CVE-2026-73009: Windows SSTP Use After Free Vulnerability

CVE-2026-73009 Overview

CVE-2026-73009 is a use-after-free vulnerability [CWE-416] in the Windows Secure Socket Tunneling Protocol (SSTP) service. The flaw allows an unauthenticated remote attacker to execute arbitrary code over a network by sending crafted SSTP traffic to an affected system. No user interaction or prior privileges are required, making internet-facing SSTP endpoints particularly exposed.

Microsoft published the advisory on 2026-09-08. Because SSTP is commonly used to terminate VPN tunnels over TCP 443, affected hosts often sit at network perimeters where exploitation could yield initial access into internal environments.

Critical Impact
Unauthenticated remote code execution against Windows SSTP endpoints, typically running with SYSTEM-level privileges on VPN gateways.

Affected Products

Microsoft Windows (versions with the SSTP service enabled)
Windows Server deployments configured as Routing and Remote Access Service (RRAS) VPN gateways
Windows clients using SSTP-based VPN connectivity

Discovery Timeline

2026-09-08 - CVE-2026-73009 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-73009

Vulnerability Analysis

The vulnerability resides in Windows SSTP protocol handling. SSTP encapsulates PPP traffic inside a TLS session over TCP 443, and the service parses attacker-controlled protocol messages before authentication completes. A use-after-free condition [CWE-416] occurs when the SSTP handler references a memory object after it has been freed during message processing.

An attacker who successfully triggers the freed-object reuse can control the contents of the reclaimed allocation. This provides a path to arbitrary code execution in the context of the SSTP service, which typically runs with high privileges on the target host.

Because SSTP listens on TCP 443, network-layer filtering alone is often insufficient to isolate the service. The attack surface is exposed wherever RRAS or an equivalent SSTP endpoint accepts inbound tunnels from the internet.

Root Cause

The root cause is improper object lifetime management in the SSTP message parser. A code path frees a heap object while a dangling pointer remains reachable during subsequent processing. Reuse of that pointer against attacker-influenced memory enables control-flow hijacking.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. An attacker sends a sequence of crafted SSTP control messages that drive the vulnerable code path, first freeing the target object and then triggering its reuse. Successful exploitation grants remote code execution on the SSTP host.

No verified public proof-of-concept code is available at time of writing. Refer to the Microsoft Security Update CVE-2026-73009 advisory for authoritative technical details.

Detection Methods for CVE-2026-73009

Indicators of Compromise

Unexpected crashes or restarts of the RasSstp service or the Routing and Remote Access Service (RemoteAccess) on Windows Server
New or unusual child processes spawned by SSTP-related services following inbound TCP 443 traffic
Anomalous outbound connections originating from VPN gateway hosts after SSTP session activity
Windows Error Reporting entries referencing SSTP components with access-violation exceptions

Detection Strategies

Monitor Event Viewer for RRAS and SSTP service faults, particularly access violations and heap corruption events
Correlate inbound SSTP connections on TCP 443 with post-connection process creation events on the gateway
Alert on unusual command-line activity or LOLBin execution originating from SVCHOST instances hosting the SSTP service

Monitoring Recommendations

Enable process creation logging (Event ID 4688) with command-line auditing on all RRAS and SSTP hosts
Capture and retain network flow metadata for inbound TCP 443 traffic reaching SSTP endpoints
Baseline normal SSTP session establishment patterns and alert on connection floods or malformed handshake sequences

How to Mitigate CVE-2026-73009

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-73009 advisory to all Windows hosts running SSTP
Inventory all internet-facing systems accepting SSTP tunnels and prioritize patching for those endpoints
Review VPN gateway logs for anomalous SSTP sessions or service crashes preceding the patch date

Patch Information

Microsoft has released updates addressing CVE-2026-73009 through its Update Guide. Administrators should consult the Microsoft Security Update CVE-2026-73009 page for the specific KB articles applicable to each affected Windows build and apply the updates through Windows Update, WSUS, or an equivalent patch management workflow.

Workarounds

Disable the SSTP VPN protocol on RRAS gateways where an alternative tunneling protocol (such as IKEv2) is available until patches are deployed
Restrict inbound TCP 443 access to SSTP endpoints using firewall rules that permit only known client source ranges
Terminate SSTP traffic behind a reverse proxy or VPN concentrator that enforces additional protocol validation

bash

# Disable SSTP as an accepted tunnel type on a Windows RRAS server (PowerShell)
Set-VpnServerConfiguration -TunnelType Ikev2
Restart-Service RemoteAccess