What is the CVSS score of CVE-2026-21525?

CVE-2026-21525 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 3.4%.

Which versions of Microsoft are affected by CVE-2026-21525?

Organizations using Null pointer dereference in Windows Remote Access Connection Manager should be aware of moderate risk from CVE-2026-21525, a null pointer dereference vulnerability rated CVSS 6.2.. A patch is available.

Is CVE-2026-21525 being actively exploited?

Yes, CVE-2026-21525 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2026-21525?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Microsoft CVE-2026-21525

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-02-10 secure@microsoft.com

Null Pointer Dereference Denial Of Service Microsoft

6.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 30, 2026 - 13:28 cisa

CISA KEV

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

MEDIUM 6.2

DescriptionCVE.org

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

AnalysisAI

Windows Remote Access Connection Manager contains a null pointer dereference flaw affecting Windows 10 (versions 1809 and 21h2) and Windows 11 (version 23h2) that has been confirmed as actively exploited. A local attacker can trigger a denial of service condition without requiring authentication or user interaction. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Affects Windows 10 1607. Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.