CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability (Pentest Lab Guide)

CVE-2026-21525: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-23T17:27:43.006Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

Context preserved from previous revision: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally. 1. Use only isolated environments and systems you own or are explicitly authorized to test.

Technical Details

CVE: CVE-2026-21525
KEV date added: 2026-02-10
KEV due date: 2026-03-03
NVD published: 2026-02-10
NVD modified: 2026-02-11
MITRE modified: 2026-03-16
CVSS base score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS exploitability score: 2.5
CVSS impact score: 3.6
Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: None
Availability impact: High

Versions and Products Impacted

microsoft / windows 10 1607 (versions: < 10.0.14393.8868)
microsoft / windows 10 1809 (versions: < 10.0.17763.8389)
microsoft / windows 10 21h2 (versions: < 10.0.19044.6937)
microsoft / windows 10 22h2 (versions: < 10.0.19045.6937)
microsoft / windows 11 23h2 (versions: < 10.0.22631.6649)
microsoft / windows 11 24h2 (versions: < 10.0.26100.7781)
microsoft / windows 11 25h2 (versions: < 10.0.26200.7781)
microsoft / windows server 2012
microsoft / windows server 2012 (versions: r2)
microsoft / windows server 2016 (versions: < 10.0.14393.8868)
microsoft / windows server 2019 (versions: < 10.0.17763.8389)
microsoft / windows server 2022 (versions: < 10.0.20348.4711)
microsoft / windows server 2022 23h2 (versions: < 10.0.25398.2149)
microsoft / windows server 2025 (versions: < 10.0.26100.32313)
Microsoft / Windows 10 Version 1607 (versions: 10.0.14393.0)
Microsoft / Windows 10 Version 1809 (versions: 10.0.17763.0)
Microsoft / Windows 10 Version 21H2 (versions: 10.0.19044.0)
Microsoft / Windows 10 Version 22H2 (versions: 10.0.19045.0)
Microsoft / Windows 11 version 22H3 (versions: 10.0.22631.0)
Microsoft / Windows 11 Version 23H2 (versions: 10.0.22631.0)

Weakness Classification

CWE-476

Repositories for Lab Validation (Public Examples)

ekomsSavior/Cerberus | stars: 15 | updated: 2026-03-13 | https://github.com/ekomsSavior/Cerberus
Notes: Cerberus-CVE Assessment Situation
greenido/CISA-alerts-bot | stars: 0 | updated: 2026-02-13 | https://github.com/greenido/CISA-alerts-bot
Notes: A stateless GitHub Action that monitors Cybersecurity Alerts and sends structured alerts to Slack / Telegram

People and Organizations Mentioned

microsoft
Windows
ekomsSavior
greenido

Practical Defensive Validation (Authorized Only)

Use only isolated environments and systems you own or are explicitly authorized to test.
Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
Inventory microsoft / windows 10 1607 (versions: < 10.0.14393.8868) assets and confirm exact vulnerable versions with automated checks.
Patch in staged environments and validate closure with scanners + service health checks.
Map detections to MITRE ATT&CK tactics relevant to your environment and tune alert quality.

References

NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-21525
MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2026-21525
CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
KEV notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525
Repository example: https://github.com/ekomsSavior/Cerberus
Repository example: https://github.com/greenido/CISA-alerts-bot

This content is for defensive security training and authorized validation only.