External risk intelligence

Windows SSTP Use After Free Allows Network Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73009

The vulnerability affects the Secure Socket Tunneling Protocol (SSTP), which is a VPN protocol specifically designed to establish encrypted tunnels over the internet. As a core component of remote access services and gateway infrastructure, SSTP endpoints are typically public-facing by design to facilitate external connectivity.

Use After Free

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Windows Secure Socket Tunneling Protocol, a component used for secure network connections. This issue allows an unauthorized attacker to potentially execute code remotely, posing a significant risk to systems utilizing this protocol. The main concern at this stage is to determine if our environment is impacted.

Flaw in secure connection protocol.
Remote code execution risk.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

A remote attacker could exploit a use-after-free vulnerability in Windows' Secure Socket Tunneling Protocol to execute arbitrary code. This could occur without any special privileges or user interaction, allowing an unauthorized party to gain control of the affected system by sending specially crafted network packets.

No authentication or user interaction required.
Triggered by sending malicious network traffic.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthorized attacker could execute code over a network by exploiting a use-after-free flaw in the Windows Secure Socket Tunneling Protocol. This could potentially impact system integrity and confidentiality.

System code execution.
Exploitable over a network.
Allows unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Windows SSTP could allow an unauthenticated network attacker to execute code remotely. Action should be coordinated by infrastructure and network security teams, potentially involving vendor management if a Microsoft patch is required. The immediate priority is to identify all SSTP endpoints, assess their exposure and criticality, and then plan remediation based on this risk analysis.

Infrastructure and network security teams.
Verify SSTP endpoint exposure and criticality.
Plan and execute remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows Secure Socket Tunneling Protocol?

SSTP is a mechanism within Windows that creates encrypted VPN tunnels to securely transport traffic. It is widely used to provide remote workers with safe access to internal network resources and private applications over public internet connections.

What does the use-after-free weakness mean in CVE-2026-73009?

This is a memory management error where the software continues to use a pointer to a memory location after that memory has been freed. In the context of this CVE, an attacker can manipulate this state to overwrite existing data or execute their own malicious instructions on the system.

How is this SSTP vulnerability triggered?

An attacker triggers this flaw by sending specifically crafted network packets to the SSTP service. Because the vulnerability lies within the protocol handling itself, the attack does not require the attacker to have user credentials, nor does it require any action from a person sitting at the targeted computer.

Do I need to worry about this if my SSTP services are internal?

According to Halo Surface Signal, SSTP is designed to facilitate external connectivity and is commonly found on internet-facing gateway infrastructure. While public-facing endpoints are at the highest risk, any system running the SSTP service that is reachable over a network could theoretically be targeted.

What steps should I take if I run Windows SSTP?

Begin by identifying all systems and gateways in your environment that have the SSTP service enabled. Once you have a list of these assets, prioritize them based on their visibility to the network and the criticality of the data they protect, while preparing to apply official security updates from Microsoft as they become available.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73009

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.