CVE-2026-21525
Microsoft Windows NULL Pointer Dereference Vulnerability
Description
CVE-2026-21525 is a medium-severity denial of service vulnerability in the Windows Remote Access Connection Manager, rated 6.2 on the CVSS v3.1 scale. The flaw is caused by a null pointer dereference that allows an unauthorized attacker to cause a denial of service condition through local access to the system. No privileges or user interaction are required for exploitation, making it straightforward for any local user or process to trigger the vulnerability. The attack complexity is low, though the impact is limited to availability — confidentiality and integrity are not affected. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026. The EPSS score of 0.02162 (84.02nd percentile) indicates a meaningful probability of exploitation. A broad range of Windows versions is affected, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.8868 |
| microsoft | windows 10 1809 | < 10.0.17763.8389 |
| microsoft | windows 10 21h2 | < 10.0.19044.6937 |
| microsoft | windows 10 22h2 | < 10.0.19045.6937 |
| microsoft | windows 11 23h2 | < 10.0.22631.6649 |
| microsoft | windows 11 24h2 | < 10.0.26100.7781 |
| microsoft | windows 11 25h2 | < 10.0.26200.7781 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8868 |
| microsoft | windows server 2019 | < 10.0.17763.8389 |
| microsoft | windows server 2022 | < 10.0.20348.4711 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2149 |
| microsoft | windows server 2025 | < 10.0.26100.32313 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21525-detection-script-dos-vulnerability-in-windows-remote-access-connection-manager(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21525-mitigation-script-dos-vulnerability-in-windows-remote-access-connection-manager(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525(US Government Resource)
Weakness Type
CWE-476: NULL Pointer Dereference
This vulnerability is classified under CWE-476: NULL Pointer Dereference, a common software weakness where a program attempts to use a pointer that has not been initialized or has been set to null. When the dereferenced pointer is used in an operation that expects a valid memory address, the application crashes or enters an undefined state. In the context of CVE-2026-21525, the Windows Remote Access Connection Manager fails to validate a pointer before use, causing the service to crash when the null pointer is accessed. NULL pointer dereferences are one of the most prevalent causes of denial of service vulnerabilities in C/C++ codebases, and while they typically do not lead to code execution on modern systems with memory protections, they can reliably disrupt service availability.
Impact Analysis
The impact of CVE-2026-21525 is concentrated entirely on availability. Confidentiality is not impacted (C:N) — the null pointer dereference does not expose or leak any sensitive data. Integrity is similarly unaffected (I:N) — the vulnerability does not allow modification of data or system configurations. Availability faces a high impact (A:H) because triggering the null pointer dereference crashes the Remote Access Connection Manager service, disrupting VPN connections, dial-up networking, and other remote access functionality that depends on this component. The attack vector is local (AV:L), meaning the attacker must have local access to the system, but no privileges (PR:N) or user interaction (UI:N) are required, which lowers the exploitation barrier for any process running on the machine. The scope is unchanged (S:U), confining the impact to the affected service. Organizations that rely on Windows Remote Access services for VPN connectivity or remote work infrastructure are most at risk, as repeated exploitation could cause persistent service disruptions. The ransomware association is currently listed as unknown.
Exploit Maturity
CVE-2026-21525 has confirmed active exploitation, as indicated by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 3, 2026. The EPSS score of 0.02162 (84.02nd percentile) reflects a higher-than-average probability of exploitation. While denial of service vulnerabilities typically receive less attention from attackers than remote code execution flaws, the KEV listing confirms that this vulnerability is being exploited in real-world scenarios. Local denial of service vulnerabilities can be leveraged as part of broader attack chains — for instance, to disrupt security monitoring services, force system restarts that clear forensic evidence, or degrade network connectivity during an intrusion.
Remediation
- Apply the latest Microsoft security update — Install the February 2026 cumulative update for your specific Windows version as described in the Microsoft Security Response Center advisory. Ensure your system build meets or exceeds the patched version numbers for your Windows edition.
- Prioritize systems providing remote access services — Systems running Remote Access Connection Manager for VPN or dial-up services should be patched first, as the denial of service directly impacts these critical functions.
- Restrict local access — Limit local logon rights and service account permissions to reduce the number of identities capable of triggering the vulnerability. Use Group Policy to enforce least-privilege access on systems running remote access services.
- Configure service recovery options — Set the Remote Access Connection Manager service to automatically restart upon failure to minimize downtime if the vulnerability is exploited before patching is complete.
- Monitor for service crashes — Enable Windows Event Log monitoring for unexpected service termination events related to the Remote Access Connection Manager (rasman.exe) to detect exploitation attempts.
- Review system hardening — Ensure that systems providing remote access functionality are hardened according to Microsoft security baselines and that unnecessary services are disabled to reduce the overall attack surface.
Technical Details
CVE-2026-21525 is a null pointer dereference vulnerability in the Windows Remote Access Connection Manager (rasman), a system service responsible for managing VPN connections, dial-up networking, and related remote access functionality. The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a locally exploitable vulnerability with low complexity that requires neither privileges nor user interaction, with impact limited exclusively to availability. The null pointer dereference occurs when the service processes a request or input that leads to an uninitialized or invalidated pointer being accessed, causing an unhandled exception that terminates the service process. On modern Windows systems with DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), null pointer dereferences typically result in a controlled crash rather than exploitable code execution. The affected version matrix covers Windows 10 builds 1607 (below 10.0.14393.8868), 1809 (below 10.0.17763.8389), 21H2 (below 10.0.19044.6937), 22H2 (below 10.0.19045.6937), Windows 11 23H2 (below 10.0.22631.6649), 24H2 (below 10.0.26100.7781), 25H2 (below 10.0.26200.7781), and corresponding Windows Server editions from 2016 through 2025.
Frequently Asked Questions
What is the Windows Remote Access Connection Manager?
The Remote Access Connection Manager (rasman) is a Windows system service that manages VPN connections, dial-up networking, and other remote access profiles. It is essential for organizations using Windows built-in VPN capabilities.
Can this vulnerability be exploited remotely?
No. The attack vector is local (AV:L), meaning the attacker must already have local access to the target system. This could include a low-privilege user, a compromised service account, or malware running on the machine.
Does this vulnerability allow code execution?
No. The vulnerability is a null pointer dereference that causes a service crash (denial of service). It does not allow an attacker to execute arbitrary code, read sensitive data, or modify system integrity.
Why is a denial of service vulnerability in the KEV catalog?
CISA includes vulnerabilities in the KEV catalog based on confirmed active exploitation, regardless of severity. Denial of service vulnerabilities can be strategically valuable to attackers when used to disrupt security services, force restarts, or degrade network connectivity during broader intrusion campaigns.
Which systems should be prioritized for patching?
Systems actively providing VPN or remote access services through the Windows Remote Access Connection Manager should be patched first, followed by any systems where local access by untrusted users is possible.
Is there a workaround if patching is not immediately possible?
Configuring the Remote Access Connection Manager service for automatic restart on failure can mitigate the impact of exploitation. Additionally, restricting local access to the system reduces the pool of potential attackers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.