CVE-2022-21907
published 2022-01-11CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability
PriorityP193critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
92.79%
99.8th percentile
HTTP Protocol Stack Remote Code Execution Vulnerability
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1466 | 10.0.19042.1466 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1466 | 10.0.19043.1466 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.1466 | 10.0.19044.1466 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.434 | 10.0.22000.434 |
| microsoft | windows_server | — | — |
| microsoft | windows_server | — | — |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.469 | 10.0.20348.469 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19042.1466 | 10.0.19042.1466 |
| msrc | windows_10_version_1809_for_32-bit_systems | — | — |
| msrc | windows_10_version_1809_for_arm64-based_systems | — | — |
| msrc | windows_10_version_1809_for_x64-based_systems | — | — |
| msrc | windows_10_version_20h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_20h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_21h1_for_32-bit_systems | — | — |
| msrc | windows_10_version_21h1_for_arm64-based_systems | — | — |
| msrc | windows_10_version_21h1_for_x64-based_systems | — | — |
| msrc | windows_10_version_21h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_21h2_for_arm64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerability is triggered in http!UlFastSendHttpResponse() when a specific code path is reached that skips MDL initialization at Tracker offset 0x80, resulting in an invalid call to nt!MmUnmapLockedPages(). Monitor for kernel crashes (BSODs) originating from nt!MmUnmapLockedPages() with an http.sys stack frame as a sign of exploitation attempts. ↗
- →The vulnerable code path requires Tracker->member_0x50 (offset 0x50 in the Tracker structure) to be non-zero and the MDL at Tracker offset 0x80 to be uninitialized. A PoC that crafts HTTP requests to reach this code path can trigger a crash via an invalid MmUnmapLockedPages() call. Kernel debugger breakpoints on nt!MmUnmapLockedPages with invalid BaseAddress arguments can confirm exploitation. ↗
- →IIS is not enabled by default on Windows 10, significantly reducing the attack surface on client systems. Focus detection and patching efforts on Windows Server 2019 and Server 2022 systems running IIS. ↗
- →The patched http.sys version is 10.0.20348.469. Systems running http.sys versions prior to this on Server 2022 are vulnerable. Use file version checks for http.sys as a detection/compliance indicator. ↗
- ·Windows 10 shares the same vulnerable code path in http.sys, but IIS is not enabled by default, substantially reducing exploitability on client systems. ↗
- ·Windows clients can also run http.sys independently of IIS, meaning all affected Windows versions (not just servers) should be considered in scope for patching. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cgqq-62rg-6vmf: HTTP Protocol Stack Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12
CVE-2022-21907 [CRITICAL] GHSA-cgqq-62rg-6vmf: HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability.
VulnCheck
HTTP Protocol Stack Remote Code Execution Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-21907 [CRITICAL] HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://go.catonetworks.com/rs/245-RJK-441/images/CATO-NETWORKS-THREAT-REPORT2024.pdf
Exploit PoC: https://vulncheck.com/xdb/1306e5fc35fb; https://vulncheck.com/xdb/f31e1149e743; https://vulncheck.com/xdb/837d27449c0a; https://vulncheck.com/xdb/8444bab2f56f; https://vulncheck.com/xdb/86fb978ad867
Microsoft
HTTP Protocol Stack Remote Code Execution Vulnerability
vendor_msrc·2022-01-11·CVSS 9.8
CVE-2022-21907 [CRITICAL] HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
In most situations, an unauthenticated attacker could send a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets.
Is this wormable?
Yes. Microsoft recommends prioritizing the patching of affected servers.
FAQ: Windows 10, Version 1909 is not in the Security Updates table. Is it affected by this vulnerability?
No, the vulnerable code does not exist in Windows 10, version 1909. It is not affected by this vulnerability.
Is the EnableTrailerSupport registry key present in any other platform than Windows Server 2019 and Windows 10, version 1809?
No, the registry key is only present in Windows Server 2019 and Windows 10, versio
Suricata
ET EXPLOIT Windows HTTP Protocol Stack UAF/RCE (CVE-2021-31166), http.sys DOS (CVE-2022-21907) Inbound
suricata·2021-05-17·CVSS 9.8
CVE-2021-31166 [CRITICAL] ET EXPLOIT Windows HTTP Protocol Stack UAF/RCE (CVE-2021-31166), http.sys DOS (CVE-2022-21907) Inbound
ET EXPLOIT Windows HTTP Protocol Stack UAF/RCE (CVE-2021-31166), http.sys DOS (CVE-2022-21907) Inbound
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Windows HTTP Protocol Stack UAF/RCE (CVE-2021-31166), http.sys DOS (CVE-2022-21907) Inbound"; flow:established,to_server; http.accept_enc; content:",|20|,"; fast_pattern; reference:url,github.com/0vercl0k/CVE-2021-31166; reference:cve,2021-31166; classtype:attempted-admin; sid:2032962; rev:1; metadata:attack_target Server, created_at 2021_05_17, cve CVE_2021_31166, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2021_05_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Publ
Fortinet
WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East | FortiGuard Labs
blogs_fortinet·2023-05-22
WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
WINTAPIX: A New Kernel Driver Targeting Countries in The Middle East
By Geri Revay and Hossein Jazi | May 22, 2023
Affected platforms: Windows
Impacted parties: Windows Users
Impact: Allows remote code execution and persistent access to the host (backdoor) and the rest of the network (proxy)
Severity level: Medium
At Fortinet, we monitor suspicious executables that make use of open-source tools and frameworks. One of the things that we keep an eye out for is tools that use the Donut project. Donut is a position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters. During our daily threat-hunting process in early February, we encountered a kernel driver that used the Donut tool an
Fortinet
Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
blogs_fortinet·2022-09-30·CVSS 6.6
CVE-2022-41040 [MEDIUM] Microsoft Exchange 0-Day Vulnerability Updates | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Microsoft Exchange 0-Day Vulnerability Updates
By James Slaughter | September 30, 2022
On 28th September, 2022, the cybersecurity company GTSC released a blog detailing an exploit attempt on a system they were monitoring. After analysis, they were able to locate and submit two bugs to Microsoft via the Zero Day Initiative (ZDI-CAN-18333 (CVSS 8.8) and ZDI-CAN-18802 (CVSS 6.3)). Microsoft validated the findings and CVE-2022-41040 and CVE-2022-41082 were assigned to the vulnerabilities.
CVE-2022-41040 is a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082 allows for remote code execution (RCE) where PowerShell is available.
This blog describes what you need to know about these vulnerabilities.
Affected Platforms: On premises Microsoft Ex
Fortinet
CVE-2022-30190: Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina” | FortiGuard Labs
blogs_fortinet·2022-06-01·CVSS 7.8
CVE-2022-30190 [HIGH] CVE-2022-30190: Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina” | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
CVE-2022-30190: Microsoft Support Diagnostic Tool (MSDT) RCE Vulnerability “Follina”
By Shunichi Imano, James Slaughter, Fred Gutierrez, and FortiRecon Team | June 01, 2022
At the end of last week, @nao_sec, an independent cyber security research team, tweeted about a malicious Microsoft Word document submitted from Belarus that leverages remote templates to execute a PowerShell payload using the "ms-msdt" MSProtocol URI scheme. Additional developments over the weekend identified the issue as a new unpatched vulnerability in Windows. A successful attack results in a remote, unauthenticated attacker taking control of an affected system. A publicly available Proof-of-Concept soon followed.
This issue is referred to as “Follina’ and has a CVE assignment of C
Fortinet
Using EPSS to Predict Threats and Secure Your Network | FortiGuard Labs
blogs_fortinet·2022-04-29
Using EPSS to Predict Threats and Secure Your Network | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Using EPSS to Predict Threats and Secure Your Network
By Paolo Di Prodi | April 29, 2022
In the world of cybersecurity and threat intelligence, understanding what threats you might face next is critical to effectively securing your network. The Common Vulnerability Scoring System (CVSS) has been a valuable tool in this fight because it highlights how exploitable different vulnerabilities are. And now, EPSS (Exploit Prediction Scoring System) can supplement CVSS by providing dynamic insight into the likelihood that a vulnerability will be exploited. It produces a probability score of a rational number between 0.0 and 1.0, and the higher the score, the greater the probability that a vulnerability will be exploited.
In this blog, I will review the CVSS scori
Fortinet
Analysis of Microsoft CVE-2022-21907 | FortiGuard Labs
blogs_fortinet·2022-02-15·CVSS 9.8
CVE-2022-21907 [CRITICAL] Analysis of Microsoft CVE-2022-21907 | FortiGuard Labs
FORTIGUARD LABS THREAT RESEARCH
Analysis of Microsoft CVE-2022-21907
By Tim Lau | February 15, 2022
On January 11th, 2022 Microsoft released a patch for CVE-2022-21907 as part of Microsoft’s Patch Tuesday. CVE-2022-21907 attracted special attentions from industry insiders due to the claim that the vulnerability is worm-able. In this analysis we will look at the cause of the vulnerability and how attackers can exploit it.
Affected Platforms: Windows Server 2022, Windows Server 2019, Windows 10
Impacted Users: Any organization with affected Windows system
Impact: Denial of service to affected systems
Severity Level: High
CVE-2022-21907 is a remote code execution vulnerability in Windows’ Internet Information Services (IIS) component. More specifically, it affects the kernel module insi
Krebs
‘Wormable’ Flaw Leads January 2022 Patch Tuesday
blogs_krebs·2022-01-11·CVSS 9.8
[CRITICAL] ‘Wormable’ Flaw Leads January 2022 Patch Tuesday
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is “wormable,” meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.
Nine of the vulnerabilities fixed in this month’s Patch Tuesday received Microsoft’s “critical” rating, meaning malware or miscreants can exploit them to gain remote access to vulnerable Windows systems through no help from the user.
By all accounts, the most severe flaw addressed today is CVE-2022-21907, a critical, remote code exec
Krebs
‘Wormable’ Flaw Leads January 2022 Patch Tuesday
blogs_krebs·2022-01-11·CVSS 9.8
[CRITICAL] ‘Wormable’ Flaw Leads January 2022 Patch Tuesday
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is “wormable,” meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.
Nine of the vulnerabilities fixed in this month’s Patch Tuesday received Microsoft’s “critical” rating, meaning malware or miscreants can exploit them to gain remote access to vulnerable Windows systems through no help from the user.
By all accounts, the most severe flaw addressed today is CVE-2022-21907, a critical, remote code exec
Tenable
Microsoft’s January 2022 Patch Tuesday Addresses 97 CVEs (CVE-2022-21907)
blogs_tenable·2022-01-11·CVSS 9.8
[CRITICAL] Microsoft’s January 2022 Patch Tuesday Addresses 97 CVEs (CVE-2022-21907)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Qualys
Microsoft & Adobe Patch Tuesday (January 2022) – Microsoft 126 Vulnerabilities with 9 Critical, Adobe 41 Vulnerabilities, 22 critical
blogs_qualys·2022-01-11·CVSS 9.0
[CRITICAL] Microsoft & Adobe Patch Tuesday (January 2022) – Microsoft 126 Vulnerabilities with 9 Critical, Adobe 41 Vulnerabilities, 22 critical
## Table of Contents
Microsoft Patch Tuesday January 2022
Adobe Patch Tuesday January 2022
Discover and Prioritize Patch Tuesday Vulnerabilities in VMDR
Respond by Patching
Patch Tuesday Dashboard
Webinar Series: This Month in Vulnerabilities and Patches
About Patch Tuesday
Contributor
## Microsoft Patch Tuesday – January 2022
Microsoft patched 126 vulnerabilities in their January 2022 Patch Tuesday release. Out of these, nine are rated as critical severity. As of this writing, none of the 126 vulnerabilities are known to be actively exploited.
Microsoft has fixed problems in their software including Remote Code Execution (RCE) vulnerabilities, privilege escalation security flaws, spoofing bugs, and Denial of Service (DoS) issues.
