Sep 2026: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2026-73009 Published on September 8, 2026
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Weakness Type
What is a Dangling pointer Vulnerability?
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CVE-2026-73009 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-73009
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
Affected Versions
Microsoft Windows 10 Version 1607:- Version 10.0.14393.0 and below 10.0.14393.9512 is affected.
- Version 10.0.17763.0 and below 10.0.17763.9245 is affected.
- Version 10.0.19044.0 and below 10.0.19044.7725 is affected.
- Version 10.0.19045.0 and below 10.0.19045.7725 is affected.
- Version 10.0.22631.0 and below 10.0.22631.7582 is affected.
- Version 10.0.22631.0 and below 10.0.22631.7582 is affected.
- Version 10.0.26100.0 and below 10.0.26100.9445 is affected.
- Version 10.0.26200.0 and below 10.0.26200.9445 is affected.
- Version 10.0.28000.0 and below 10.0.28000.2954 is affected.
- Version 6.2.9200.0 and below 6.2.9200.26349 is affected.
- Version 6.2.9200.0 and below 6.2.9200.26349 is affected.
- Version 6.3.9600.0 and below 6.3.9600.23397 is affected.
- Version 6.3.9600.0 and below 6.3.9600.23397 is affected.
- Version 10.0.14393.0 and below 10.0.14393.9512 is affected.
- Version 10.0.14393.0 and below 10.0.14393.9512 is affected.
- Version 10.0.17763.0 and below 10.0.17763.9245 is affected.
- Version 10.0.17763.0 and below 10.0.17763.9245 is affected.
- Version 10.0.20348.0 and below 10.0.20348.5622 is affected.
- Version 10.0.26100.0 and below 10.0.26100.33438 is affected.
- Version 10.0.26100.0 and below 10.0.26100.33438 is affected.