Windows Secure Socket Tunneling Protocol: Denial of Service

Summary

An uncontrolled resource consumption flaw (CWE-401) in the Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthenticated remote attacker to exhaust resources and deny service. The attack needs only network access, no privileges and no user interaction, and the impact is limited to availability. Organizations running Windows SSTP VPN endpoints, typically RRAS or Always On VPN on Windows Server, are affected.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: builds 10.0.19044.0 to before 10.0.19044.7846 and 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: builds 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2: builds 10.0.26100.0 to before 10.0.26100.9974 and 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: builds 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: builds 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9688 or later
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.9487 or later
• Windows 10 Version 21H2 and 22H2: 10.0.19044.7846 or later and 10.0.19045.7846 or later
• Windows 11 Version 23H2: 10.0.22631.7711 or later
• Windows 11 Version 24H2 and 25H2: 10.0.26100.9974 or later and 10.0.26200.9974 or later
• Windows 11 Version 26H1: 10.0.28000.3501 or later
• Windows 11 Version 26H2: 10.0.26300.9974 or later
• Windows Server 2022: 10.0.20348.5870 or later

Build numbers are taken from the CVE record. Verify them against the MSRC advisory before patching. KB mapping: Unknown.

Workaround

• Unknown. Microsoft has not published a workaround in the sources reviewed.
• Reducing SSTP exposure, for example by restricting access to the SSTP listener or moving remote users to another VPN protocol, is a general option. It has operational costs for remote access and is not confirmed by Microsoft.

Exploitation

• In the wild: No evidence found in the sources reviewed. One third-party source lists the CVE as not in CISA KEV; this was not verified against the KEV catalog.
• Public proof of concept: None found.
• CISA SSVC: Exploitation none, automatable yes, technical impact partial.

Our recommendation

• Install the November 2026 security updates on all affected SSTP servers (RRAS, Always On VPN) first, and on other affected Windows systems in the next scheduled maintenance window.
• Confirm the fixed build for each system against the MSRC advisory before rollout.
• Check whether SSTP is exposed to the Internet and restrict access where business needs allow.
• Confirm that SSTP servers are also patched for CVE-2026-62889 (SSTP remote code execution, August 2026).
• Monitor VPN availability and logs for unusual connection floods.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105561 msrc.microsoft.com
• CVE Record CVE-2026-105561 www.cve.org
• VulDB entry 434557 vuldb.com
• Always On VPN security updates, November 2026 (Richard Hicks) directaccess.richardhicks.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-105561 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:11.