CVE-2026-21525KEV · OVERDUECWE-476

Windows Remote Access Connection Manager Denial of Service Vulnerability

Medium · published February 10, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.2. It is confirmed in active exploitation. It sits in the 91.9th percentile for exploit probability.

235
days past CISA
deadline
CVSS v3.1
6.2
EPSS
5%
Percentile
91.9
In the wild
Confirmed
What it is

⚠️ A null pointer dereference in Windows Remote Access Connection Manager lets an attacker crash your service with a simple request — no special skills required! 🔥 Think of it like a restaurant where a customer spills water on the floor, causing everyone to slip and fall — a small action leading to a big mess! This vulnerability allows unauthorized users to trigger a denial of service, causing interruptions in your network access. If exploited, this vulnerability can lead to a denial of service, making your remote access capabilities temporarily unavailable. This means users could find themselves locked out of essential services, impacting productivity and disrupting workflows across your organization.

Put simply

Think of it like a restaurant where a customer spills water on the floor, causing everyone to slip and fall — a small action leading to a big mess! This vulnerability allows unauthorized users to trigger a denial of service, causing interruptions in your network access. This null pointer dereference occurs when the Remote Access Connection Manager attempts to access a null reference, leading to potential service crashes. An unauthorized attacker can trigger this through local access, resulting in a denial of service.

What to do

If exploited, this vulnerability can lead to a denial of service, making your remote access capabilities temporarily unavailable. This means users could find themselves locked out of essential services, impacting productivity and disrupting workflows across your organization. To remediate this, ensure you apply the latest security patches provided by Microsoft for Windows Remote Access Connection Manager. Review your system configurations to limit unauthorized access and monitor for unusual local activity. Make it part of your routine to keep your systems updated regularly. You've got this! Stay proactive and secure your systems, and you'll keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
6.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.04825 · 91.9th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-02-10T17:51Z
KEV added
2026-02-10 · due 2026-03-03
EPSS history
Timeline
  • 10 FEB 17:51Z
    Windows Remote Access Connection Manager Denial of Service Vulnerability
    cvelistv5
  • 10 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 3
    kev