Microsoft HTTP.sys Remote Code Execution Vulnerability (CVE-2015-1635)

What is affected, what to do

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Windows Server 2008 eq r2..r2
• Microsoft Windows Server 2012 eq r2..r2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Apply the security update: Microsoft shipped the fix in 2015 as bulletin MS15-034 (KB3042553). Confirm the patch level against the vendor advisory. Any later cumulative or rollup update already contains the fix. Verify with Get-HotFix -Id KB3042553 or through WSUS/SCCM compliance reports.
   • Inventory every HTTP.sys listener, not just IIS: This covers Windows 7, 8, 8.1, Server 2008 R2 SP1, 2012 and 2012 R2. It includes WinRM (TCP 5985/5986), SSRS, WSUS, ADFS/WAP, Exchange front ends, Print over HTTP and third-party apps built on http.sys. List active bindings with netsh http show servicestate.
   • Isolate internet-facing unpatched hosts immediately, or place them behind a reverse proxy or WAF that normalises request headers. Block direct TCP 80/443 to the host.
   • Interim workaround if you cannot patch: Disable the IIS kernel cache, either in IIS Manager → Output Caching → untick "Enable kernel cache" or via appcmd set config /section:system.webServer/caching /enableKernelCache:false. This reduces exposure but may cost some performance.
   • Flag lifecycle risk: All affected OS versions are end-of-life. Tag hosts without ESU coverage as high-risk assets and record the migration plan in your risk treatment register (NIS2 Art. 21).
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Allow WinRM (5985/5986) and admin HTTP services only from dedicated admin networks (PAW or jump-host VLAN). Permit inbound HTTP/HTTPS to legacy servers solely via a reverse proxy.
   • WAF/reverse-proxy rule: Drop requests whose Range header matches bytes=\d+-\d{11,} or contains 18446744073709551615. Alternatively, strip Range entirely for static content.
   • IPS signatures: Enable the public Snort/Suricata rules for MS15-034 (ET and Talos rulesets, keyword "MS15-034" or "HTTP.sys Range"). Set them to blocking mode on legacy segments.
   • TLS termination upstream: Inspection only works if HTTPS is terminated before the IIS host. Otherwise the IPS never sees the Range header.
   • Configuration hardening: Remove unneeded HTTP.sys URL reservations with netsh http delete urlacl. Uninstall unused roles such as WebDAV and Print over HTTP.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata): Look for HTTP requests carrying Range: bytes= with an upper bound of 2^32 or more. Suricata: content:"Range|3a| bytes="; http_header; pcre:"/bytes=\d+-\d{11,}/H";. In Zeek, enable header logging and filter for 18446744073709551615.
   • Windows System log: Watch for unexpected crashes on IIS hosts, which are the typical symptom of exploit attempts (BSOD/DoS). Relevant events are System Event ID 1001 (BugCheck), 41 (Kernel-Power) and 6008 (unexpected shutdown). KQL: Event | where EventLog=="System" and EventID in (41,1001,6008) | join kind=inner (IISHosts) on Computer.
   • HTTPERR/IIS logs: Review %SystemRoot%\System32\LogFiles\HTTPERR for bursts of Connection_Dropped, Request_Cancelled or 416 responses, grouped by source IP. W3C logs do not record the Range header by default, so add it as a custom logging field.
   • Scanner patterns: Bursts of short GET/HEAD requests to /, /iisstart.htm or /welcome.png from a single source are characteristic of MS15-034 scanners. Sigma shape: logsource: webserver, cs-method in (GET, HEAD), cs-uri-stem: /welcome.png, aggregated as count() by c-ip > 20 in 5m.
   • EDR: After any crash, review process activity on the host. Treat child processes of w3wp.exe such as cmd.exe, powershell.exe or rundll32.exe as indicators of compromise.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Windows 7
• Microsoft Microsoft Windows 8 Professional Edition
• Microsoft Microsoft Windows 8.1
• Microsoft Microsoft Windows Server 2008
• Microsoft Microsoft Windows Server 2012

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

References & sources

• docs.microsoft.comMS15-034Vendor advisory, x_refsource_MS, Patch, Vendor advisory
• exploit-db.com36773Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• osvdb.org120629Vulnerability database, x_refsource_OSVDB, Broken link
• securitytracker.com1032109Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• securityfocus.com74013Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• exploit-db.com36776Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635government-resource, US government resource