PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72930 Microsoft CVE debrief

A use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to execute code locally. This issue affects various versions of Windows 10, Windows 11, and Windows Server. The vulnerability exists due to improper handling of memory, allowing attackers to exploit this weakness. Defenders should prioritize patching and inventory checks for exposed systems. The CVE record and NVD vulnerability detail provide information on the vulnerability, its CVSS score, and affected versions of Windows.

Vendor
Microsoft
Product
Windows 10 Version 1607
CVSS
HIGH 7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-08
Original CVE updated
2026-09-22
Advisory published
2026-09-08
Advisory updated
2026-09-22

Who should care

Defenders responsible for Windows systems, especially those using SSTP, should assess exposure and prioritize patching. This includes administrators managing Windows 10, Windows 11, and Windows Server environments. Security teams should review system inventory and implement compensating controls for exposed systems while remediation is scheduled.

Why it matters

CVE-2026-72930 is a high-severity vulnerability in Windows Secure Socket Tunneling Protocol (SSTP) that allows authorized attackers to execute code locally. Defenders should prioritize patching and inventory checks for exposed systems.

  • Local code execution by authorized attackers
  • Potential for lateral movement within compromised networks
  • Need for immediate patching or mitigation
  • Verification of system inventory and exposure

Technical summary

The vulnerability exists in the Windows Secure Socket Tunneling Protocol (SSTP) and allows an authorized attacker to execute code locally due to a use-after-free issue. This occurs when the protocol improperly manages memory, enabling attackers to exploit this weakness. Affected systems include various versions of Windows 10, Windows 11, and Windows Server. The CVE record provides additional technical details.

Defensive priority

High

Recommended defensive actions

  • Review and apply the available patch from Microsoft.
  • Inventory Windows systems for exposure, especially those using SSTP.
  • Monitor for potential exploitation attempts.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, its CVSS score, and affected versions of Windows. Evidence is based on official CVE Program and NVD records. The vulnerability has a high CVSS score of 7, indicating a significant threat. Defenders should verify system inventory and exposure, especially for systems using SSTP. Limited source detail is available; explicit evidence limits apply.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72930 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72930

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72930 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72930

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.