Microsoft Windows HTTP.sys Improper Access Control Vulnerability Allowing Privilege Elevation

A vulnerability in Windows HTTP.sys has been identified, allowing an authorized attacker to elevate privileges over a network. This issue arises from improper access control in the HTTP.sys component.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain SYSTEM privileges.

Remediation

Users can apply the security update for this vulnerability, which is available as part of the January 2026 Monthly Rollup for various Windows Server and Windows 10 versions. Instructions for downloading this update can be found in the Microsoft Update Catalog.