Windows SSTP CVE-2026-72931

Exploitation requires: (1) local interactive or remote-shell access to the target Windows system as a low-privileged authenticated user (PR:L); (2) the Windows SSTP service (SstpSvc) must be running and reachable on the target system - SSTP is not enabled by default on workstations but is a standard component of Windows Server VPN/RAS configurations; (3) high attack complexity (AC:H) - likely a race condition or specific sequence of operations to reliably trigger the resource leak rather than a trivial single-request trigger. What limits exploitation: attack vector is local only (AV:L), so remote-only threat actors cannot exploit this directly; high complexity reduces reliability of exploitation; impact is confined to service availability with no credential or data exposure.

The CVSS 4.7 (Medium) score accurately reflects the constrained real-world risk profile. AV:L restricts exploitation to users with local system access; AC:H indicates non-trivial exploitation complexity, likely requiring specific timing conditions to reliably trigger the leak and exhaust the target resource. PR:L means a standard non-privileged user account suffices, but combined with AC:H this limits automated or mass exploitation. The impact is strictly availability (C:N/I:N/A:H), with no confidentiality or integrity implications - contradicting the 'Information Disclosure' tag in the input metadata, which is a mislabel. No KEV listing, no POC, and EPSS data is not provided, all pointing to low immediate exploitation pressure. This is best characterized as a locally exploitable resource-exhaustion DoS that is a maintenance-priority patch rather than an emergency response item. The broad version scope (Server 2012 through Server 2025, Windows 10 and 11) means patch coverage effort across the estate is non-trivial even if urgency is low.

An attacker with a local non-privileged account on a Windows Server acting as an SSTP VPN endpoint initiates repeated SSTP connection sequences crafted to trigger the resource non-release path, exhausting the server's available handles or memory over time. Under the right timing conditions (AC:H), this causes the SSTP service or associated system components to become unresponsive, denying VPN access to legitimate users. No public exploit code exists at time of analysis, and AC:H implies reliable triggering would require research effort.