CVE-2026-49160

This vulnerability is in Windows’ HTTP/2 web handling (HTTP.sys). An attacker can send specially crafted network traffic that forces the system to consume too many resources, which can knock out or seriously slow down the web services running on that machine. Think of it like overwhelming the “front desk” so it can’t handle legitimate visitors.

This matters to you if your business runs Windows 10, Windows 11, or Windows Server (2016/2019/2022/2025) and those systems can be reached over the network with web traffic. The attack does not require a login, and no user interaction is needed. Exposure is primarily a concern when the vulnerable HTTP/2 handling is reachable from an attacker over the network (whether via a public-facing website, reverse proxy path, or any inbound connectivity that reaches the HTTP service).

This is RED because attackers are already exploiting it in real-world attacks, as confirmed by Microsoft’s June 2026 Patch Tuesday release notes. It can be triggered remotely without authentication, so downtime risk is immediate for exposed systems. Patch now to stop attackers from knocking your web services offline.