CVE-2021-31166

high-risk

Published 2021-05-11

HTTP Protocol Stack Remote Code Execution Vulnerability

Do I need to act?

93.0% chance of exploitation in next 30 days

EPSS score — higher than 7% of all CVEs

CISA KEV: actively exploited in the wild

On the Known Exploited Vulnerabilities catalog — federal agencies must patch

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Windows 10 2004

Windows 10 20H2

Windows Server 2004

Windows Server 20H2

Microsoft

Third Party Advisory http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote...

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-3116...

Third Party Advisory http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote...

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-3116...

US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-...

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 27/34 · High

Exposure 10/34 · Low