Is CVE-2015-1635 (Microsoft HTTP.sys Remote Code Execution) being exploited in the wild?

Yes. CISA added CVE-2015-1635 to its Known Exploited Vulnerabilities catalogue on 10 February 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution. Any organisation running the affected product should treat remediation as urgent.

What the Exploitation Signal Means for This CVE

CISA listing CVE-2015-1635 in the Known Exploited Vulnerabilities catalogue means defenders should treat it as more than a theoretical Microsoft HTTP.sys flaw. For a remote code execution issue, the key operational question is not whether exploitation is possible, but whether exposed systems are still reachable and whether compensating controls are already in place.

The practical takeaway is that “in the wild” exploitation changes prioritisation. A vulnerability with active exploitation evidence should move ahead of routine backlog triage, especially on internet-facing Windows systems or hosts that terminate HTTP traffic. CISA Known Exploited Vulnerabilities Catalog is the authoritative source for the exploitation status and the remediation expectation.

How to Confirm Exposure and Scope

Start with asset confirmation: identify which Windows servers still rely on HTTP.sys and whether they are exposed to untrusted networks. Because this is an RCE condition, the question is not only versioning but also whether the vulnerable service path is reachable from the outside or from a compromised internal segment.

Then verify whether the vulnerable hosts are part of high-value paths such as reverse proxies, web front ends, management services, or shared infrastructure. For many organisations, the biggest mistake is assuming that “we do not host a website” means no exposure, when HTTP.sys can still be present in service roles that process HTTP traffic. Use the vendor advisory and the NIST National Vulnerability Database to correlate the CVE record with your inventory and prioritisation workflow.

What Remediation Should Look Like When the Bug Is Actively Exploited

When a vulnerability is known to be exploited, remediation should be treated as an urgent change, not a normal patch cycle item. The immediate goal is to remove the exploit path, then validate that the fix actually reached every affected system and cluster member.

If patching or rebooting must wait, use the vendor’s documented mitigation path and reduce exposure by tightening network reachability, reducing attack surface, and placing the affected service behind stronger ingress controls. For prioritisation, pair the KEV signal with exploitation-likelihood data such as FIRST EPSS only as a triage aid, not as a substitute for the confirmed exploitation evidence already provided by CISA.

Risk and Threat Considerations

Active exploitation means an attacker does not need to discover a new flaw or wait for a novel technique, they can use a known path against unpatched or reachable systems. For a remote code execution issue in a core Windows HTTP component, that can translate quickly into initial access, payload execution, and follow-on movement if the host is externally exposed or weakly segmented.

Failure mechanism: The vulnerable HTTP.sys path can be triggered through network-facing request handling, allowing code execution on the target system before normal application-layer controls have a chance to intervene.

Impact: Successful exploitation can lead to full host compromise, service disruption, credential access on the affected machine, and a broader intrusion path if the server has privileged roles or trusted network reach.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited RCEs require rapid identification, prioritisation and remediation of vulnerable assets.
Recommendation — Prioritise and remediate the affected Windows systems immediately, then verify exposure has been removed.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV-listed exploitation changes how the organisation should rank and act on vulnerability risk.
	PR.PS-02 — Software, Hardware, and Firmware are Updated	The subject turns on prompt patching or mitigation of a known exploited software flaw.
Recommendation — Treat KEV-listed vulnerabilities as urgent risk items in your remediation process. Apply the vendor fix or mitigation as soon as feasible across all exposed systems.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Confirming exposure and tracking remediation for an actively exploited CVE is a core vulnerability-management task.
	SI-2 — Flaw Remediation	A known exploited remote code execution flaw requires prompt flaw remediation and validation.
Recommendation — Scan for vulnerable HTTP.sys hosts and track remediation until every instance is addressed. Remediate the flaw urgently and confirm the corrective action was fully deployed.

Practitioner Guidance

What to prioritise: Triage this CVE as an emergency on any exposed or business-critical Windows server, then verify whether the fix landed everywhere rather than assuming one patched node represents the fleet.

What to verify: Confirm external reachability, inventory completeness, and whether any compensating control actually blocks the vulnerable request path. If you cannot prove that the attack surface is closed, treat the system as still at risk.

What practitioners underestimate: The post-patch question is compromise assessment, not just patch status. A known-exploited RCE deserves checks for suspicious service behaviour, unexpected child processes, and other signs that the system was touched before remediation.

Practitioner takeaway: Once CISA has placed a CVE in KEV, the operational decision shifts from “should we patch this?” to “how fast can we remove exposure and validate that no compromise already occurred?”