CVE-2026-73009
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker can remotely execute code in the context of SSTP, potentially leading to system compromise or breach of VPN connection confidentiality.
Recommendation
Install the latest security updates for Windows. Restrict access to SSTP services on the network.
Other vulnerabilities in Windows Secure Socket Tunneling Protocol (SSTP)
See all- CVE-2026-88147High
A heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
- CVE-2026-85926High
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
- CVE-2026-71332High
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS