CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

The vulnerability’s exact title is Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability. Microsoft describes it as: “Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.”

Why CVE-2026-73009 matters​

The issue is classified as CWE-416, a use-after-free weakness. This class of memory-safety flaw occurs when software continues to use memory after it has been released. In the worst case, carefully constructed network input can turn that programming mistake into code execution.

Microsoft’s advisory states that an unauthenticated attacker could send a specially crafted packet to an affected service over the network. If exploitation succeeds, the attacker could execute code on the target system. No authentication or user interaction is required.

The security rating reflects that potentially serious outcome:

• Severity: Critical
• CVSS base score: 9.8
• CVSS temporal score: 8.5
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• CWE: CWE-416
• Exploitation assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

That CVSS vector is the attention-getter: network access, low attack complexity, no privileges, and no user interaction. In short, this is not a vulnerability that waits patiently for someone to click a suspicious attachment.

Patch the Windows systems in scope​

Microsoft has supplied updates across a notably broad range of Windows client and server releases. The practical goal is straightforward: deploy the applicable KB and verify that systems reach the corresponding fixed build.

Windows 10​

Windows 11​

Windows Server​

Administrator checklist​

1. Identify systems running one of the affected Windows products listed above.
2. Match each device’s Windows release and architecture to its required KB.
3. Deploy the update through the organization’s normal Windows update-management process.
4. Confirm successful installation and validate the fixed build number, rather than treating update approval as proof of remediation.
5. Give particular operational attention to systems that expose or rely on SSTP services, since Microsoft’s stated attack path involves a specially crafted network packet.

CVE-2026-73009 is an example of why monthly Windows security maintenance is not merely housekeeping. The remediation is clearly mapped to KB packages and target builds; the job now is making sure the fleet actually arrives there.