CVE-2026-72931: Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.
Other sources
Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authorized on the affected Windows system and must be able to act locally. The provided severity vector indicates low privileges are required and no user interaction is required.
What is the likely impact if exploitation succeeds?
Successful exploitation can deny service by triggering a resource-release flaw in SSTP. The provided data identifies availability impact only; it does not indicate confidentiality or integrity impact.
Which systems should be reviewed for exposure?
Review Microsoft Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems that use SSTP. The supplied information does not identify unaffected versions or configurations.