Nov 2026: HTTP.sys Information Disclosure Vulnerability
CVE-2026-119946 Published on November 10, 2026
HTTP.sys Information Disclosure Vulnerability
Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network.
Vulnerability Analysis
Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL
Weakness Type
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Products Associated with CVE-2026-119946
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
