Microsoft rushed out critical patches on February 10, 2026, for a zero-day vulnerability in the Windows Remote Access Connection Manager (RasMan) service.
Tracked as CVE-2026-21525, this flaw is actively exploited in the wild, letting attackers crash systems and disrupt remote connections.
RasMan handles remote access features like VPNs and dial-up, making it vital for networked environments.
The bug stems from a null pointer dereference (CWE-476), where the service tries to read a nonexistent memory address, think of a GPS app directing a driver to a blank location, causing the whole navigation to freeze.
Attackers with local access (no admin rights needed) can trigger repeated crashes, halting RasMan and knocking out remote sessions.
This creates a denial-of-service (DoS) scenario, potentially sidelining servers or disconnecting users from critical networks.
While it doesn’t allow code execution or data theft, the “High” availability impact makes it a real threat for enterprises.
Microsoft’s disclosure confirms exploitation, crediting the 0patch research team for discovery. The CVSS score sits at 6.2 (Base)/5.4 (Temporal), rated Moderate overall but serious for uptime-dependent ops.
| Metric | Detail |
|---|---|
| CVE ID | CVE-2026-21525 |
| Vulnerability Name | Windows Remote Access Connection Manager Denial of Service Vulnerability |
| Release Date | Feb 10, 2026 |
| Impact | Denial of Service (DoS) |
| Max Severity | Moderate |
| Weakness | CWE-476: NULL Pointer Dereference |
| CVSS Score | 6.2 (Base) / 5.4 (Temporal) |
| Attack Vector | Local |
| Privileges Required | None |
Affected systems span Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Servers (2012, 2016, 2019, 2022, 2025). No workarounds exist; admins must deploy patches via Windows Update immediately.
A local user crafts malformed input to RasMan, forcing a null pointer read. The service dereferences it, triggering an unhandled exception and crash.
Restarting RasMan restores service temporarily, but repeated attacks sustain the DoS. Tools like fuzzers likely aided discovery, probing RasMan’s RPC interfaces.
- Run Windows Update and install the February 10 patch.
- Monitor Event Logs for RasMan crashes (Event ID 7024).
- Limit local logons on servers via Group Policy.
- Use endpoint detection to flag suspicious RasMan interactions.
This zero-day highlights RasMan’s long-standing exposure to past flaws like CVE-2021-24087, which also targeted it.
With attacks ongoing, unpatched systems risk outages. Microsoft urges priority deployment; check MSRC for details.
Stay vigilant, zero-days like this remind us that patching beats perfect security.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1)%20(1).webp?fit=1600,900&ssl=1&description=Tracked as CVE-2026-21525, this flaw is actively exploited in the wild, letting attackers crash systems and disrupt remote connections.){kind=link}