{"id":"CVE-2015-1635","kind":"vulnerability","aliases":["CVE-2015-1635"],"related":[],"title":"Microsoft HTTP.sys: Microsoft HTTP.sys Remote Code Execution Vulnerability","description":"HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka \"HTTP.sys Remote Code Execution Vulnerability.\"","summary":"Microsoft HTTP.sys, the Windows kernel HTTP stack, contains a flaw that allows remote code execution. CISA lists it as actively exploited in the wild, with an EPSS score of 1.000.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2022-02-10T00:00:00+00:00","products":[{"name":"Microsoft HTTP.sys","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","iis","infrastructure","windows","windows-server"],"not_affected_if":["no-http-sys-listener"],"how_to_check":"Check whether Windows Server or Windows hosts run HTTP.sys listeners (IIS, WinRM, or other HTTP services) and whether the MS15-034 update is installed; exact commands unknown from sources.","fix":"Apply the Microsoft update for HTTP.sys per vendor instructions (CISA required action); the specific KB number is unknown from sources.","status":"open","published_at":"2015-04-14T20:59:01+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:28:53+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:28:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft update for HTTP.sys per vendor instructions (CISA required action); the specific KB number is unknown from sources.","reach":"network","impact":"high","summary":"Microsoft HTTP.sys, the Windows kernel HTTP stack, contains a flaw that allows remote code execution. CISA lists it as actively exploited in the wild, with an EPSS score of 1.000.","category":"infrastructure","who_cares":["windows","iis","windows-server"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs code on the Windows server over the network.","analyst_note":"Confirm the affected Windows builds, the KB number, and the detection method from the Microsoft security bulletin for CVE-2015-1635 (MS15-034).","how_to_check":"Check whether Windows Server or Windows hosts run HTTP.sys listeners (IIS, WinRM, or other HTTP services) and whether the MS15-034 update is installed; exact commands unknown from sources.","needs_analyst":true,"not_affected_if":["no-http-sys-listener"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000494,"input_tokens":2831,"output_tokens":422,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1635':11A,14A '-2015':10A,13A '1.000':53B '2008':62C '2012':72C '7':58C '8':66C '8.1':68C 'activ':43B 'aka':87C 'allow':35B,76C 'arbitrari':81C 'attack':78C 'cisa':39B 'code':6A,37B,82C,90C 'contain':31B 'craft':84C 'cve':9A,12A 'epss':50B 'execut':7A,38B,80C,91C 'exploit':17B,44B 'flaw':33B 'gold':73C 'http':29B,85C 'http.sys':2A,4A,16A,25B,54C,88C 'ii':18B 'infrastructur':19B 'kernel':28B 'list':40B 'microsoft':1A,3A,15A,24B,56C 'r2':63C,75C 'remot':5A,36B,77C,89C 'request':86C 'score':51B 'server':23B,61C,71C 'sp1':59C,64C 'stack':30B 'via':83C 'vulner':8A,92C 'wild':47B 'window':20B,22B,27B,57C,60C,65C,67C,70C 'windows-serv':21B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-04-14T20:59:01+00:00","kev":{"dateAdded":"2022-02-10","dueDate":"2022-08-10","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-1635","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1635","severity":null,"published_at":"2022-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2015-1635","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-1635","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-1635","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1635","severity":null,"published_at":"2015-04-14T20:59:01+00:00","modified_at":"2026-06-17T00:22:44+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}