CVE-2026-50694

What it actually does

CVE-2026-50694 is a remotely reachable use-after-free vulnerability in Microsoft Windows Secure Socket Tunneling Protocol (SSTP). SSTP is used by Windows Remote Access/RRAS VPN services to tunnel PPP traffic over HTTPS, typically on TCP/443. A use-after-free occurs when SSTP code continues to reference memory after it has been released; with carefully timed or malformed network traffic, an unauthenticated attacker may be able to corrupt process memory and execute arbitrary code. The CVSS vector indicates network reachability, no required authentication, no user interaction, high confidentiality/integrity/availability impact, and high attack complexity, meaning exploitation is likely sensitive to heap state, timing, service configuration, or protocol sequencing.

Why it matters to the business

If exploited, an attacker could gain code execution on a Windows system exposing SSTP, most critically VPN/RRAS servers that are reachable from the internet or untrusted networks. Compromise of a VPN endpoint can be especially damaging because it may provide a foothold into internal networks, enable credential theft, disrupt remote access operations, or allow tampering with traffic and access controls. The vulnerability affects a broad range of supported Windows client and server versions, including Windows Server 2012 through 2025 and Windows 10/11 releases. Although EPSS is currently low at 0.00662, the issue is only 28 days old, has no known public exploit maturity, and affects perimeter-accessible infrastructure, so exposed SSTP services should still be treated as high-priority patch targets.

How an attack unfolds

An attacker first identifies Windows systems exposing SSTP, commonly by discovering HTTPS listeners associated with RRAS/VPN services. The attacker then initiates SSTP protocol negotiation and sends a crafted sequence of packets intended to trigger incorrect object lifetime handling inside the SSTP implementation. If the attacker can manipulate memory layout successfully despite the high attack complexity, the freed memory may be reused in a controlled way and later dereferenced by the vulnerable code path. Successful exploitation can result in arbitrary code execution in the context of the affected SSTP/RRAS service process, potentially allowing the attacker to install tooling, dump credentials, alter VPN-related configuration, pivot to reachable systems, or cause denial of service if exploitation is unstable. No CISA KEV listing, ransomware association, named threat actor exploitation, or mature public exploit is currently indicated by the provided intelligence.

How to fix it

Apply the appropriate Microsoft security update or latest cumulative update for all affected Windows versions running SSTP/RRAS, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. Because no exact fixed build numbers were provided, use Microsoft’s official security update guidance for CVE-2026-50694 and verify that the relevant monthly cumulative update is installed for each operating system release. Prioritize internet-facing VPN/RRAS servers and any hosts where SSTP is enabled. If immediate patching is not possible, reduce exposure by disabling SSTP where not required, disabling RRAS/VPN services on nonessential systems, restricting access to SSTP listeners to trusted source networks, placing VPN endpoints behind protective network controls where feasible, and increasing monitoring for SSTP service crashes or abnormal VPN traffic. Do not rely on obscurity or port changes as primary mitigation.

How to confirm the fix worked

Confirm remediation by validating that affected Windows systems have installed the Microsoft security update that addresses CVE-2026-50694 or a later cumulative update. Check OS build and patch level using standard enterprise patch management tooling, Windows Update history, Microsoft Update Catalog applicability, PowerShell inventory, or vulnerability scanners updated with current Microsoft security content. Validate exposure by identifying systems with RRAS/SSTP enabled and listening for VPN traffic, especially TCP/443 on perimeter interfaces. Confirm that unnecessary SSTP/RRAS services are stopped and disabled where mitigation is being used. After patching, reboot if required by the update, verify that the Remote Access/SSTP service is running normally if needed, and rescan to ensure the host is no longer reported vulnerable.

Typical attack path

1. Discover internet-facing or untrusted-network-facing Windows hosts exposing SSTP/RRAS, commonly over TCP/443.
2. Fingerprint the service behavior to confirm SSTP or Windows VPN functionality is reachable.
3. Establish SSTP negotiation with malformed or specially sequenced protocol messages.
4. Trigger the use-after-free condition by manipulating SSTP object allocation, release, and reuse timing.
5. Achieve process crash or, with successful heap manipulation, execute attacker-controlled code in the vulnerable service context.
6. Perform post-exploitation actions such as persistence, credential access, VPN configuration discovery, lateral movement, or service disruption.

How to detect it

There are no unique public exploitation indicators provided for this vulnerability, so detection should focus on evidence of attempted SSTP exploitation and post-exploitation on Windows VPN/RRAS servers. Collect and review Windows System, Application, Security, RemoteAccess/RRAS, SSTP/RAS, Windows Error Reporting, EDR, firewall, VPN, proxy, and load balancer logs. Look for repeated SSTP connection attempts followed by crashes or restarts of SSTP/RRAS-related services, application fault events referencing SSTP components, abnormal memory-access exceptions, unexpected child processes spawned from service-hosting processes, new local users, credential dumping behavior, suspicious PowerShell/cmd execution, or unusual outbound connections from VPN servers. Correlate network telemetry showing malformed or high-volume SSTP negotiation attempts over TCP/443 with service instability. Because successful exploitation may produce normal-looking HTTPS transport at the network layer, endpoint telemetry and crash artifacts are especially important. If a server experienced unexplained SstpSvc/RRAS crashes before patching, preserve memory/crash dumps and perform forensic review for code execution, persistence, and credential theft.

• SstpSvc
• SSTPSVC
• SstpSvc.dll
• RemoteAccess
• Routing and Remote Access
• Microsoft-Windows-RasSstp
• Microsoft-Windows-RemoteAccess
• Faulting module name: SstpSvc.dll
• Faulting application name: svchost.exe
• The Secure Socket Tunneling Protocol Service service terminated unexpectedly
• The Remote Access Connection Manager service terminated unexpectedly
• The Routing and Remote Access service terminated unexpectedly
• Windows Error Reporting
• APPCRASH
• 0xc0000005
• TCP/443 SSTP
• SSTP

What your security team should do

• Prioritize patching or mitigation for internet-facing Windows Server systems running RRAS/SSTP VPN services.
• Inventory all Windows hosts with Remote Access, RRAS, VPN, or SSTP enabled; do not limit review to dedicated VPN appliances or servers.
• Apply the relevant Microsoft cumulative security updates and confirm successful reboot and patch compliance.
• If patching must be delayed, restrict SSTP access to trusted source ranges and disable SSTP/RRAS where it is not business-critical.
• Monitor VPN endpoints for crashes, unexpected service restarts, anomalous SSTP handshakes, and unusual post-authentication activity following SSTP connection attempts.
• Review authentication logs and remote access logs for suspicious VPN activity around service instability events.
• Ensure EDR coverage and tamper protection are active on VPN/RRAS servers, since compromise of these systems can provide high-value network access.
• Track Microsoft advisories for any later exploitability assessment changes, proof-of-concept publication, KEV listing, or known exploitation reports.