CVE-2026-62889

Published Aug 11, 2026

Last updated a day ago

CVSS high 8.1
Tunneling protocol

Overview

Description
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Source
secure@microsoft.com
NVD status
Undergoing Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
8.1
Impact score
5.9
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

secure@microsoft.com
CWE-415

Social media

Hype score
Not currently trending

  1. 🚨 CRITICAL CVE ALERT CVE-2026-62889 · Microsoft Windows Server 2019 · CVSS 8.1 Attackers could execute arbitrary code. Upgrade to a vendor-listed fixed release. 🔎 Full advisory: https://t.co/dzAcdMOCRy #CyberSecurity #CVE #Microsoft #WindowsServer

    @vulnipulse

    11 Aug 2026

    23 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Related CVEs

  1. An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage•CVE-2026-13117
  2. A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry•CVE-2026-12996
  3. A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets•CVE-2026-12932
  4. Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability•CVE-2026-16812
  5. WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.•CVE-2026-63089

References

Sources include official advisories and independent security research.