Skip to main content

Microsoft CVE-2026-21525

MEDIUM
NULL Pointer Dereference (CWE-476)
2026-02-10 secure@microsoft.com
Denial Of Service Null Pointer Dereference Microsoft
6.2
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 6.2 (MEDIUM). Attack vector: Local. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Exploitable via remote/network. CISA KEV listed — actively exploited in the wild.
Exploit ScenarioDerived

A remote attacker without authentication could exploit this vulnerability to compromise the affected system.
This Month Plan within 30 days. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 3.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Windows Remote Access Connection Manager contains a null pointer dereference flaw affecting Windows 10 (versions 1809 and 21h2) and Windows 11 (version 23h2) that has been confirmed as actively exploited. A local attacker can trigger a denial of service condition without requiring authentication or user interaction. No patch is currently available for this vulnerability.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:02 CVSS 6.2

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally. [CVSS 6.2 MEDIUM] [CISA KEV - actively exploited]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_10_version_1607_10_0_14393_8868 fix: Windows 10 Version 1607 for 32-bit Systems 10.0.14393.8868, Windows 10 Version 1607 for x64-based Systems 10.0.14393.8868
microsoft windows_10_version_1809_10_0_17763_8389 fix: Windows 10 Version 1809 for 32-bit Systems 10.0.17763.8389, Windows 10 Version 1809 for x64-based Systems 10.0.17763.8389
microsoft windows_10_version_21h2_10_0_19044_6937 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.6937, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.6937, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.6937
microsoft windows_10_version_22h2_10_0_19045_6937 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.6937, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.6937, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.6937
microsoft windows_11_version_23h2_10_0_22631_6649 fix: Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.6649, Windows 11 Version 23H2 for x64-based Systems 10.0.22631.6649
microsoft windows_11_version_24h2_10_0_26100_7840 fix: Windows 11 Version 24H2 for ARM64-based Systems 10.0.26100.7840, Windows 11 Version 24H2 for x64-based Systems 10.0.26100.7840
microsoft windows_11_version_25h2_10_0_26200_7840 fix: Windows 11 Version 25H2 for ARM64-based Systems 10.0.26200.7840, Windows 11 Version 25H2 for x64-based Systems 10.0.26200.7840
microsoft windows_11_version_26h1_10_0_28000_1575 fix: Windows 11 Version 26H1 for ARM64-based Systems 10.0.28000.1575, Windows 11 version 26H1 for x64-based Systems 10.0.28000.1575
microsoft windows_server_2012_6_2_9200_25923 fix: Windows Server 2012 6.2.9200.25923, Windows Server 2012 (Server Core installation) 6.2.9200.25923
microsoft windows_server_2012_r2_6_3_9600_23022 fix: Windows Server 2012 R2 6.3.9600.23022, Windows Server 2012 R2 (Server Core installation) 6.3.9600.23022
microsoft windows_server_2016_10_0_14393_8868 fix: Windows Server 2016 10.0.14393.8868, Windows Server 2016 (Server Core installation) 10.0.14393.8868
microsoft windows_server_2019_10_0_17763_8389 fix: Windows Server 2019 10.0.17763.8389, Windows Server 2019 (Server Core installation) 10.0.17763.8389
microsoft windows_server_2022_10_0_20348_4773 fix: Windows Server 2022 10.0.20348.4773, Windows Server 2022 (Server Core installation) 10.0.20348.4773
microsoft windows_server_2022_23h2_edition_10_0_25398_2149 fix: Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2149
microsoft windows_server_2025_10_0_26100_32370 fix: Windows Server 2025 10.0.26100.32370, Windows Server 2025 (Server Core installation) 10.0.26100.32370

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 15 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-476 (NULL Pointer Dereference). Affects Windows 10 1607. Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Mar 30, 2026 - 13:28 cisa
CISA KEV
CVE Published
Feb 10, 2026 - 18:16 nvd
MEDIUM 6.2

DescriptionCVE.org

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Executive ViewAI

Why It Matters

Organizations using Null pointer dereference in Windows Remote Access Connection Manager should be aware of moderate risk from CVE-2026-21525, a null pointer dereference vulnerability rated CVSS 6.2. Exploitation could compromise the security of affected deployments. This vulnerability is actively exploited in the wild (KEV-listed). Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
3.4%
Top 13% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org CISA KEV EPSS VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV Yes
Public POC No
EPSS 3.4%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

84
Low Medium High Critical
KEV: +50
EPSS: +3
CVSS: +31
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
+ 3 more

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ADVISORY https://vuldb.com/?id.345298 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525 REF https://www.vicarius.io/vsociety/posts/cve-2026-21525-detection-script-dos-vulnerability-in-windows-remote-access-connection-manager REF https://www.vicarius.io/vsociety/posts/cve-2026-21525-mitigation-script-dos-vulnerability-in-windows-remote-access-connection-manager

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy