CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVSS 9.8
CRITICAL
Critical - Same Day Deployment
“A single malicious network packet could give an unauthenticated attacker the ability to run code on a vulnerable Windows system.”
CVE-2026-73009 is a critical use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-416
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.