OnlyPatch
Windows Remote Access Connection Manager

CVE-2026-21525 — Windows Remote Access Connection Manager Denial of Service Vulnerability

Moderate CVSS 6.2 EPSS 0.04956 ⚠️ Exploited in the wild 🔬 Patch diffed 2026-02 archive

Executive Summary

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Overview

6.2
CVSS MEDIUM
Moderate
MS Severity
Exploited
MS Exploit Status
Exploitation Detected
MS Exploit Likelihood
Category Denial of Service
Weakness CWE-476: NULL Pointer Dereference
Released Feb 10 2026
Last Updated Feb 10 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.04956 — 0.91271 percentile
NVD CVSS 6.2 MEDIUM — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
None
INTEGRITY
None
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 5.4

EPSS Score

0.04956
probability of exploitation in the next 30 days
0.91271 percentile - updated 2026-07-25
View on FIRST.org

Affected Products

23 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5075999 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 1607 for x64-based Systems 5075999 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 1809 for 32-bit Systems 5075904 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 1809 for x64-based Systems 5075904 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 21H2 for 32-bit Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 21H2 for ARM64-based Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 21H2 for x64-based Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 22H2 for 32-bit Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 22H2 for ARM64-based Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 10 Version 22H2 for x64-based Systems 5075912 (Security Update) Moderate Denial of Service Yes
Windows 11 Version 23H2 for ARM64-based Systems 5075941 (Security Update) Moderate Denial of Service Yes
Windows 11 Version 23H2 for x64-based Systems 5075941 (Security Update) Moderate Denial of Service Yes
Windows 11 Version 24H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Moderate Denial of Service 5073379 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.26100.7840 10.0.26100.7781 Yes None Windows 11 Version 24H2 for x64-based Systems 5077212 (Security Hotpatch Update) 5077181 (Security Update) Moderate Denial of Service 5074109 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.26100.7781 10.0.26100.7840 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Moderate Denial of Service 5074109 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 25H2 for x64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Moderate Denial of Service 5074109 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5077179 (Security Update) Moderate Denial of Service Yes
Windows 11 version 26H1 for x64-based Systems 5077179 (Security Update) Moderate Denial of Service Yes
Windows Server 2012 5075971 (Monthly Rollup) Moderate Denial of Service Yes
Windows Server 2012 (Server Core installation) 5075971 (Monthly Rollup) Moderate Denial of Service Yes
Windows Server 2012 R2 5075970 (Monthly Rollup) Moderate Denial of Service Yes
Windows Server 2012 R2 (Server Core installation) 5075970 (Monthly Rollup) Moderate Denial of Service Yes
Windows Server 2016 5075999 (Security Update) Moderate Denial of Service Yes
Windows Server 2016 (Server Core installation) 5075999 (Security Update) Moderate Denial of Service Yes
Windows Server 2019 5075904 (Security Update) Moderate Denial of Service Yes
Windows Server 2019 (Server Core installation) 5075904 (Security Update) Moderate Denial of Service Yes
Windows Server 2022 5075906 (Security Update) 5075943 (Security Hotpatch Update) Moderate Denial of Service 5073457 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022 (Server Core installation) 5075906 (Security Update) 5075943 (Security Hotpatch Update) Moderate Denial of Service 5073457 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5075897 (Security Update) Moderate Denial of Service Yes

Patches

8 patches
Article Type Restart
5075999 Security Update Yes
5075904 Security Update Yes
5075912 Security Update Yes
5075941 Security Update Yes
5077179 Security Update Yes
5075971 Monthly Rollup Yes
5075970 Monthly Rollup Yes
5075897 Security Update Yes

Patch Diff

ghidriff · rasman.dll (KB5077181)

Patch diff 10.0.26100.7309 -> 10.0.26100.7705 (RpcConnect shared-binding UAF; fix retired Feature_VPN_BugFixes_25B_Use_After_Free_Fix gate)

Pre-patch version 10.0.26100.7309
Post-patch version 10.0.26100.7705
Function Address Change Note
wil_details_FeatureReporting_ReportUsageToServiceDirect 180024eb4 -> 180024e54 code, length, sig, address similarity 0.43
Feature_VPN_BugFixes_25B_Use_After_Free_Fix__private_IsEnabledDeviceUsageNoInline 180024340 -> 1800242f0 code, length, address similarity 0.69
wil_details_FeatureReporting_ReportUsageToService 180024e30 -> 180024dd8 code, length, sig, address similarity 0.63
RpcConnect 180011e90 code, length, sig, called similarity 0.45
wil_details_IsEnabledFallback 180025258 -> 1800251f0 code, refcount, length, sig, address, calling similarity 0.48
wil_details_FeatureStateCache_TryEnableDeviceUsageFastPath 18002504c -> 180024ff4 code, length, sig, address similarity 0.4
View full diff report View RCA report Download PoC

Known Exploits

On This Page