CVE-2026-62889 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

CVE-2026-62889 is a Critical remote code execution vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). A double-free memory flaw can allow an unauthenticated remote attacker to execute code by sending a specially crafted packet to an affected SSTP service. Exploitation requires winning a race condition, making attack complexity high.

CVSS Score: 8.1.

SEVERITY: Critical.

THREAT:
An attacker can target an affected SSTP service remotely over the network without privileges or user interaction. Successful exploitation can result in high impact to confidentiality, integrity, and availability. Exploitation is rated less likely because successfully triggering the vulnerability requires winning a race condition.

EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a CWE-415 double-free condition in Windows Secure Socket Tunneling Protocol (SSTP). An unauthenticated attacker can send a specially crafted packet over the network to an affected service. Successful exploitation requires the attacker to win a race condition but, if successful, can allow code execution on the target system. The CVSS metrics identify a network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and supported architectures. Exploitation uses a specially crafted network packet and requires winning a race condition.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution on affected systems, putting sensitive information, system integrity, and service availability at risk. For organizations with affected SSTP services, compromise could disrupt operations and expose critical Windows systems to attacker-controlled code.

WORKAROUND:
No workaround or mitigation is identified. An official fix is listed, so affected systems should be updated with the applicable security update.

URGENCY:
This vulnerability carries a Critical severity rating and can enable unauthenticated remote code execution with no user interaction. Although exploitation is assessed as less likely and no exploitation is reported, the potential impact is high. Organizations should prioritize deployment of the applicable security updates across affected Windows systems.