VulnerabilityUndergoing Analysis

CVE-2026-72931

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

MEDIUM 4.7EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

CVSS 3.1: 4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-772
Source: secure@microsoft.com

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72931

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.