High7.5Microsoft Server Updated

HTTP.sys Denial of Service Vulnerability

CVE-2026-49787 Published Jul 14, 2026Updated by vendor Jul 14, 2026

CVE-2026-49787

Affected products & platforms

Microsoft ServerWindows Server

Summary

HTTP.sys Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.

Affected versions

Windows 10 Version 1607 10.0.14393.0
Windows 10 Version 1809 10.0.17763.0
Windows 10 Version 21H2 10.0.19044.0
Windows 10 Version 22H2 10.0.19045.0
Windows 11 Version 24H2 10.0.26100.0
Windows 11 Version 25H2 10.0.26200.0
Windows 11 version 26H1 10.0.28000.0
Windows Server 2016 10.0.14393.0
Windows Server 2016 (Server Core installation) 10.0.14393.0
Windows Server 2019 10.0.17763.0
Windows Server 2019 (Server Core installation) 10.0.17763.0
Windows Server 2022 10.0.20348.0

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

KB5099538 (build 10.0.17763.9020)
KB5099540 (build 10.0.20348.5386)
KB5099539 (build 10.0.19045.7548)
KB5099536 (build 10.0.26100.33158)
KB5101650 (build 10.0.26100.8875)
KB5095051 (build 10.0.28000.2269)
KB5101649 (build 10.0.28000.2525)
KB5099535 (build 10.0.14393.9339)

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Install the applicable security update for your platform: KB5099538, KB5099540, KB5099539, KB5099536, KB5101650, KB5095051 (see the Microsoft Update Catalog).

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Source evidence

What VulniPulse actually used to build this record — and why.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
Microsoft Server
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-49787NVD CVE.org MITRE

Official resources

MSRC Security Update Guide
Official documentation
Filter by this CVE for per-product KB numbers, severity and exploitability assessment.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

HTTP.sys Denial of Service Vulnerability

CVE-2026-49787 Published Jul 14, 2026Updated by vendor Jul 14, 2026

Affected products & platforms

Microsoft ServerWindows Server

Summary

HTTP.sys Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.

Affected versions

Windows 10 Version 1607 10.0.14393.0
Windows 10 Version 1809 10.0.17763.0
Windows 10 Version 21H2 10.0.19044.0
Windows 10 Version 22H2 10.0.19045.0
Windows 11 Version 24H2 10.0.26100.0
Windows 11 Version 25H2 10.0.26200.0
Windows 11 version 26H1 10.0.28000.0
Windows Server 2016 10.0.14393.0
Windows Server 2016 (Server Core installation) 10.0.14393.0
Windows Server 2019 10.0.17763.0
Windows Server 2019 (Server Core installation) 10.0.17763.0
Windows Server 2022 10.0.20348.0

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Fixed versions

KB5099538 (build 10.0.17763.9020)
KB5099540 (build 10.0.20348.5386)
KB5099539 (build 10.0.19045.7548)
KB5099536 (build 10.0.26100.33158)
KB5101650 (build 10.0.26100.8875)
KB5095051 (build 10.0.28000.2269)
KB5101649 (build 10.0.28000.2525)
KB5099535 (build 10.0.14393.9339)

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Install the applicable security update for your platform: KB5099538, KB5099540, KB5099539, KB5099536, KB5101650, KB5095051 (see the Microsoft Update Catalog).

Official advisory · high-confidence parse· fetched 2 hours ago·verify at source

Source evidence

What VulniPulse actually used to build this record — and why.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
Microsoft Server
CVE.org CNA recordCVE.org
Independent CNA record used for near-real-time discovery and missed-CVE reconciliation.
CVE Program
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-49787NVD CVE.org MITRE

Official resources

MSRC Security Update Guide
Official documentation
Filter by this CVE for per-product KB numbers, severity and exploitability assessment.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.