CVE-2026-62889

SSTP is a Windows networking feature used for secure tunneling. This bug is a memory handling error (a “double free”) that can be triggered by someone sending specially crafted network traffic. If it’s reachable, it can let an attacker run code on your computer as if they were already inside.

This matters if your business runs Windows SSTP on the listed Microsoft systems: Windows 10, Windows 11, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. The findings say it requires no authentication and no user action, so the key factor is whether your systems are reachable from a network and whether SSTP traffic can get to the affected service. Treat it as a risk especially for any servers or devices exposed to the internet or to untrusted networks via SSTP.

This is RED because the flaw can allow remote attackers to execute arbitrary code without authentication or user interaction. That combination—remote reachability plus code execution—means patching is the most important step to prevent compromise. Even though no confirmed CISA KEV entry or dated public exploitation report is listed, the technical impact is high and a security-relevant patch is available.