, it is a compensating control while you work through remediation.

What to check before and after remediation

When a vulnerability is already known to be exploited, patching alone is not the whole response. Check for suspicious process creation, new services, unexpected web shells, unusual outbound connections, and signs that the affected host was used as a staging point before remediation.

If the server could have been compromised, review adjacent credentials, scheduled tasks, remote management paths, and privileged sessions that were active on that system. A code execution flaw on a server can expose more than the host itself when administrators reused sessions or when the machine had privileged access to internal resources.

After remediation, verify that the vulnerable service is no longer reachable in the same exposure pattern and that the patch actually applied to every in-scope host. Re-scanning and targeted log review matter because exploited vulnerabilities often leave behind persistence or follow-on access even after the original flaw is closed.

Risk and Threat Considerations

Remote code execution in a widely deployed stack creates a direct attacker path from exposure to foothold. Once attackers can execute code on a reachable server, they can pivot to persistence, credential access, or lateral movement if the host has useful trust relationships.

Failure mechanism: The vulnerable http.sys component can be triggered remotely, allowing attacker-controlled input to become code execution on the target system.

Impact: The result can be full host compromise, service disruption, and downstream access to internal systems or data if the server sits inside a trusted network boundary.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Directly governs finding and remediating a KEV-listed exploit path.
Recommendation — Prioritise exposed hosts and verify remediation with rescans.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	CVE exploitation requires timely flaw remediation and verification on affected systems.
	SI-4 — System Monitoring	Exploit-in-the-wild response depends on detecting compromise and suspicious activity.
Recommendation — Apply fixes promptly and confirm they are installed everywhere. Monitor affected hosts for execution, persistence, and lateral movement.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	Supports prioritising and tracking remediation for actively exploited weaknesses.
Recommendation — Track the issue through remediation and validation to closure.

Practitioner Guidance

What to prioritise: Treat every externally reachable affected host as urgent, then rank internal systems by privilege, business criticality, and whether the server brokers access to other services. A low-value lab host is not the same as a production server with management reach or domain-adjacent access.

What to verify: Confirm the patch or mitigation on each host, then verify by rechecking exposure paths and reviewing recent logs for pre-remediation compromise indicators. If you cannot explain what changed at the host and network layers, do not assume the risk is gone.

Practitioner takeaway: For a KEV-listed remote code execution flaw, the decision point is not whether exploitation is possible, but whether any exposed system was still reachable before you contained it and whether it may already have been used.