CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 99.9% chance of exploitation in the next 30 days.

HTTP Protocol Stack Remote Code Execution Vulnerability

Affected products

  • Microsoft Windows 10 2004: before 10.0.19041.982 (fixed in 10.0.19041.982)
  • Microsoft Windows 10 20h2: before 10.0.19042.982 (fixed in 10.0.19042.982)
  • Microsoft Windows Server 2004: before 10.0.19041.982 (fixed in 10.0.19041.982)
  • Microsoft Windows Server 20h2: before 10.0.19042.982 (fixed in 10.0.19042.982)

Published 2021-05-11. Last modified 2026-06-17.