Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-21525

Microsoft Windows NULL Pointer Dereference Vulnerability

6.2
CVSS 3.1
1
story
FEB 10
added to KEV
Severity
6.2 Medium · vendor score
Vendor
Microsoft
Product
Windows
Published
Feb 10, 2026
Added to KEV
Feb 10, 2026
KEV deadline
Mar 3, 2026
Ransomware use
Unknown
Weakness
CWE-476

What it is

Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525Fixvicarius.io/vsociety/posts/cve-2026-21525-mitigation-script-dos-vulnerability-in-windows-remote-access-connection-managerAnalysisvicarius.io/vsociety/posts/cve-2026-21525-detection-script-dos-vulnerability-in-windows-remote-access-connection-manager