Windows SSTP CVE-2026-50694

Exploitation requires the target Windows host to have the SSTP VPN endpoint (RRAS with SSTP enabled) running and network-reachable, typically on TCP 443, so the attacker can deliver malicious SSTP protocol traffic to the vulnerable code path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed against a reachable SSTP service. Limiting factors: SSTP/RRAS is not enabled by default on most systems, so only hosts explicitly configured as SSTP VPN servers (or otherwise exposing the SSTP service) are exploitable; additionally, turning a use-after-free into reliable RCE is non-trivial (SSVC Automatable: no), which raises the practical bar beyond the raw score.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a trivially reachable, unauthenticated network RCE with total impact, and CISA SSVC rates Technical Impact as 'total'. Counterbalancing this, SSVC lists Exploitation as 'none' and Automatable as 'no', EPSS is only 0.61% (45th percentile), the CVE is NOT in CISA KEV, and no POC is known - so this is a high-severity-but-not-yet-exploited issue rather than an active fire. A notable tension worth flagging: exploiting a use-after-free for reliable RCE (versus a crash/DoS, which the tags also list) is non-trivial, consistent with SSVC's Automatable:no, so the practical bar is higher than the 9.8 suggests. Realistic exposure also depends on whether SSTP/RRAS is actually enabled and reachable, which is not universal.

An attacker who can reach a Windows host running the SSTP/RRAS VPN service on TCP 443 sends a crafted sequence of SSTP protocol messages that triggers the use-after-free, corrupting heap memory to hijack control flow and execute code in the context of the vulnerable service. No credentials or user interaction are required per the CVSS vector, but reliable code execution (as opposed to a crash) demands careful heap grooming; no public POC is known at time of analysis.