## Critical Microsoft Vulnerabilities Patched
Qualys
Microsoft & Adobe Patch Tuesday (January 2022) – Microsoft 126 Vulnerabilities with 9 Critical, Adobe 41 Vulnerabilities, 22 critical | Qualys
blogs_qualys·2022-01-11·CVSS 9.0
[CRITICAL] Microsoft & Adobe Patch Tuesday (January 2022) – Microsoft 126 Vulnerabilities with 9 Critical, Adobe 41 Vulnerabilities, 22 critical | Qualys
#### Table of Contents
- Microsoft Patch Tuesday January 2022
- Adobe Patch Tuesday January 2022
- Discover and Prioritize Patch Tuesday Vulnerabilities in VMDR
- Respond by Patching
- Patch Tuesday Dashboard
- Webinar Series: This Month in Vulnerabilities and Patches
- About Patch Tuesday
- Contributor
## Microsoft Patch Tuesday – January 2022
Microsoft patched 126 vulnerabilities in their January 2022 Patch Tuesday release. Out of these, nine are rated as critical severity. As of this writing, none of the 126 vulnerabilities are known to be actively exploited.
Microsoft has fixed problems in their software including Remote Code Execution (RCE) vulnerabilities, privilege escalation security flaws, spoofing bugs, and Denial of Service (DoS) issues.
### Critical Microsoft Vulnerabiliti
Fortinet
DeathRansom Part II: Attribution
blogs_fortinet·2020-01-02
DeathRansom Part II: Attribution
FORTIGUARD LABS THREAT RESEARCH
DeathRansom Part II: Attribution
By Artem Semenchenko and Evgeny Ananin | January 02, 2020
Introduction
FortiGuard Labs recently discovered an ongoing DeathRansom malicious campaign. Our first blog on this new variant was devoted to a technical analysis of the samples that had been gathered. In this second part, we will try to shed a light on how this DeathRansom campaign is connected with other campaigns, and who might be behind them.
False Scent and Connections with Vidar Stealer
False Language Lead
We start our investigation with the sample 13d263fb19d866bb929f45677a9dcbb683df5e1fa2e1b856fde905629366c5e1, which was mentioned in our previous blog. This sample has debug paths, but we could not recognize the language used. In addition, it has nine resour
Fortinet
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
blogs_fortinet·2018-05-23·CVSS 9.8
CVE-2017-7269 [CRITICAL] Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
FORTIGUARD LABS THREAT RESEARCH
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
By Bing Liu | May 23, 2018
There is a buffer overflow vulnerability in the WebDAV service in Microsoft IIS 6.0 identified as CVE-2017-7269 that allows remote attackers to execute arbitrary code via a long HTTP header. This vulnerability was reportedly first exploited in July or August of 2016, and the PoC was publicly disclosed in March 2017 on GitHub. Over the past month, however, FortiGuard Labs has been documenting a spike in new attacks targeting this vulnerability, peaking on Apr 13, 2018 when we logged over 4 million triggers.
Fortinet released an IPS signature for this vulnerability in March of 2017 named MS.IIS.WebDAV.PROPFIND.ScStoragePathFromUrl.Buffer.Overflow. The daily trigger rate of
Fortinet
Microsoft Kernel Integer Overflow Vulnerability
blogs_fortinet·2016-10-31·CVSS 5.5
CVE-2016-0070 [MEDIUM] Microsoft Kernel Integer Overflow Vulnerability
FORTIGUARD LABS THREAT RESEARCH
Microsoft Kernel Integer Overflow Vulnerability
By Honggang Ren | October 31, 2016
Last month I discovered and reported an integer overflow vulnerability in the Windows Registry. Last Tuesday, October 25th, Microsoft released Security Bulletin MS16-124, which contains the patch for this vulnerability, and identifies it as CVE-2016-0070.
This vulnerability could lead to local privilege elevation, and is rated as “Important” by Microsoft. The vulnerability affects multiple Windows versions, and Microsoft has recommended installing this update immediately.
In this blog I will share the details of this vulnerability.
How to Reproduce
To reproduce the vulnerability, follow the steps below.
Sign into Windows 7 with any non-admin account.
Run regedit.exe in
Crowdstrike
January 2022 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] January 2022 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2022-01-11
Published
Exploited in the wild