Windows SSTP VPN Vulnerability Patched in Record July 2026 Patch Tuesday

Microsoft’s July 2026 Patch Tuesday fixed 622 vulnerabilities, a record, and one of them is a Critical remote code execution bug in a VPN protocol built into Windows Server. If you administer Always On VPN or another SSTP-based remote access setup, this is about you. If you use a commercial VPN app like NordVPN or ProtonVPN, it isn’t. Here’s the difference, and why it’s worth explaining.

What actually got patched

On July 14, Microsoft shipped fixes for 622 vulnerabilities, including two zero-days already under active attack and a third that was publicly disclosed before a patch existed. Among the 62 flaws rated Critical was CVE-2026-50694, a remote code execution vulnerability in the Secure Socket Tunneling Protocol, or SSTP, rated 8.1 on the CVSS scale.

SSTP is a VPN tunneling protocol Microsoft built into Windows years ago. It wraps PPP traffic inside HTTPS, which means it looks like ordinary web traffic to firewalls and proxies. That’s the whole point of it: SSTP was designed to punch through restrictive network gear that blocks other VPN protocols outright. It’s also the protocol underneath Always On VPN, Microsoft’s enterprise remote-access solution, specifically for user-tunnel connections that let employees reach the corporate network from wherever they’re working.

CVE-2026-50694 is a use-after-free flaw (tracked as CWE-416 in the standard weakness classification). In practice, that means an unauthenticated attacker can send a specially crafted SSTP packet to a vulnerable server and get code execution, no login required, no user needing to click anything. Richard Hicks, who covers Always On VPN in detail, flagged the update as one to prioritize in his July security roundup. The one mitigating factor is that Microsoft rates the attack complexity as high: an attacker needs to complete extra preparatory steps before the exploit works, which buys defenders a little time but doesn’t make this optional to patch.

Why an unauthenticated RCE on an internet-facing VPN role matters

The detail that makes this one sting is exposure. SSTP servers are meant to sit directly on the internet, accepting inbound connections from remote employees anywhere. That’s not a misconfiguration, it’s the design. Which also means any vulnerable SSTP-based Windows Server VPN role is, by definition, reachable by anyone scanning the internet for it. An unauthenticated RCE on infrastructure built to be internet-facing is about as high-priority as a Patch Tuesday entry gets.

Compare that to a typical desktop vulnerability, the kind that needs a user to open a malicious file or click a bad link. Those are bad, but they need a human to make a mistake first. A vulnerable SSTP server needs nothing from anyone inside the organization. An attacker who finds it can go straight after it, at any hour, with no phishing email required. That’s the part IT teams should sit with: this isn’t a “someone has to fall for something” risk, it’s a “the door is already open if you haven’t patched” risk.

This didn’t land in isolation. Edge devices and remote-access infrastructure, VPN gateways, firewalls, and the servers behind them, have become one of the most exploited categories in breaches over the past couple of years. Attackers have learned that a single bug in a box designed to accept internet connections beats weeks of phishing an employee. Security researchers keep pointing at exactly this pattern: legacy protocols and edge appliances that were never rebuilt with the current threat model in mind.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

The broader July 2026 Patch Tuesday, in context

The SSTP bug is one line in a very long release. Microsoft’s July update covered 622 vulnerabilities total, the largest single Patch Tuesday on record, with 62 rated Critical. Two of those were zero-days already being exploited when the patch shipped, and a third had been publicly disclosed ahead of a fix. Coverage from The Hacker News and CyberSecurityNews both singled out the sheer volume as the headline, with the SSTP RCE called out specifically because of how it’s deployed.

Big Patch Tuesdays are routine at this point, but the size of this one is a reminder that “patch when convenient” isn’t a real strategy for anything facing the internet. Attackers read release notes the same day defenders do.

Who needs to act, and who doesn’t

If you’re an IT administrator running Always On VPN, or any Windows Server deployment with the SSTP role enabled for remote access: patch now. This is squarely your problem. Check which servers have the VPN role active, confirm the July update is applied, and if you can’t patch immediately, look at whether SSTP exposure can be restricted at the network level in the meantime. Richard Hicks’ write-up and Microsoft’s own advisory are the places to check exact KB numbers for your Windows Server version.

If you’re a regular reader of this site looking for a VPN subscription, or already using one: this doesn’t touch you. NordVPN, ProtonVPN, Mullvad, and the other consumer services covered on this site run their own server infrastructure, built on protocols like WireGuard, OpenVPN, or Lightway, not on a Windows Server SSTP role. CVE-2026-50694 is a flaw in a specific piece of Microsoft’s server software, not in the concept of VPNs, and not in any commercial VPN app. It’s a fair question to ask when a “VPN vulnerability” headline shows up, and the honest answer here is: check what infrastructure the story is actually about before assuming your subscription is affected.

The pattern is worth remembering anyway. It’s the same lesson from other VPN-adjacent security stories this year: the word “VPN” gets used for wildly different products, from a Windows Server role built into corporate networks to a consumer app you install on your phone, and a critical flaw in one says nothing about the other.

That confusion is understandable, honestly. Headlines rarely have room to specify “this affects self-hosted enterprise VPN infrastructure, not the app you pay $5 a month for,” so readers are left to sort it out themselves. Our advice whenever a VPN vulnerability story breaks: check who runs the affected servers before deciding whether to worry. If it’s a company running its own gateway for remote staff, that’s an IT problem. If it’s a provider you pay a subscription to, check whether that specific provider issued a statement, since the two situations rarely overlap.

What to do now

For admins: this goes on the patch-immediately list, not the next-maintenance-window list. Unauthenticated RCE plus internet-facing-by-design is the combination that turns into a breach headline if it sits unpatched. Cross-reference every Windows Server instance running Always On VPN or another SSTP-based remote access setup against the July 2026 update, and don’t assume “we’ll get to it” is safe given how attractive edge infrastructure has become to attackers.

For everyone else: no action needed. If you want a VPN that isn’t running on legacy Windows infrastructure and uses a modern protocol by default, providers like NordVPN default to NordLynx, their WireGuard implementation, which is a different codebase and threat surface entirely. If privacy and a clean audit history matter more to you than raw speed, ProtonVPN is worth a look too. Our guide to VPN protocols and our WireGuard vs OpenVPN comparison both go deeper into why the protocol a provider uses matters more than most people assume.

Sources: Richard Hicks, Always On VPN Security Updates | The Hacker News