CVE-2026-20929CWE-284broken-access-control

CVE-2026-20929

High · published January 13, 2026

CVSS v3.1
7.5
EPSS
3%
Percentile
86.7
In the wild
Unconfirmed
What it is

⚡ An authorized user can sneak through the cracks! CVE-2026-20929 in Windows HTTP.sys lets attackers elevate their privileges over the network with just a little finesse. 🚨 Think of this vulnerability like a restaurant where a waiter can wander into the kitchen and access restricted areas just because they have a uniform on. With the right moves, they could potentially serve themselves the chef's special recipe—or worse! If exploited, this vulnerability allows an attacker to gain higher-level access to the system, unlocking doors to sensitive information and critical functions. Imagine a waiter not only accessing the kitchen but taking control of the cash register! This could lead to unauthorized changes, data breaches, and a whole lot of chaos in your network.

Put simply

Think of this vulnerability like a restaurant where a waiter can wander into the kitchen and access restricted areas just because they have a uniform on. With the right moves, they could potentially serve themselves the chef's special recipe—or worse! This improper access control issue in Windows HTTP.sys enables an authorized attacker to escalate their privileges, granting them more control than intended over the server's resources.

What to do

If exploited, this vulnerability allows an attacker to gain higher-level access to the system, unlocking doors to sensitive information and critical functions. Imagine a waiter not only accessing the kitchen but taking control of the cash register! This could lead to unauthorized changes, data breaches, and a whole lot of chaos in your network. To secure your systems, ensure that you're running the latest patches for Windows that address this vulnerability. Review user permissions and restrict access to sensitive resources to those who genuinely need it. Don't wait—act now to lock down your environment! You've got this! Take these steps, and you'll have your defenses up in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02871 · 86.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-01-13T23:16Z
Affected products (16)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
References (1)
EPSS history
Timeline
  • 13 JAN 17:57Z
    Windows HTTP.sys Elevation of Privilege Vulnerability
    cvelistv5