PT-2026-48117 · Microsoft · Windows 10 Version 1607+11

Published 2026-06-09 · Updated 2026-06-10 · CVE-2026-49160

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to cause a denial of service over a network. This issue is known as the HTTP/2 Bomb DoS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-49160

Affected Products

Windows 10 Version 1607

Windows 10 Version 1809

Windows 10 Version 21H2

Windows 10 Version 22H2

Windows 11 Version 23H2

Windows 11 Version 24H2

Windows 11 Version 25H2

Windows 11 Version 26H1

Windows Server 2016

Windows Server 2019

Windows Server 2022

Windows Server 2025

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-49160 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49160 · Vendor Advisory
• https://twitter.com/GoCocoaAI/status/2064475970677952957 · Twitter Post
• https://i.redd.it/u7ozq38qra6h1.png · Reddit Post
• https://twitter.com/PointFrankRange/status/2064526461470466514 · Twitter Post
• https://twitter.com/GoCocoaAI/status/2064475971986641155 · Twitter Post
• https://twitter.com/horizon_secured/status/2064406305625047363 · Twitter Post
• https://twitter.com/techepages/status/2064414018341875795 · Twitter Post