Windows SSTP CVE-2026-71332

Exploitation requires an existing low-privileged local account on the target Windows system (CVSS PR:L confirmed). The SSTP kernel component is loaded as part of the Windows networking stack on all supported Windows versions; no special SSTP VPN server configuration is required for the UAF code path to be locally reachable. High attack complexity (AC:H) means the attacker must successfully win a kernel-level race condition, requiring repeated attempts and limiting reliable single-attempt exploitation. No user interaction is required once local access is established (UI:N). Remote network exploitation is not possible - the attack is strictly local (AV:L). Exploitation is not restricted to systems configured as SSTP VPN endpoints; any Windows host granting local account access is within scope.

The CVSS 7.0 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately profiles this as a locally-constrained, non-trivial exploit requiring an existing low-privileged account and success against a race condition. The local-only attack vector and high complexity substantially lower the immediate threat priority relative to remote-exploitable flaws - even a mid-sized municipal IT team in opole should treat this as urgent primarily for environments that grant local interactive access to untrusted users, such as multi-user terminal servers, VDI deployments, or systems accessible via lateral movement. No EPSS score is available in the provided data; the absence of a CISA KEV listing and no identified public exploit code further moderate near-term urgency. However, the full C:H/I:H/A:H impact triad is credible - a successful UAF in a Windows kernel driver reliably yields SYSTEM access, making this a high-value post-exploitation primitive. The SSTP component is present on all Windows systems regardless of whether SSTP VPN is actively configured, so the attack surface is any Windows host with a local low-privileged account.

An attacker who has obtained a low-privileged local account - via credential theft, a compromised service account, or lateral movement - repeatedly invokes concurrent SSTP-related kernel operations to win the race condition between memory deallocation and the subsequent dangling access, corrupting a kernel structure to redirect execution and escalate to SYSTEM. No public proof-of-concept exploit has been identified, but the AC:H rating indicates the race window is narrow yet achievable with sufficient repeated attempts on a live system.