Windows Remote Access Connection Manager Denial of Service Vulnerability

published 2026-02-10 8 mo ago modified 2026-08-19 2 mo ago also EUVD-2026-7329

cvss: 6.2; version 3.1, CNA
cisa kev: Exploited; added 2026-02-10
epss: 5.0%; EPSS 5.0% chance of exploitation in 30 days, percentile 92%
public exploits: 0; none known

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

fixed in 21 links 1

Microsoft Windows 10 Version 1607 10.0.14393.8868
Microsoft Windows 10 Version 1809 10.0.17763.8389
Microsoft Windows 10 Version 21H2 10.0.19044.6937
Microsoft Windows 10 Version 22H2 10.0.19045.6937
Microsoft Windows 11 version 22H3 10.0.22631.6649
Microsoft Windows 11 Version 23H2 10.0.22631.6649
Microsoft Windows 11 Version 24H2 10.0.26100.7840
Microsoft Windows 11 Version 25H2 10.0.26200.7840
Microsoft Windows 11 version 26H1 10.0.28000.1575
Microsoft Windows Server 2012 6.2.9200.25923
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.25923
Microsoft Windows Server 2012 R2 6.3.9600.23022
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.23022
Microsoft Windows Server 2016 10.0.14393.8868
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.8868
Microsoft Windows Server 2019 10.0.17763.8389
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.8389
Microsoft Windows Server 2022 10.0.20348.4773
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2149
Microsoft Windows Server 2025 10.0.26100.32370
Microsoft Windows Server 2025 (Server Core installation) 10.0.26100.32370

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 advisory

Timeline

2026-02-10 Added to CISA KEV
2026-02-10 Published
2026-02-11 CISA SSVC: exploitation active
2026-03-03 CISA patch deadline

Known exploited

Added: 8 mo ago (2026-02-10)
Patch by: 2026-03-03 (8 mo ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product: Microsoft, Windows
CISA name: Microsoft Windows NULL Pointer Dereference Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-11)

Exploit prediction

5.04% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
CNA	3.1	6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Microsoft Windows 10 Version 1607
Microsoft Windows 10 Version 1809
Microsoft Windows 10 Version 21H2
Microsoft Windows 10 Version 22H2
Microsoft Windows 11 version 22H3
Microsoft Windows 11 Version 23H2
Microsoft Windows 11 Version 24H2
Microsoft Windows 11 Version 25H2
Microsoft Windows 11 version 26H1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 (Server Core installation)
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012 R2 (Server Core installation)
Microsoft Windows Server 2016
Microsoft Windows Server 2016 (Server Core installation)
Microsoft Windows Server 2019
Microsoft Windows Server 2019 (Server Core installation)
Microsoft Windows Server 2022
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation)
Microsoft Windows Server 2025
Microsoft Windows Server 2025 (Server Core installation)

Classification

Weakness

CWE-476 NULL Pointer Dereference

References

msrc.microsoft.com /update-guide/vulnerability/CVE-2026-21525
vendor-advisory, patch
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525
government-resource, us-government-resource
vicarius.io /vsociety/posts/cve-2026-21525-detection-script-dos-vulnerability-in-windows-remote-access-connection-manager
third-party-advisory
vicarius.io /vsociety/posts/cve-2026-21525-mitigation-script-dos-vulnerability-in-windows-remote-access-connection-manager
mitigation, third-party-advisory

Sources

CVE List CVE-2026-21525
NVD CVE-2026-21525

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary