CVE Database · CVE-2015-1635
CVSS v3.1
9.8
EPSS
100.00%
Published
Apr 14, 2015
Modified
Apr 22, 2026
CISA Known Exploited Vulnerability
Added: 2022-02-10 · Due: 2022-08-10
Apply updates per vendor instructions.
Public PoC / Exploit (12)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses (CWE)
Affected Products (7)
References (15)