CVE-2026-50694

SSTP is a Windows feature used for setting up secure connections (commonly for VPN-style access). This vulnerability is a “use-after-free” bug where Windows can be tricked into using memory that has already been released. If that happens, a remote attacker could potentially run their own code on the machine.

This affects organizations that run any of the listed Windows versions (Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025). It matters most if you use SSTP in your environment (for example, if your servers accept SSTP connections from clients).

Reachability gate: the risk is only relevant if SSTP is reachable over the network to an external/untrusted party; there is no authentication required for the attacker per the findings.

This is RED because the flaw is a remote code execution issue that does not require attacker authentication. That combination means an attacker can potentially attempt the attack directly over the network.

While CISA KEV does not list this issue and there’s no clear dated public exploitation report in the findings, you should still treat it as urgent because a remotely triggerable, unauthenticated code-execution bug is high-risk in practice.