CVE-2026-72931

MediumCVSS 4.7

Published: 08/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

Risk Assessment

An attacker could cause resource exhaustion, potentially leading to unavailability of the SSTP service.

Recommendation

Apply Windows security updates to address this vulnerability.

Other vulnerabilities in Windows SSTP

See all

CVE-2026-72930High
Use-after-free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally.
CVE-2026-62889High
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

Original NVD description (English source)

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS