CVE-2026-72931

Published: Sep 8, 2026Modified: Sep 24, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Missing release of resource after effective lifetime in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to deny service locally.

Affected (24)

Products: Microsoft: Windows 10 1607, Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025

13 products

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10 1607	version < 10.0.14393.9512
Microsoft Windows 10 1607	version < 10.0.14393.9512
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	version < 10.0.14393.9512
Microsoft Windows Server 2019	version < 10.0.17763.9245
Microsoft Windows Server 2022	version < 10.0.20348.5622
Microsoft Windows Server 2025	version < 10.0.26100.33438

Related CWEs

CWE-772

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72931

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.