CVE-2026-62889
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Risk Assessment
A remote unauthenticated attacker could execute code on the vulnerable system, potentially leading to full compromise.
Recommendation
Apply Windows security updates and restrict access to SSTP services from trusted networks.
Other vulnerabilities in Windows SSTP
See all- CVE-2026-72931Medium
Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.
- CVE-2026-72930High
Use-after-free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.
Original NVD description (English source)
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS