Is CVE-2026-21525 (Microsoft Windows NULL Pointer Dereference) being exploited in the wild?

Yes. CISA added CVE-2026-21525 to its Known Exploited Vulnerabilities catalogue on 10 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

What being in KEV means for this Windows CVE

For this CVE, the practical signal is not the weakness name alone, but the fact that CISA has already listed it in KEV. That means defenders should treat it as actively exploited, not hypothetical, and prioritise exposure checks and remediation work accordingly. For a Windows denial-of-service flaw, the first question is whether the affected component is present and reachable on systems that matter.

Exposure assessment should focus on the Windows estate that can invoke Remote Access Connection Manager functions, then narrow to systems that are internet-facing, user-reachable, or operationally sensitive. The Zero-Day and Exploited Vulnerabilities Guide is useful here because it frames KEV as a triage signal, not just a catalog entry. For teams managing broad vulnerability volume, Vulnerability Management Guide gives the prioritisation logic that should govern the next steps.

Because the direct impact described is denial of service, the immediate operational concern is service disruption rather than silent data theft. That changes the response posture: availability owners, endpoint teams, and incident response should all care if the affected Windows service is on a critical path or on systems that support remote connectivity, authentication workflows, or remote administration.

How to confirm whether you are exposed

Confirming exposure starts with inventory, not scanning in the abstract. Identify Windows hosts that run the affected component, then determine whether the vulnerable path is actually enabled in your environment and whether it can be exercised by local users or by software with local execution on the machine. For many organisations, the real risk is not every endpoint, but the subset that is operationally exposed and hard to replace quickly.

Check whether your patch and asset records can map the CVE to specific device groups, service roles, or remote access fleets. If you already maintain a KEV-based workflow, this is the point where you should mark the asset as priority remediation and track the exception explicitly if it cannot be fixed immediately. CISA Known Exploited Vulnerabilities Catalog should be the authoritative source for the remediation expectation, while the CVE Program remains the canonical identifier reference.

If you need a severity lens for prioritisation, use exploitability context rather than only the weakness name. CISA listing means exploitation evidence has already crossed the threshold that matters for emergency operations, even when the vulnerability is not remote code execution or credential theft.

What to do if patching cannot happen immediately

When immediate remediation is not possible, the goal is to reduce reachable exposure and preserve the ability to detect abuse. For a local denial-of-service issue, that usually means limiting which users and processes can interact with the vulnerable host, reducing unnecessary interactive access, and tightening operational monitoring around crashes, service restarts, or unusual error spikes.

Document the compensating control and the expiry date for the exception. If the service is critical, treat the exception as a business continuity decision, not just a security waiver. A temporary mitigation that is not measurable or reviewable tends to become a long-term exposure, especially when the business does not see the issue as a confidentiality breach.

Where the vulnerable component supports remote work or admin access, evaluate whether endpoint hardening or access reduction can shrink blast radius while you wait for the vendor fix. If the asset cannot be safely isolated, then the exception itself becomes part of the risk record and should be owned by the service manager, not only by vulnerability operations.

Risk and Threat Considerations

Actively exploited Windows flaws matter because even a local denial-of-service condition can be used to degrade availability, create noisy incident load, or disrupt a control plane that other systems depend on. In practice, attackers often prefer weaknesses that are easy to trigger, low in complexity, and useful for creating operational friction before or during a broader intrusion.

Failure mechanism: An attacker or local malicious user can trigger the NULL pointer dereference in the Remote Access Connection Manager path, causing the affected process or service to fail and interrupt normal Windows operation.

Impact: The likely result is denial of service on the affected system, which can interrupt connectivity, remote access functions, or any dependent business workflow that relies on that host being available.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Tracks vulnerable assets so KEV-listed exposure can be prioritized.
	PR.PS-01 — Configuration Management	Supports reducing attack surface on affected Windows systems.
	DE.CM-01 — Networks and Services Monitored	Covers monitoring for service disruption and abnormal behavior after exploitation.
Recommendation — Inventory exposed Windows hosts and prioritize remediation for systems running the vulnerable component. Restrict and harden the affected service path until patching is complete. Monitor affected Windows services for crashes, restarts, and availability anomalies.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Directly governs timely remediation of exploited software flaws.
	CM-7 — Least Functionality	Reduces exposure by limiting unnecessary service capability on affected systems.
	AU-6 — Audit Record Review, Analysis, and Reporting	Supports detection of exploitation symptoms and service disruption evidence.
Recommendation — Prioritize remediation of the KEV-listed vulnerability on all exposed Windows hosts. Disable or restrict the vulnerable component where operationally feasible. Review logs for crashes, restarts, and related anomalies on affected systems.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Directly applies to prioritizing and remediating KEV-listed exposures.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Supports hardening and reducing exposure on affected Windows endpoints.
Recommendation — Use KEV status to drive urgent scanning, remediation, and exception tracking. Harden the affected Windows service path and remove unnecessary exposure.

Practitioner Guidance

What to prioritise: Treat KEV status as the sorting rule. Fix hosts that are exposed, business-critical, or difficult to recover first, and do not spend cycles debating theoretical exploitability once CISA has already confirmed active exploitation.

What to verify: Verify not only that the patch is deployed, but that the affected Windows component is no longer reachable in the operational path you care about. For availability issues, a clean patch record is not enough if the service is still deployed on fragile or high-dependency systems.

Common mistake: Teams often underestimate denial-of-service CVEs because they do not obviously imply data theft. In reality, availability loss can be enough to trigger incident response, service degradation, or a chained operational outage.

Practitioner takeaway: For KEV-listed Windows flaws, the decision point is speed of exposure reduction, not certainty of local impact in every environment. If the host matters to operations, remediate or isolate it as though exploitation is already part of the threat model.