Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Exploitation requires specific conditions, including particular network configurations and timing conditions, and has only been observed in limited scenarios. This means an attacker cannot reliably exploit the issue in all environments and may need favorable setup or circumstances for it to work.
Security updates
10.0.17763.9376 — https://support.microsoft.com/help/5126651
10.0.19044.7807 — https://support.microsoft.com/help/5126657
10.0.20348.5761 — https://support.microsoft.com/help/5126655
10.0.22631.7652 — https://support.microsoft.com/help/5126653
10.0.26100.9711 — https://support.microsoft.com/help/5127648
10.0.26100.33650 — https://support.microsoft.com/help/5126646
10.0.28000.3231 — https://support.microsoft.com/help/5127646
6.2.9200.26434 — https://support.microsoft.com/help/5126835
6.3.9600.23470 — https://support.microsoft.com/help/5126836
10.0.14393.9612 — https://support.microsoft.com/help/5126868
Vulnerabilities 1
-
High 8.1
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-85926 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85926
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss