Every CVE Search/ Get API key

CVE-2022-21907

HTTP Protocol Stack Remote Code Execution Vulnerability

9.8 CriticalPublic exploit

HTTP Protocol Stack Remote Code Execution Vulnerability

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

92.8%Up 21.5 points since Feb 8, 2022
90%50%10%1%

What each source reports

CVE List Score used 9.8

HTTP Protocol Stack Remote Code Execution Vulnerability

HTTP Protocol Stack Remote Code Execution Vulnerability

Record
CVE-2022-21907
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated
2026-11-02
EUVDEUVD-2022-27063 9.8

HTTP Protocol Stack Remote Code Execution Vulnerability

Record
EUVD-2022-27063
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Updated
2026-11-03
GitHub AdvisoriesGHSA-cgqq-62rg-6vmf 9.8

HTTP Protocol Stack Remote Code Execution Vulnerability.

HTTP Protocol Stack Remote Code Execution Vulnerability.

Record
GHSA-cgqq-62rg-6vmf
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 9.8

HTTP Protocol Stack Remote Code Execution Vulnerability

Record
CVE-2022-21907
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBWindows 10 v21H1 - HTTP Protocol Stack Remote Code Execution2023-07-07
PoC in GitHub0xmaximus/Home-Demolisher2022-11-22
PoC in GitHubEzoomE/CVE-2022-21907-RCE2023-05-06
PoC in GitHubMalwareman007/CVE-2022-219072022-10-29
PoC in GitHubZZ-SOCMAP/CVE-2022-219072022-01-17
PoC in GitHubasepsaepdin/CVE-2022-219072023-08-17
PoC in GitHubcassie0206/CVE-2022-219072023-04-25
PoC in GitHubcorelight/cve-2022-219072022-01-11
PoC in GitHubgpiechnik2/nmap-CVE-2022-219072022-04-16
PoC in GitHubiveresk/cve-2022-219072022-05-16
Show 7 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubiveresk/cve-2022-21907-http.sys2022-05-10
PoC in GitHubkamal-marouane/CVE-2022-219072023-12-09
PoC in GitHubmauricelambert/CVE-2022-219072022-01-15
PoC in GitHubmichelep/CVE-2022-21907-Vulnerability-PoC2022-01-23
PoC in GitHubp0dalirius/CVE-2022-21907-http.sys2022-01-17
PoC in GitHubpolakow/CVE-2022-219072022-04-04
PoC in GitHubsiboy17/CVE-2022-21907-http.sys2026-08-03

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21907 is a critical vulnerability (CVSS 9.8) in Microsoft Windows 10 Version 1809, published January 11, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 92.8%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open