CVE-2026-21525

MEDIUM(6.2)KEV

Microsoft Windows NULL Pointer Dereference Vulnerability

Description

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

KEV Information

Vendor
Microsoft
Product
Windows
Date Added
February 10, 2026
Due Date
March 3, 2026
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
2.5
Impact Score
3.6

CWEs

CWE-476NULL Pointer Dereference

NULL Pointer Dereference

Affected Products

VendorProductVersion
microsoftwindows 10 1607< 10.0.14393.8868
microsoftwindows 10 1809< 10.0.17763.8389
microsoftwindows 10 21h2< 10.0.19044.6937
microsoftwindows 10 22h2< 10.0.19045.6937
microsoftwindows 11 23h2< 10.0.22631.6649
microsoftwindows 11 24h2< 10.0.26100.7781
microsoftwindows 11 25h2< 10.0.26200.7781
microsoftwindows server 2012-; r2
microsoftwindows server 2016< 10.0.14393.8868
microsoftwindows server 2019< 10.0.17763.8389
microsoftwindows server 2022< 10.0.20348.4711
microsoftwindows server 2022 23h2< 10.0.25398.2149
microsoftwindows server 2025< 10.0.26100.32313

References

CVSS Score

6.2
MEDIUM(6.2)

EPSS Score

EPSS Score4.96%
EPSS Percentile91.3%

Dates

PublishedFebruary 10, 2026
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch