{"id":"CVE-2026-21525","kind":"vulnerability","aliases":["CVE-2026-21525"],"related":[],"title":"Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service…","description":"Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"A NULL pointer dereference in the Windows Remote Access Connection Manager service lets an unauthorized attacker crash it and deny service on the local machine. CISA lists it as actively exploited, and the sources do not describe any code execution.","severity":"medium","cvss":6.2,"epss":null,"exploited":true,"exploited_at":"2026-02-10T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.8868"],"affected":"< 10.0.14393.8868","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.8389"],"affected":"< 10.0.17763.8389","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.6937"],"affected":"< 10.0.19044.6937","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.6937"],"affected":"< 10.0.19045.6937","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.6649"],"affected":"< 10.0.22631.6649","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.7781"],"affected":"< 10.0.26100.7781","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.7781"],"affected":"< 10.0.26200.7781","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.8868"],"affected":"< 10.0.14393.8868","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.8389"],"affected":"< 10.0.17763.8389","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.4711"],"affected":"< 10.0.20348.4711","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.2149"],"affected":"< 10.0.25398.2149","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.32313"],"affected":"< 10.0.26100.32313","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","remote-access","vpn","windows"],"not_affected_if":["no-remote-access-service-in-use"],"how_to_check":null,"fix":"Apply the Microsoft security update for CVE-2026-21525 per vendor instructions; the sources do not name the patch or build.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","status":"open","published_at":"2026-02-10T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:22+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:42:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2026-21525 per vendor instructions; the sources do not name the patch or build.\nIf no mitigation is available, CISA says to discontinue use of the affected product.","reach":"local","summary":"A NULL pointer dereference in the Windows Remote Access Connection Manager service lets an unauthorized attacker crash it and deny service on the local machine. CISA lists it as actively exploited, and the sources do not describe any code execution.","category":"infrastructure","who_cares":["windows","remote-access","vpn"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the Remote Access Connection Manager service, denying service on the machine","analyst_note":"Find the Microsoft advisory for CVE-2026-21525 to confirm the affected builds, the patch, and whether the attack is local-only or reachable over the network.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-remote-access-service-in-use"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00045,"input_tokens":2531,"output_tokens":394,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':162C '-2026':18A,21A '-21525':19A,22A '10':27A,31A,35A,39A '11':43A,47A,51A '1607':28A '1809':32A '2012':56A,60A '2016':64A '2019':68A '2022':72A,76A '2025':81A '21h2':36A '22':161C '22h2':40A '23h2':44A,77A '24h2':48A '25h2':52A 'access':7A,86B,97B,132C 'action':152C 'activ':118B 'allow':10A,142C 'appli':153C 'applic':159C 'attack':13A,104B,145C 'bod':160C 'cisa':114B,150C 'cloud':165C 'code':127B 'connect':8A,98B,133C 'contain':135C 'could':141C 'crash':105B 'cve':17A,20A 'deni':15A,108B,147C 'derefer':3A,92B,139C 'describ':125B 'discontinu':168C 'execut':128B 'exploit':82B,119B 'follow':158C 'guidanc':163C 'infrastructur':83B 'instruct':157C 'let':101B 'list':115B 'local':112B,149C 'machin':113B 'manag':9A,99B,134C 'microsoft':23A,25A,29A,33A,37A,41A,45A,49A,53A,57A,61A,65A,69A,73A,78A,129C 'mitig':154C,174C 'null':1A,90B,137C 'per':155C 'pointer':2A,91B,138C 'product':172C 'remot':6A,85B,96B,131C 'remote-access':84B 'requir':151C 'server':55A,59A,63A,67A,71A,75A,80A 'servic':16A,100B,109B,148C,166C 'sourc':122B 'unauthor':12A,103B,144C 'unavail':176C 'use':169C 'vendor':156C 'vpn':87B 'window':5A,88B,95B,130C 'windows':24A,26A,30A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,79A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-10T00:00:00+00:00","kev":{"dateAdded":"2026-02-10","dueDate":"2026-03-03","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-21525","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21525","severity":null,"published_at":"2026-02-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21525","severity":null,"published_at":"2026-02-10T18:16:34+00:00","modified_at":"2026-06-17T10:18:46+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}