Future TechnologyCVE-2026-73009 hits the Windows SSTP service and needs no password
Key takeaways
- CVE-2026-73009 is a use-after-free RCE in the Windows SSTP service rated CVSS 9.8
- Exploitation needs no authentication, just a crafted packet to an exposed SSTP listener
- SSTP is usually published straight to the internet on TCP 443 by Windows Server RRAS
- Microsoft fixed 973 vulnerabilities this month, two of them already under active exploitation
Microsoft fixed 973 vulnerabilities on 8 September. That number is doing nothing useful for you, because nobody patches 973 things in priority order.
The one to move on first is CVE-2026-73009, a remote code execution flaw in the Windows Secure Socket Tunneling Protocol service, rated 9.8 out of 10.
Why 9.8 with no authentication is the bad combination
The underlying bug is a use after free in the SSTP protocol handling. An unauthenticated attacker sends a specially crafted packet to the SSTP listener and executes code on the target. There is no credential step and nobody to trick into clicking anything.
A CVSS score on its own tells you very little, which we covered in what a CVSS 10 actually means. What matters here is the combination: maximum impact, network reachable, and no authentication barrier in front of it. That is the shape of a flaw that gets scanned for at scale within days.
Who is actually exposed
SSTP is the Microsoft-native VPN protocol, supported out of the box by Windows Server's Routing and Remote Access Service. Organisations offering SSTP-based remote access almost always publish the service straight to the internet on TCP 443, because that is the point of it. The exposure is deliberate and the flaw sits behind it.
So the question is narrow and answerable. Does anything in your estate terminate VPN connections on Windows? If RRAS is running with SSTP enabled and reachable from outside, you are in scope. If your remote access runs through a third party appliance or an IPsec or WireGuard setup, this specific CVE is not your problem.
The two minute check
Work the exposure rather than the patch list. Confirm which hosts have the RemoteAccess role installed, check whether SSTP is enabled as a tunnel type rather than left at the default, and confirm from outside your own network whether TCP 443 on those hosts answers. An external port check from a phone on mobile data is faster and more honest than reading a firewall rule.
If it answers and you cannot patch this week, restricting which source addresses can reach the listener buys you time. It is not a fix.
The rest of the load
The 973 total breaks down as 723 Windows issues, 111 Office, 62 SQL, 22 developer tools, 16 SharePoint Server and 9 Exchange Server, with elevation of privilege accounting for close to half. Two flaws in the release were already being exploited before the patches landed, and we went through those in our September Patch Tuesday roundup.
Separately, CISA added five actively exploited flaws to its KEV catalogue the same week, covering JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. Different vendors, same urgency. Browser-side, the Chrome V8 zero day is still the one to have already handled.
What to watch
Whether a public exploit appears. Use after free bugs in network-facing services are fiddly to weaponise reliably, which usually buys defenders a few weeks rather than a few days. That window is the entire value of patching now instead of at the end of the month.
The quieter point sits in the breakdown. Of 973 fixes, the one that can be exploited by an anonymous packet is in a service that only runs because somebody deliberately published it to the internet, which means the fix and the exposure are both entirely within your control.