CVE-2026-50694 is a use after free (CWE-416) in Windows Secure Socket Tunneling Protocol (SSTP) that can let an unauthorized attacker execute code over a network. NVD scores it 8.1 high. Install the Microsoft update for your build and check where SSTP VPN is in use.
What's affected
The record lists Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 24H2, 25H2 and 26H1, and Windows Server 2012, among others. Microsoft's page holds the update numbers.
The vector is network based with high complexity, no privileges and no user interaction.
How to check if you're exposed
SSTP is used by the Windows VPN server role and by clients that connect to it. On a server, check whether Remote Access is installed and the SSTP service is running:
Get-Service SstpSvc
Get-WindowsFeature RemoteAccess
Then compare installed updates from Get-HotFix with Microsoft's advisory.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find Windows servers that run Remote Access and accept SSTP VPN connections.
- Open the Microsoft advisory and map the fixed update to each Windows build.
- Patch VPN servers first, then client machines.
- If you do not use SSTP, turn it off and use another supported tunnel type.
- Review VPN logs for failed or odd connection attempts around the patch window.
Why it matters
A use after free (CWE-416) happens when freed memory is referenced again. In a protocol handler that accepts connections from outside, that can be steered toward code execution.
The record does not mark this CVE as exploited in the wild and it is not a CISA KEV entry. A VPN endpoint is by design reachable from the internet, so it is a good place to patch early.
Quick check
Do clients need the update too?
The record lists client and server builds. Apply the update to all systems that use SSTP and read the advisory for details.
Is SSTP on by default?
Not on a plain Windows install. It depends on the roles you enable, so check your servers.
Sources
Last reviewed: 19 October 2026.
