CVE-2026-50694

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 54th percentile. A vendor fix is available.

CVSS 3.18.1High EPSS percentile54th0.8% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your systems are running Windows and whether SSTP is enabled/used (for VPN/RRAS scenarios that terminate SSTP).
Identify your exact Windows version/build and compare it to the fixed builds below.
Patch now to the fixed version for your Windows branch (do not wait for symptoms):
- Windows 10: 10.0.14393.9339 OR 10.0.17763.9020 OR 10.0.19044.7548 OR 10.0.19045.7548
- Windows 11: 10.0.26100.8875 OR 10.0.26200.8875 OR 10.0.28000.2269
- Windows Server 2012: 6.2.9200.26226
- Windows Server 2012 R2: 6.3.9600.23291
- Windows Server 2016: 10.0.14393.9339
- Windows Server 2019: 10.0.17763.9020
- Windows Server 2022: 10.0.20348.5386
If you can’t patch immediately, reduce exposure by blocking network access to the SSTP/VPN entry points from untrusted networks until updates are applied.
After patching, verify the update installed successfully and keep an eye on SSTP/VPN-related logs for unusual connection attempts.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-50694 is a Windows bug that lets a remote attacker run code through SSTP without needing a login, so businesses running affected Windows versions should patch urgently.

CVE-2026-50694 is a use-after-free remote code execution flaw in Windows Secure Socket Tunneling Protocol (SSTP); it can be triggered over the network by an unauthenticated attacker.

If you're affected

Full server compromise
Ransomware risk
Network-wide compromise
Service disruption

What is it

SSTP is a Windows feature used for setting up secure connections (commonly for VPN-style access). This vulnerability is a “use-after-free” bug where Windows can be tricked into using memory that has already been released. If that happens, a remote attacker could potentially run their own code on the machine.

Who is affected

This affects organizations that run any of the listed Windows versions (Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025). It matters most if you use SSTP in your environment (for example, if your servers accept SSTP connections from clients).

Reachability gate: the risk is only relevant if SSTP is reachable over the network to an external/untrusted party; there is no authentication required for the attacker per the findings.

How urgent is it

This is RED because the flaw is a remote code execution issue that does not require attacker authentication. That combination means an attacker can potentially attempt the attack directly over the network.

While CISA KEV does not list this issue and there’s no clear dated public exploitation report in the findings, you should still treat it as urgent because a remotely triggerable, unauthenticated code-execution bug is high-risk in practice.

What to do — in detail

Confirm exposure (are we actually reachable by SSTP?)
- Inventory servers/workstations on the affected list.
- Determine where SSTP is used: VPN gateways, RRAS deployments, or any Windows configuration that terminates SSTP connections.
- Check network controls: whether SSTP endpoints are reachable from the internet or from untrusted networks.
Determine exact patch state
- On each affected machine, capture the Windows version/build.
- Compare your build against the fixed versions provided for your branch (below).
Upgrade path (apply the fix)
- Windows 10:
  - Fixed in 10.0.14393.9339 OR 10.0.17763.9020 OR 10.0.19044.7548 OR 10.0.19045.7548
- Windows 11:
  - Fixed in 10.0.26100.8875 OR 10.0.26200.8875 OR 10.0.28000.2269
- Windows Server 2012:
  - Fixed in 6.2.9200.26226
- Windows Server 2012 R2:
  - Fixed in 6.3.9600.23291
- Windows Server 2016:
  - Fixed in 10.0.14393.9339
- Windows Server 2019:
  - Fixed in 10.0.17763.9020
- Windows Server 2022:
  - Fixed in 10.0.20348.5386
- Windows Server 2025:
  - Notably, no fixed version was listed in the findings for Server 2025; treat this as “fix not yet confirmed in provided data” and prioritize obtaining the vendor update guidance for that branch.
Temporary workaround if patching is delayed
- Block inbound access to SSTP/VPN entry points from the internet/untrusted networks.
- Restrict access to only known IP ranges or via a VPN/authenticated front door, so the unauthenticated remote trigger path is not reachable.
What to monitor after remediation
- Review SSTP/VPN-related connection logs for unusual or repeated connection attempts.
- Confirm the systems report the intended update level and remain stable post-reboot.
CISA due date
- Not listed in the findings (no KEV entry provided), so no due date is available from the supplied data.

Technical context

Severity: HIGH with remote code execution potential (CWE-416: use-after-free). Mechanism: a use-after-free in Windows Secure Socket Tunneling Protocol (SSTP) that allows an unauthorized remote attacker to execute arbitrary code. Attack vector is network-based, and authentication is not required per the findings; there is no user interaction required.

Exploit status: the findings do not list this vulnerability in CISA KEV and do not provide a clear dated press claim of exploitation; no public exploit code is on record in the provided sources. The patch guidance is version-specific across multiple Windows branches (including multiple Windows 10/11 and multiple Windows Server releases).

What KEV means here: because KEV is not listed in the findings, there is no confirmation (from CISA KEV in the provided data) of widespread known exploitation—however, the vulnerability’s unauthenticated, remotely triggerable code-execution nature still warrants immediate patching.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS54th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.8% chance of exploitation activity in the next 30 days, which ranks it in the 54th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 27 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16Patch availablerecord updated
2026-07-15Record updatedrecord updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated
2026-06-25OpenVAS check added

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable