CVE-2023-21548

This is a remote-code-execution vulnerability in Windows' Secure Socket Tunneling Protocol implementation, reachable over the network without authentication. The one thing holding it back is high attack complexity: successful exploitation isn't a simple single-shot request, it depends on conditions the attacker doesn't fully control, which is why it lands at 8.1 rather than a straight 9.8 despite the unauth-remote-RCE shape.

SSTP is a VPN protocol, so the exposure that matters is Windows hosts terminating SSTP connections at the network edge, exactly the kind of internet-facing service attackers probe. The high-complexity requirement dampens the tempo, opportunistic reliable exploitation is harder to achieve, but a VPN-facing RCE is the sort of thing capable actors will invest in developing, so 'hard' is not 'safe' over time.

Our priority driver here is exposure: which Windows systems actually have SSTP enabled and reachable from untrusted networks, because that set is usually far smaller than the total Windows estate. We patch those first and hard, confirm the rollup is landing, and where SSTP isn't needed we would disable or firewall it outright, since removing the listener eliminates the reachable path entirely.