CVE-2026-20929: Windows HTTP.sys Privilege Escalation Flaw

CVE-2026-20929 Overview

CVE-2026-20929 is an improper access control vulnerability in Windows HTTP.sys that allows an authorized attacker to elevate privileges over a network. HTTP.sys is a kernel-mode driver that processes HTTP requests in Windows and is used by IIS, WinRM, and other Windows services. This vulnerability enables authenticated attackers to escalate their privileges by exploiting flaws in how HTTP.sys handles access control decisions.

Critical Impact

Authenticated attackers can exploit improper access control in the Windows HTTP.sys kernel driver to elevate privileges, potentially gaining SYSTEM-level access to affected Windows systems over a network connection.

Affected Products

• Windows HTTP.sys kernel driver
• Windows Server systems running HTTP.sys-based services
• Windows systems with IIS or WinRM enabled

Discovery Timeline

• 2026-01-13 - CVE CVE-2026-20929 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-20929

Vulnerability Analysis

This vulnerability stems from CWE-284 (Improper Access Control) in the Windows HTTP.sys kernel-mode driver. HTTP.sys is responsible for handling HTTP protocol parsing and processing at the kernel level, making it a critical component for web services and remote management interfaces in Windows environments.

The improper access control allows an authenticated attacker with low privileges to bypass authorization mechanisms and escalate to higher privilege levels. Since the vulnerability exists in a kernel-mode driver, successful exploitation can lead to complete system compromise. The attack requires network access and valid credentials, but the attack complexity is high, suggesting specific conditions must be met for successful exploitation.

The potential impact includes unauthorized access to sensitive data, the ability to modify system configurations, and disruption of services. Organizations running internet-facing IIS servers or systems with WinRM enabled should prioritize remediation.

Root Cause

The root cause is classified as CWE-284: Improper Access Control. The HTTP.sys driver fails to properly validate authorization before permitting certain privileged operations. This allows authenticated users to perform actions beyond their intended privilege level through specially crafted HTTP requests processed by the kernel driver.

Attack Vector

The attack is conducted over a network connection and requires the attacker to have valid credentials (low privilege required). No user interaction is necessary for exploitation. The attacker sends specially crafted HTTP requests to a Windows system running HTTP.sys, exploiting the improper access control to escalate privileges.

The exploitation flow involves establishing an authenticated session with the target system, sending malformed or specially crafted HTTP requests designed to bypass access control checks, and leveraging the kernel-mode execution context of HTTP.sys to gain elevated privileges.

Detection Methods for CVE-2026-20929

Indicators of Compromise

• Unusual HTTP traffic patterns or malformed HTTP requests targeting Windows services
• Unexpected privilege escalation events from low-privilege accounts
• Anomalous kernel-mode activity associated with http.sys driver
• Authentication events followed by unauthorized access to privileged resources

Detection Strategies

• Monitor Windows Security Event Logs for privilege escalation events (Event ID 4672, 4673)
• Implement network-based detection for anomalous HTTP request patterns to Windows services
• Deploy endpoint detection solutions to identify suspicious kernel-mode driver behavior
• Enable HTTP.sys logging and audit for unusual request patterns

Monitoring Recommendations

• Configure SentinelOne to monitor for suspicious http.sys driver activity and kernel-mode exploits
• Enable enhanced auditing on systems running IIS or WinRM services
• Implement network segmentation to limit exposure of HTTP.sys-based services
• Monitor for lateral movement following successful authentication events

How to Mitigate CVE-2026-20929

Immediate Actions Required

• Apply the latest Microsoft security updates from the January 2026 Patch Tuesday release
• Restrict network access to HTTP.sys-based services using firewall rules
• Review and minimize the number of authenticated users with network access to affected systems
• Enable advanced threat protection on endpoint security solutions

Patch Information

Microsoft has released security updates to address this vulnerability. Organizations should consult the Microsoft Security Update Guide for specific patch details and affected product versions. Apply all relevant updates through Windows Update, WSUS, or your organization's patch management solution.

Workarounds

• Restrict network access to HTTP.sys-based services to trusted IP ranges only
• Disable unnecessary HTTP.sys-dependent services such as IIS or WinRM where not required
• Implement network segmentation to isolate systems running vulnerable services
• Apply principle of least privilege to user accounts with network access to affected systems

# Restrict access to WinRM service to specific IP ranges
netsh http add iplisten ipaddress=<trusted_ip>

# Verify HTTP.sys URL reservations and remove unnecessary entries
netsh http show urlacl

# Enable HTTP.sys logging for audit purposes
netsh http add accesslog directory=C:\Windows\System32\LogFiles\HTTP