CVE-2026-62750: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-62750 Overview

CVE-2026-62750 is a tampering vulnerability in the Windows HTTP Protocol Stack (HTTP.sys). The flaw stems from a partial string comparison [CWE-187] that allows an unauthenticated attacker on an adjacent network to tamper with HTTP protocol handling. Microsoft published the advisory on 2026-08-11.

The vulnerability affects a wide range of Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires no user interaction and no privileges, but the attacker must be positioned on the same logical network segment as the target.

Critical Impact
An adjacent-network attacker can tamper with HTTP protocol processing on unpatched Windows hosts, undermining integrity controls that rely on strict string matching in HTTP.sys.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62750 published to NVD
2026-08-11 - Microsoft releases security update for CVE-2026-62750
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62750

Vulnerability Analysis

The vulnerability resides in the Windows HTTP Protocol Stack, the kernel-mode driver (HTTP.sys) that processes HTTP and HTTPS traffic for Internet Information Services (IIS), WinRM, WebDAV, and other services that bind to the HTTP Server API. Microsoft classifies the defect as a partial string comparison issue tracked under [CWE-187].

A partial string comparison flaw occurs when code compares only a prefix, suffix, or truncated portion of a string instead of the full value. In the context of HTTP.sys, this weakness enables an attacker to craft HTTP request components (such as headers, URLs, or host values) that pass validation checks while still being routed or interpreted differently by downstream components.

The result is a tampering primitive that undermines the integrity of HTTP request handling. Confidentiality and availability are not directly affected, but integrity is impacted at a high level, allowing manipulation of request routing, access checks, or response content.

Root Cause

The root cause is improper length or boundary handling during string comparison inside HTTP.sys. Instead of matching the full input against the expected value, the routine terminates comparison early. This mismatch between validation logic and downstream interpretation opens the door to protocol-level tampering.

Attack Vector

Exploitation requires network adjacency, such as a shared broadcast domain, a shared Wi-Fi segment, or an attacker foothold on a peer virtual machine. The attacker sends specially crafted HTTP requests to a listening service that uses HTTP.sys. No credentials or user interaction are required. The vulnerability manifests during parsing of the malformed request and can alter how the request is authorized, routed, or logged. See the Microsoft Security Update CVE-2026-62750 advisory for additional technical context.

Detection Methods for CVE-2026-62750

Indicators of Compromise

Anomalous HTTP requests containing unusual header lengths, embedded null bytes, or non-canonical Host values directed at IIS or other HTTP.sys-backed services.
Discrepancies between requests logged by HTTP.sys (%SystemRoot%\System32\LogFiles\HTTPERR) and downstream application logs.
Requests originating from adjacent subnets or link-local addresses targeting internal HTTP endpoints.

Detection Strategies

Enable and centralize IIS and HTTP.sys logging, then alert on requests where header parsing errors or protocol violations spike from a single source.
Deploy network intrusion detection signatures for malformed HTTP requests targeting Windows hosts on internal segments.
Correlate patch state telemetry with observed HTTP traffic to prioritize unpatched, exposed hosts.

Monitoring Recommendations

Monitor east-west HTTP traffic to Windows servers, not only north-south flows, because exploitation requires adjacent-network access.
Track authentication and authorization outcomes on IIS-hosted applications for unexpected successes tied to malformed requests.
Baseline typical HTTP request patterns per service and alert on deviations in header structure or URL canonicalization.

How to Mitigate CVE-2026-62750

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62750 to all affected Windows 10, Windows 11, and Windows Server systems.
Inventory hosts running IIS, WinRM, WebDAV, or any service bound to HTTP.sys and prioritize those exposed to shared network segments.
Restrict adjacent-network exposure by segmenting management and application VLANs from general user networks.

Patch Information

Microsoft released a patch on 2026-08-11 as part of the monthly security update cycle. Consult the Microsoft Security Update CVE-2026-62750 page for build-specific KB article numbers covering Windows 10, Windows 11, and Windows Server 2012 through 2025.

Workarounds

Limit access to HTTP.sys-backed services using host-based firewall rules that restrict inbound traffic to trusted management subnets.
Place a validating reverse proxy or web application firewall in front of IIS to normalize HTTP requests before they reach HTTP.sys.
Disable unused HTTP listeners and services (for example, WebDAV or unused IIS sites) to reduce the attack surface until patches are deployed.

bash

# Example: restrict inbound HTTP/HTTPS on a Windows host to a trusted management subnet
New-NetFirewallRule -DisplayName "Restrict HTTP.sys to Mgmt Subnet" `
  -Direction Inbound -Protocol TCP -LocalPort 80,443 `
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "Block Other HTTP.sys Inbound" `
  -Direction Inbound -Protocol TCP -LocalPort 80,443 `
  -Action Block