Yesterday Microsoft has patched a critical vulnerability in Windows HTTP stack (http.sys), which would have extreme consequences if an exploit is publicly disclosed.
Up until this writing (15-04-2015 17:00) no public exploit exists.
The vulnerability is assigned CVE-2015-1635 and MS15-034.
Using a specially crafted HTTP GET request, an attacker can trivially execute code remotely on an IIS server (or other exposed service taking advantage of the vulnerable code in http.sys), in the context of the System account.
DOS vectors may also apply and is under investigation by our engineers.
Please refer to https://support.microsoft.com/en-us/kb/3042553 for affected versions
Microsoft has published a update KB3042553.
On publicly exposed servers immediately ensure (via update history) that KB3042553 has been successfully installed.
You can use WSUS (if utilized) to ensure update was installed successfully.
If above conditions do not meet, manually update and ensure.
https://technet.microsoft.com/en-us/library/security/ms15-034.aspx