EUVD-2026-73773
GHSA-hgrc-8wgv-4gxf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, unauthenticated, no-interaction against an exposed SSTP service, but reliably exploiting a use-after-free requires heap grooming/race winning, so AC:H rather than the vendor's AC:L.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Windows Secure Socket Tunneling Protocol (SSTP) service lets an unauthenticated network attacker run arbitrary code on affected hosts by triggering a use-after-free condition. The flaw spans nearly the entire supported Windows family (Windows 10/11 through 26H1 and Windows Server 2012 through 2025), carries a CVSS 9.8, and was reported by Microsoft's own security team with a patch now available. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running the Windows SSTP service - i.e., a host configured as an SSTP VPN endpoint via the Routing and Remote Access Service, with the SSTP listener reachable by the attacker over the network; this VPN role is not enabled by default, which is the primary factor limiting real-world exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) presents a maximal, network-reachable, unauthenticated, no-interaction RCE - a top-priority profile on paper, and Microsoft assigning it directly (secure@microsoft.com) lends credibility to the impact rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update for your specific build as published in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73009) - Patch available per vendor advisory, with the exact fixed build per edition listed above (for example, 10.0.26100.9445 for Windows 11 24H2, 10.0.20348.5622 for Server 2022, 6.3.9600.23397 for Server 2012 R2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Windows systems in your organization that have SSTP VPN listeners enabled (typically Windows Server instances configured for remote access) and segment them from production networks if patching cannot be completed immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today