---
id: "CVE-2026-119946"
page: "https://infrastack.ai/live/CVE-2026-119946"
kind: "vulnerability"
aliases: ["CVE-2026-119946"]
title: "Windows HTTP.sys: unauthorized network attacker can read some information"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows HTTP.sys", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["http-sys", "iis", "infrastructure", "windows"]
not_affected_if: []
published_at: "2026-11-10T19:20:17+00:00"
first_seen_at: "2026-11-10T19:25:04+00:00"
updated_at: "2026-11-10T20:00:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119946", "first_seen_at": "2026-11-10T19:25:04+00:00"}]
exploit_sources: []
---

# Windows HTTP.sys: unauthorized network attacker can read some information

Link for people: https://infrastack.ai/live/CVE-2026-119946 (this .md is for agents)

Windows HTTP.sys, the kernel driver that handles HTTP requests for IIS and other services, has an access control flaw. An unauthenticated attacker over the network can disclose information.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Windows HTTP.sys affected range not listed fixed no fixed version listed

## Timeline

- 2026-11-10T19:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119946

## From the sources

Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_