CVE-2026-62889

SSTP is a Windows networking feature used for secure tunneling. This bug is a memory handling error (a “double free”) that can be triggered by someone sending specially crafted network traffic. If it’s reachable, it can let an attacker run code on your computer as if they were already inside.

This matters if your business runs Windows SSTP on the listed Microsoft systems: Windows 10, Windows 11, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. The findings say it requires no authentication and no user action, so the key factor is whether your systems are reachable from a network and whether SSTP traffic can get to the affected service. Treat it as a risk especially for any servers or devices exposed to the internet or to untrusted networks via SSTP.

This is RED because the flaw can allow remote attackers to execute arbitrary code without authentication or user interaction. That combination—remote reachability plus code execution—means patching is the most important step to prevent compromise. Even though no confirmed CISA KEV entry or dated public exploitation report is listed, the technical impact is high and a security-relevant patch is available.

1. Confirm what you’re running

• Identify which machines use Windows in the affected set: Windows 10, Windows 11, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025.
• Determine whether SSTP is enabled/used on those systems (for example, systems providing remote access VPN/tunneling, or hosts where SSTP traffic is allowed through firewalls).

2. Check whether each system is already patched

• For each Windows device, check the OS version/build and compare it to Microsoft’s fixed versions for CVE-2026-62889.
• Apply the patch if your build is below the fixed build for your edition.

3. Upgrade to the fixed versions (per Microsoft)

• Windows 10: 10.0.14393.9418 OR 10.0.17763.9121 OR 10.0.19044.7663 OR 10.0.19045.7663
• Windows 11: 10.0.22631.7517 OR 10.0.26100.9168 OR 10.0.26200.9168 OR 10.0.28000.2704
• Windows Server 2012: 6.2.9200.26280
• Windows Server 2012 R2: 6.3.9600.23338
• Windows Server 2016: 10.0.14393.9418
• Windows Server 2019: 10.0.17763.9121

4. If patching is delayed (temporary workaround)

• Reduce exposure by blocking or tightly restricting external access to SSTP endpoints/services until updates are installed.
• Review firewall rules so that SSTP traffic is not reachable from the internet unless absolutely required and protected.

5. After patching

• Verify the OS build number matches a fixed version.
• Continue monitoring for suspicious network activity on remote access/tunneling-related services.

6. Timing guidance

• KEV: not listed in CISA KEV (per findings), and no dated public exploitation claim was provided.
• Due date: not specified in the provided findings.
• Given RED severity and the available fix, prioritize within your normal incident response window (days, not weeks).

Severity is high: CVSS 8.1 (HIGH). The vulnerability is CVE-2026-62889, a double-free memory management bug (CWE-415) in Windows Secure Socket Tunneling Protocol (SSTP). Findings indicate remote code execution is possible over the network with no authentication and no user interaction required. KEV status is not listed (so it’s not a CISA-validated, actively exploited catalog entry in the provided data). Exploitation: no public exploit code on record and no dated, clear news claim of exploitation; however, press attention is reported and the PULSE feed mentions actor activity associated with Lazarus group, which increases caution. No exploit maturity details beyond that were provided. EPSS is given as a prediction only (0.6% with flat trend), but remediation priority here follows the RED verdict and availability of a Microsoft fix.