Loading story…
Microsoft addressed CVE-2026-33096, a denial-of-service vulnerability in the Windows HTTP.sys kernel-mode HTTP protocol stack, through its Security Update Guide. The flaw was included in Microsoft's May 2026 Patch Tuesday release, making it relevant to organizations that expose Windows web services or rely on HTTP.sys-backed components for application delivery.
Public reporting also highlighted the vulnerability's discovery and attribution. Microsoft credited Milad Nasr of Anthropic and researchers from Calif.io working with Claude, while external tracking noted the issue as part of a 16-CVE MDASH cohort and preserved both attribution paths for the same vulnerability. The available references describe the issue as a service-disruption bug rather than a code-execution flaw, underscoring patching urgency for availability-sensitive Windows environments.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Bugflation reference says Microsoft's acknowledgment credited Milad Nasr of Anthropic and researchers from Calif.io working with Claude for discovering CVE-2026-33096. It highlights the shared attribution while counting the CVE only once in tracking.
Bugflation states that CVE-2026-33096, a Windows HTTP.sys denial-of-service vulnerability, was included in Microsoft's May 2026 Patch Tuesday release. The same reference notes Microsoft tracked it as part of a 16-CVE MDASH cohort.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026
Microsoft patched **`CVE-2026-47291`**, a remotely exploitable flaw in **Windows `HTTP.sys`** that can cause denial of service or potentially **kernel-level remote code execution** on systems using the HTTP protocol stack behind IIS and other applications. The bug stems from an **integer overflow** while `HTTP.sys` expands a per-request buffer reference array during **HTTP/1.x header parsing over TLS**; the array's 16-bit capacity can wrap to zero, leading to a large **kernel pool heap buffer overflow** during memory movement operations. Exploitation requires a remote, unauthenticated attacker to send a specially crafted **HTTPS** request with many header lines, placing each header in a separate **TLS application data record** so each becomes a distinct buffer reference. The issue is described as reachable only on the **HTTP/1.x over TLS** path, not the HTTP/2 or HTTP/3 parser paths, and it depends on the target accepting an unusually large request; keeping the **`MaxRequestBytes`** registry setting at or below **65,535 bytes** is cited as a practical mitigation, while applying Microsoft's June 2026 patch is the recommended fix. Detection guidance includes inspecting decrypted HTTPS traffic for excessive HTTP/1.x header lines or, without decryption, looking for sustained connections carrying many small TLS application data records.
Jul 11, 2026
Microsoft released its June Patch Tuesday updates to address more than 200 vulnerabilities across Windows, .NET, Office, Teams, Exchange Server, Azure, Visual Studio Code, and other products, including three publicly disclosed zero-days: `CVE-2026-45586` in the Windows Collaborative Translation Framework (`CTFMON`), `CVE-2026-49160` in `HTTP.sys`, and `CVE-2026-50507` in Windows BitLocker. The update covered a broad range of impact types, including elevation of privilege, spoofing, denial of service, security feature bypass, information disclosure, and remote code execution, with notable high-severity issues such as `CVE-2026-44815`, a DHCP Client Service RCE flaw rated `CVSS 9.8`, and `CVE-2026-47281`, a Visual Studio Code elevation-of-privilege bug rated `CVSS 9.6`. Researchers described the release as part of a wider 2026 "patch tsunami," estimating roughly 198 to 208 Microsoft CVEs in the June cycle and about 571 CVEs overall when Chromium and other third-party issues were included, with 38 rated critical. One of the zero-days, `CVE-2026-49160`, was detailed as an `HTTP/2` and `HTTP/3` header compression flaw that can trigger resource exhaustion through a "compression bomb," and Microsoft added a `MaxHeadersCount` registry mitigation; the bug was reportedly credited to OpenAI Codex, underscoring claims that AI-assisted discovery is accelerating vulnerability reporting and increasing patch-management pressure on enterprises.
Jul 8, 2026