A critical local privilege escalation vulnerability in the Windows HTTP.sys driver could allow an authenticated attacker to gain elevated system permissions.

This is a TOCTOU race condition (CWE-367) within the HTTP.sys kernel driver. The flaw allows an attacker who already possesses low-level local user access to manipulate system resources during the processing of HTTP requests, resulting in unauthorized privilege escalation.

Successful exploitation of this vulnerability grants an attacker elevated privileges on the local system, which is a precursor to full system compromise or lateral movement within the network. Given the CVSS score of 7.8, this represents a high-risk scenario where an authenticated user can bypass security boundaries to gain administrative control, potentially leading to data exfiltration or the installation of persistent malicious software.

Immediate Action: Apply the February 2026 security updates provided by Microsoft to all affected Windows systems immediately.

Proactive Monitoring: Review system and security event logs for suspicious process creation or unusual activity originating from low-privileged user accounts.

Compensating Controls: Ensure that the principle of least privilege is enforced on all workstations and servers to limit the number of users who can execute arbitrary code on the local machine.

Public Exploit Available: Unknown.

Organizations should prioritize the deployment of the vendor-supplied security updates to all Windows endpoints identified in the affected versions list. While this vulnerability requires local authentication, the potential for total system compromise necessitates prompt patching to prevent lateral movement and further exploitation by malicious actors.