CVE-2026-85926: Windows SSTP Use After Free Vulnerability

CVE-2026-85926 Overview

CVE-2026-85926 is a use-after-free vulnerability [CWE-416] in the Windows Secure Socket Tunneling Protocol (SSTP). An unauthorized attacker can exploit the flaw over a network to execute arbitrary code on affected Windows systems. The weakness resides in SSTP memory handling, where freed objects can be referenced after deallocation. Successful exploitation grants the attacker code execution in the context of the vulnerable service.

Microsoft published guidance for this issue in the Security Update Guide. The vulnerability requires no authentication and no user interaction, though attack complexity is high.

Critical Impact
Remote, unauthenticated attackers can execute arbitrary code on Windows systems with SSTP exposed, impacting confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (versions implementing the Secure Socket Tunneling Protocol service)
Windows Server deployments acting as SSTP VPN endpoints
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-10-13 - CVE-2026-85926 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85926

Vulnerability Analysis

The vulnerability stems from a use-after-free condition in the Windows SSTP implementation. SSTP tunnels Point-to-Point Protocol (PPP) traffic through a Transport Layer Security (TLS) channel, typically over TCP port 443. The protocol handler maintains state objects for each tunnel session.

Under specific message sequencing, the service releases a memory object while retaining a reference that is later dereferenced. When the stale pointer is reused, an attacker who controls the reclaimed allocation can redirect execution flow. The outcome is arbitrary code execution within the SSTP service process.

Attack complexity is high because the attacker must win a timing or allocation race to place controlled data into the freed region. However, no credentials and no user interaction are required, which keeps the attack surface broad for internet-facing VPN gateways.

Root Cause

The root cause is improper lifetime management of SSTP session objects [CWE-416]. The service frees a structure while concurrent or subsequent processing paths continue to access it, violating the object's lifecycle contract.

Attack Vector

An attacker reaches the vulnerable service across the network by initiating SSTP connections to a target gateway. By orchestrating a sequence of protocol messages that triggers the free-then-use condition, the attacker corrupts memory and executes code. See the Microsoft Security Update Guide for protocol-level specifics.

No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-85926

Indicators of Compromise

Unexpected crashes, restarts, or Watson error reports from the Windows SSTP service process
Anomalous child processes spawned by services associated with Remote Access or SSTP handling
Unusual outbound connections from the SSTP host following inbound TLS sessions on TCP/443
SSTP session logs showing malformed or truncated control messages preceding service faults

Detection Strategies

Monitor Windows Event Logs for Application Error, Service Control Manager, and Routing and Remote Access service failures correlated with external SSTP connections
Inspect network telemetry for high-rate or malformed SSTP handshake patterns from untrusted sources
Hunt for post-exploitation behavior such as credential access, lateral movement, and persistence originating from the SSTP host

Monitoring Recommendations

Enable verbose logging on Routing and Remote Access Service (RRAS) servers that expose SSTP
Forward endpoint, VPN gateway, and perimeter telemetry to a centralized SIEM for correlation
Alert on service crash loops on hosts with SSTP enabled, which may indicate exploitation attempts

How to Mitigate CVE-2026-85926

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows hosts
Inventory internet-facing SSTP endpoints and prioritize patching those systems first
Restrict inbound access to SSTP services to trusted source ranges where feasible
Review RRAS and VPN logs for signs of exploitation attempts preceding patch deployment

Patch Information

Microsoft has published the authoritative advisory and patch availability through the Security Update Guide. Administrators should consult the Microsoft Security Update Guide for the specific KB articles mapped to each affected Windows build and deploy updates through Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

Disable SSTP on RRAS servers if the protocol is not required, favoring IKEv2 or alternative tunneling
Place SSTP gateways behind a TLS-terminating reverse proxy or VPN concentrator that filters malformed traffic
Enforce network segmentation so compromise of an SSTP host cannot pivot directly into sensitive internal zones

bash

# Disable SSTP as a tunnel option on an RRAS server (PowerShell)
Set-VpnServerConfiguration -TunnelType IKEv2

# Verify current VPN tunnel protocols
Get-VpnServerConfiguration | Select-Object -ExpandProperty TunnelType