CISA KEV: Windows Remote Access Connection Manager NULL Pointer Dereference (CVE‑2026‑21525) Enables Local DoS
What It Is — A NULL‑pointer dereference flaw in the Windows Remote Access Connection Manager (RASMAN) can be triggered by a local, unauthenticated attacker to cause a denial‑of‑service condition.
Exploitability — The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating that attackers have observed active exploitation in the wild. No public exploit code is required; the attack works locally on a vulnerable system.
Affected Products — Microsoft Windows operating systems that include the Remote Access Connection Manager component (all supported Windows 10, Windows Server 2016‑2022 releases).
Why It Matters for Trust & Control Assurance
- Availability controls – A DoS event directly violates the control objective of maintaining system and service availability, a core requirement across frameworks such as NIST CSF 2.0 and ISO 27001.
- Patch management evidence – Demonstrating timely remediation (patch deployment, configuration hardening) provides defensible audit evidence that an organization is exercising due‑diligence.
- Continuous monitoring – Detecting exploitation attempts through endpoint telemetry feeds into a continuous‑control‑monitoring program, strengthening the trust posture demanded by enterprise buyers.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2026‑21525 immediately via your patch‑management system.
- Verify remediation on all endpoints using a trusted configuration‑assessment tool.
- Update your asset inventory to flag systems still running vulnerable RASMAN versions.
- Enable logging of RASMAN service failures and correlate with SIEM alerts for early detection of exploitation attempts.
Source: CISA KEV – CVE‑2026‑21525