AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2015-1635

CRITICAL · CVSS 9.8 EPSS 100.00% CISA KEV · Actively Exploited Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2015-04-14 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

Exhibit — Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution
External Security References
packetstormsecurity.com ↗ exploit-db.com ↗ exploit-db.com ↗

Note: these links are listed for security research and verification purposes only.

Cross-Reference — CISA KEV

Status: This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

Ransomware use: Unknown

Added to KEV: 2022-02-10

Required action: Apply updates per vendor instructions.

CVE
CVE-2015-1635
Severity
CRITICAL
CVSS
9.8
EPSS
100.00%
Microsoft Windows

Original Filing — NVD Description

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."