Windows SSTP CVE-2026-62889

The SSTP service must be actively running and reachable from the attacker over the network - in practice, this means a Windows Server with RRAS configured to accept SSTP VPN connections, typically listening on TCP/443. The PR:N CVSS metric and the 'Authentication Bypass' tag together confirm exploitation is possible without any valid Windows credentials, occurring in the pre-authentication SSTP handshake phase. The key limiting factor is AC:H (high attack complexity): exploitation is not straightforward and requires meeting specific conditions during the double free trigger, such as heap grooming, precise packet sequencing, or a race condition - this significantly raises the bar for reliable exploitation compared to a simpler memory corruption class. Exploitation is not limited to any specific SSTP client configuration; the flaw is server-side. Systems that do not expose SSTP (i.e., have RRAS disabled or SSTP not configured as an allowed VPN protocol) are not exploitable. Windows 10/11 client systems are listed as affected but are not typically configured as SSTP servers.

The CVSS 3.1 base score of 8.1 reflects a high-impact but technically demanding vulnerability: AV:N (network reachable), AC:H (high complexity - exploitation requires meeting specific conditions), PR:N (no authentication needed), and C:H/I:H/A:H (full triad compromise if exploited). The high attack complexity is the primary mitigating factor and distinguishes this from trivially wormable RCEs. EPSS data was not provided; without it, probabilistic exploitation likelihood cannot be quantified precisely. No CISA KEV entry exists and no POC is publicly identified, which lowers near-term exploitation risk relative to a KEV-listed flaw of similar severity. The 'Authentication Bypass' tag corroborates the PR:N assessment and suggests the double free is triggered during SSTP handshake processing, before credential validation - reducing the defensive value of strong password policies as a compensating control. The breadth of affected versions (19 distinct OS builds from Server 2012 through Windows 11 26H1) creates significant patch-management pressure, particularly for organizations maintaining older Windows Server 2012/2012 R2 systems that may require Extended Security Updates. Overall: real priority for SSTP-exposing systems, but AC:H means targeted, skilled exploitation rather than automated mass compromise.

An attacker with network access to a Windows SSTP VPN endpoint (typically TCP/443) sends a specially crafted sequence of SSTP handshake packets designed to trigger a double free in the session setup code path before authentication completes. By precisely timing or sequencing packet delivery to satisfy the high-complexity exploitation condition, the attacker corrupts heap metadata, redirects execution to attacker-controlled code, and achieves SYSTEM-level remote code execution on the VPN server. No public POC has been identified at time of analysis, meaning this scenario currently requires significant exploit-development effort from a skilled adversary.