Microsoft released the November 2026 security updates today, which include three vulnerabilities affecting Always On VPN deployments. This month’s release addresses issues in the Secure Socket Tunneling Protocol (SSTP) and Internet Key Exchange (IKE). And for a change, there are NO vulnerabilities in the Windows Server Routing and Remote Access Service (RRAS) this month!
SSTP Vulnerabilities
SSTP is commonly used for Always On VPN user tunnel connections. Because SSTP is, by design, exposed directly to the Internet, vulnerabilities affecting this protocol deserve attention. This month’s updates address the following two SSTP vulnerabilities. Both are rated Important.
CVE-2026-105561 – Windows SSTP Denial of Service Vulnerability (CVSS 7.5)
CVE-2026-105510 – Windows SSTP Elevation of Privilege Vulnerability (CVSS 7.0)
IKE Vulnerability
The November 2026 security updates also address a spoofing vulnerability in the Windows IKE Extension. Always On VPN implementations that use the device tunnel or IKEv2 for the user tunnel are affected. Microsoft rates this vulnerability as Important.
CVE-2026-122169 – Windows IKE Extension Spoofing Vulnerability (CVSS 7.5)
Not Using IKEv2?
If you are not using the device tunnel or IKEv2 for the user tunnel, ensure the following IKEv2 ports are blocked at the edge firewall.
- Inbound UDP port 500 (IKE)
- Inbound UDP port 4500 (IKE NAT-T)
In addition, consider disabling IKEv2 on the RRAS server entirely. Guidance for doing this is in my earlier post, Always On VPN IKEv2 Security Vulnerability April 2026.
No RRAS Vulnerabilities
RRAS has been a regular fixture in the monthly security updates, with several CVEs disclosed in most recent releases. September 2026 alone included eight RRAS CVEs, four of them rated Critical. It is refreshing to report that the November 2026 release includes no RRAS vulnerabilities at all.
Summary
This is a relatively light month for Always On VPN administrators. All three vulnerabilities are rated Important, and none are rated Critical. However, SSTP and IKE are both Internet-facing services in most Always On VPN deployments, so administrators should plan to deploy these updates during their next scheduled maintenance window and avoid unnecessary delays.
Additional Information
Always On VPN: Secure Remote Access for Windows
