CVE-2026-47291 HTTP.sys RCE - Anomalous IIS Child Processes and Crash Events

Ankit Mehta@Secvyn

•updated Jun 26, 2026•2•0•6

Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).