CVE-2026-73009 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

CVE-2026-73009 is a critical use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The primary threat is unauthenticated remote code execution over the network. Successful exploitation can have a high impact on confidentiality, integrity, and availability, creating the potential for system compromise without requiring credentials or action from a user.

EXPLOITS: The vulnerability is assessed as “Exploitation Less Likely.” It is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Secure Socket Tunneling Protocol (SSTP). An unauthenticated attacker can target an affected service over the network by sending a specially crafted packet. If exploitation succeeds, the attacker can execute code on the target system. The CVSS metrics identify a network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and supported architectures shown in the affected software list. Exploitation can occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on vulnerable Windows systems, potentially compromising sensitive information, system integrity, and service availability. Because neither authentication nor user interaction is required, exposed affected services can present a serious organizational risk. “No credentials and no user action means the vulnerable service itself can become the attack path.”

WORKAROUND: No workaround or mitigation is identified. An official fix is listed, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and supports network-based remote code execution with low attack complexity. No privileges or user interaction are required. Although exploitation is assessed as less likely and no exploitation is currently identified, the potential impact makes timely deployment of the applicable security update important.