---
id: "CVE-2015-1635"
kind: "vulnerability"
aliases: ["CVE-2015-1635"]
title: "Microsoft HTTP.sys: Microsoft HTTP.sys Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99999
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft HTTP.sys", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "iis", "infrastructure", "windows", "windows-server"]
not_affected_if: ["no-http-sys-listener"]
published_at: "2015-04-14T20:59:01+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1635", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-1635", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1635", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft HTTP.sys: Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft HTTP.sys, the Windows kernel HTTP stack, contains a flaw that allows remote code execution. CISA lists it as actively exploited in the wild, with an EPSS score of 1.000.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft HTTP.sys affected ? fixed ?

## How to check

Check whether Windows Server or Windows hosts run HTTP.sys listeners (IIS, WinRM, or other HTTP services) and whether the MS15-034 update is installed; exact commands unknown from sources.

## Fix

Apply the Microsoft update for HTTP.sys per vendor instructions (CISA required action); the specific KB number is unknown from sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-1635
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-1635
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-1635

## From the sources

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_