PT-2026-7407 · Microsoft · Windows

Published 2026-02-10 · Updated 2026-05-08 · CVE-2026-21525

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to February 10, 2026

Description A null pointer dereference exists in the Windows Remote Access Connection Manager (RasMan). This issue allows a local attacker to cause a denial-of-service by repeatedly crashing the VPN/remote-access service and disrupting connectivity. The vulnerability is actively exploited in the wild. The issue affects systems globally that utilize Windows for VPN and remote access. The vulnerability impacts the availability of the remote access service. Exploitation involves triggering the null pointer dereference within the RasMan component, leading to service crashes.

Recommendations Apply the February 10, 2026 updates to address this vulnerability. Monitor for abnormal RasMan service crashes to identify potential exploitation attempts.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2026-01698

CVE-2026-21525

Affected Products

Windows

References · 28

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21525 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21525 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01698 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21525 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-21525 · Security Note
• https://twitter.com/grok/status/2021423036188996056 · Twitter Post
• https://twitter.com/rahsi_aaka/status/2026963240853610678 · Twitter Post
• https://twitter.com/BleepinComputer/status/2021362440131547257 · Twitter Post
• https://t.me/avleonovcom/1631 · Telegram Post
• https://twitter.com/ThreatSynop/status/2021535007760679274 · Twitter Post
• https://vicarius.io/vsociety/posts/cve-2026-21525-detection-script-dos-vulnerability-in-windows-remote-access-connection-manager · Note
• https://twitter.com/ThreatSynop/status/2021732673241170233 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525 · Note
• https://twitter.com/mkolsek/status/2021367376399548446 · Twitter Post