CVE-2026-72931: Windows SSTP DOS Vulnerability

CVE-2026-72931 is a denial of service vulnerability in Windows Secure Socket Tunneling Protocol caused by missing resource release. An authorized attacker can exploit this locally to deny service. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-72931 Overview

CVE-2026-72931 is a denial of service vulnerability in the Windows Secure Socket Tunneling Protocol (SSTP). The flaw stems from a missing release of resources after their effective lifetime, classified as [CWE-772]. An authorized local attacker can trigger the condition to exhaust system resources and disrupt SSTP service availability. The vulnerability requires low privileges but has high attack complexity, limiting practical exploitation. Microsoft rates the issue as medium severity with an availability impact but no confidentiality or integrity impact.

Critical Impact
An authorized local attacker can exhaust SSTP resources to cause denial of service on the affected Windows host.

Affected Products

Microsoft Windows (SSTP component)
Windows Secure Socket Tunneling Protocol service
See the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72931 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72931

Vulnerability Analysis

The vulnerability resides in the Windows SSTP implementation, a VPN protocol that tunnels PPP traffic over an SSL/TLS channel. SSTP allocates resources such as memory buffers, handles, or connection state to service tunneling requests. Under specific conditions, the code path fails to release these resources once their effective lifetime ends. Repeated triggering of the flawed code path causes gradual resource exhaustion. The result is degraded service or a full denial of the SSTP subsystem on the affected host.

Root Cause

The root cause is a missing resource release, categorized under [CWE-772] Missing Release of Resource after Effective Lifetime. When an SSTP operation completes or fails along a specific branch, the corresponding allocation is not freed. Over many iterations, leaked resources accumulate and starve legitimate operations of memory, handles, or session slots.

Attack Vector

Exploitation requires local access with low privileges on the target system. The attacker interacts with the SSTP interface in a manner that repeatedly reaches the leaky code path. Because attack complexity is high, the attacker must satisfy timing or state conditions that are not directly under their control. No user interaction is required, and successful exploitation impacts only availability, not confidentiality or integrity.

No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide entry for CVE-2026-72931 for vendor technical details.

Detection Methods for CVE-2026-72931

Indicators of Compromise

Progressive increase in non-paged pool or handle counts attributed to SSTP-related services
Failed SSTP connection attempts followed by service unresponsiveness
System event log entries indicating resource allocation failures on the RRAS or SSTP service

Detection Strategies

Baseline memory and handle usage of the Routing and Remote Access Service (RRAS) and monitor for sustained growth
Correlate repeated local SSTP API calls or connection attempts from the same user context with rising resource metrics
Alert on process restarts or service crashes tied to the SSTP component

Monitoring Recommendations

Ingest Windows performance counters for Process\Handle Count and Process\Private Bytes on RRAS-related processes into your SIEM
Monitor Windows Event Log channels for RRAS, SSTP, and Service Control Manager errors
Track local logon activity from low-privilege accounts that subsequently interact with VPN services

How to Mitigate CVE-2026-72931

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72931 as soon as it is available in your patch cycle
Inventory Windows hosts running RRAS with SSTP enabled and prioritize them for patching
Restrict local logon rights on VPN servers to trusted administrative accounts

Patch Information

Microsoft has published guidance for this CVE in the Security Update Guide. Consult the Microsoft Security Update Guide for the specific KB articles and cumulative updates that address the resource leak in the SSTP component.

Workarounds

Disable SSTP as an accepted VPN protocol on RRAS servers where it is not required and use alternatives such as IKEv2
Enforce least privilege so that only vetted accounts can interact locally with the SSTP service
Configure service recovery options to automatically restart RRAS if the SSTP subsystem becomes unresponsive, reducing outage duration until patches are applied