Remediation
Analysis of CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
Immediate Containment
! Install official Microsoft patch resolving CVE-2026-47291 immediately on all Windows systems hosting web services.
! Enable WAF rule to block requests with integer overflow patterns in Range headers.
Exposure Reduction & Patching
🛡️ Disable IIS kernel caching (HTTP.sys caching) temporarily if patching must be delayed.
🛡️ Restrict access to administrative web interfaces to internal network segments.
📦 Apply all vendor-recommended security updates and patches.
Configuration & Credentials
⚙️ Enforce hardened security configuration baselines.
🔑 Rotate administrative and identity access tokens across affected scopes.
Evidence Preservation
📁 Capture forensic memory images and event logs prior to remediation.
Verification & Rollback
✓ Run comprehensive threat hunts to verify eradication of threat indicators.
↩️ Rollback: Follow vendor-supported rollback instructions if policy adjustments cause outages.