CVE-2026-72930: Windows SSTP Use After Free Vulnerability

CVE-2026-72930 Overview

CVE-2026-72930 is a use-after-free vulnerability [CWE-416] in the Windows Secure Socket Tunneling Protocol (SSTP) component. An authorized local attacker can trigger the flaw to execute arbitrary code on the affected system. Microsoft published the advisory on 2026-09-08 with a CVSS 3.1 base score of 7.0.

The vulnerability requires local access, low privileges, and high attack complexity, but successful exploitation compromises confidentiality, integrity, and availability. No public exploit code or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Local code execution via memory corruption in the SSTP driver enables privilege escalation and full system compromise once an attacker wins the required race condition.

Affected Products

Microsoft Windows (SSTP component)
Windows client and server editions using the Secure Socket Tunneling Protocol stack
Refer to the Microsoft Security Response Center advisory for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72930 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72930

Vulnerability Analysis

The flaw resides in the Windows Secure Socket Tunneling Protocol (SSTP) implementation, a VPN transport that carries PPP traffic over an SSL/TLS channel. SSTP runs as a privileged kernel-mode and service-mode component, so memory corruption in this code path directly threatens the operating system boundary.

A use-after-free condition occurs when the SSTP component releases a memory object but retains a dangling reference. Subsequent operations dereference the freed pointer, allowing an attacker to control the object contents through heap grooming. Reliable exploitation converts the dangling reference into arbitrary code execution in the context of the vulnerable component.

The requirement for high attack complexity indicates that exploitation depends on winning a race condition or satisfying non-trivial preconditions. Successful attackers gain code execution with elevated rights on the local host.

Root Cause

The root cause is improper object lifetime management within the SSTP protocol handler. The component fails to invalidate or reference-count a pointer after freeing the underlying allocation, matching the classic [CWE-416] pattern.

Attack Vector

An attacker must already hold low-privilege local access on the target. The attacker interacts with the SSTP service through its exposed local interfaces, triggers the vulnerable free path, and then reclaims the freed allocation with attacker-controlled data before the stale pointer is reused. Because no user interaction is required, the technique is suitable for chaining after initial access.

No verified proof-of-concept code is available. See the Microsoft advisory for vendor technical details.

Detection Methods for CVE-2026-72930

Indicators of Compromise

Unexpected crashes, bugchecks, or WER reports referencing the SSTP driver or RasSstp components.
New or unusual child processes spawned from SSTP-related services on hosts that do not routinely terminate VPN tunnels.
Local, low-privilege accounts initiating repeated SSTP connection attempts against localhost or loopback interfaces.

Detection Strategies

Monitor kernel crash telemetry and Windows Error Reporting for faults tagged to SSTP modules, which often precede successful use-after-free exploitation attempts.
Alert on process creation chains where an SSTP service account launches shells, script hosts, or LOLBins.
Correlate local user session activity with SSTP connection setup and teardown patterns that deviate from baseline VPN usage.

Monitoring Recommendations

Enable Windows event log forwarding for RAS, SSTP, and driver-load events into a centralized analytics platform.
Track EDR telemetry for anomalous memory operations, token manipulation, or privilege changes originating from SSTP service processes.
Review scheduled tasks and services created shortly after suspected SSTP crashes as potential persistence indicators.

How to Mitigate CVE-2026-72930

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to every affected Windows host.
Restrict interactive and remote local logon rights to reduce the population of accounts that can reach the vulnerable code path.
Audit endpoints and servers for enabled SSTP functionality and disable it where it is not required.

Patch Information

Microsoft addressed CVE-2026-72930 in the Windows security update published on 2026-09-08. Consult the Microsoft Security Response Center entry for the specific KB numbers, build versions, and superseded updates that map to your Windows release.

Workarounds

Disable the SSTP protocol on RRAS servers and client VPN profiles where an alternative such as IKEv2 is acceptable.
Block inbound TCP/443 SSTP traffic at the perimeter for servers that do not terminate SSTP VPN sessions.
Enforce least-privilege configurations and application control policies to limit which local accounts can invoke SSTP client APIs.

bash

# Example: disable SSTP on a Windows RRAS server (run in elevated PowerShell)
Set-VpnServerConfiguration -TunnelType Sstp -Enabled $false
Restart-Service RemoteAccess