CVE-2026-21525

CVE-2026-21525 is a null pointer dereference (CWE-476) in the Windows Remote Access Connection Manager (RasMan) component that can be triggered by an unauthorized attacker with local access to an affected machine, without valid credentials or user interaction. Triggering the flaw crashes the service or system, yielding a high-availability-impact denial of service with no confidentiality or integrity loss. Any organization running the affected Windows 10, Windows 11, or Windows Server builds is in scope, because the vulnerable component ships as part of the operating system. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-10, confirming active in-the-wild exploitation, and it was among the 59 fixes (including six actively exploited zero-days) in Microsoft's February 2026 Patch Tuesday. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile); no public proof-of-concept code is known.

What to do: Deploy the February 2026 Patch Tuesday Windows security updates to all affected Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2012/2016/2019/2022/2022 23H2 systems; organizations bound by CISA BOD 22-01 must remediate within the required timeline or apply vendor mitigations. Because the attack vector is local and no public PoC or documented workaround exists, patching is the primary mitigation — prioritize multi-user servers, remote-access/VDI hosts, and shared endpoints, and confirm deployment through your patch-management reporting.