CVE-2026-21525: Microsoft Windows NULL pointer dereference in Remote Access Connection Manager

CVE-2026-21525 · Severity: critical · CVSS 6.2 · Exploited in the wild · Published 2026-02-10

Microsoft Windows Remote Access Connection Manager, which handles network connections, contains a flaw that can be used to crash the system. An attacker with local access to a computer can trigger this vulnerability to cause a blue screen or system restart, leading to a denial of service. This issue has been observed being used in active attacks, making prompt patching essential to maintain system stability.

Technologies: Microsoft Windows. Vendors: Microsoft.

Quick answers

Is CVE-2026-21525 exploited in the wild?
Yes. CVE-2026-21525 is known to be exploited in the wild, first recorded on 10 February 2026. Treat it as urgent.
How severe is CVE-2026-21525?
Critical severity, with a CVSS score of 6.2, published 10 February 2026.
Which products and versions are affected?
Microsoft Windows 10 Up to 10.0.19045.6937; Microsoft Windows 11 Up to 10.0.26200.7781; Microsoft Windows Server 2012 / 2016 / 2019 / 2022 / 2025 Various versions up to 10.0.26100.32313.
Is there a fix for CVE-2026-21525?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21525 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-21525?
Check whether you run Microsoft Windows. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference (CWE-476) exists in the Microsoft Windows Remote Access Connection Manager (rasman.dll). The vulnerability is triggered when the service improperly handles specific memory addresses, leading to a system crash (BSOD). The attack vector is local, requiring the attacker to execute code on the target system, though it does not require elevated privileges or user interaction. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Microsoft has released security updates to address this issue across supported versions of Windows and Windows Server.

Affected products

  • Microsoft Windows 10 Up to 10.0.19045.6937
  • Microsoft Windows 11 Up to 10.0.26200.7781
  • Microsoft Windows Server 2012 / 2016 / 2019 / 2022 / 2025 Various versions up to 10.0.26100.32313

Timeline

  • 2026-02-10: disclosed: Vulnerability disclosed by Microsoft
  • 2026-02-10: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-02-10: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.