CVE-2026-21525

**CVE-2026-21525: Windows Remote Access Connection Manager NULL Pointer Dereference** The Remote Access Connection Manager service in Microsoft Windows contains a NULL pointer dereference flaw that allows a local attacker to crash the service and deny access to remote connections. An attacker with local system access can trigger this condition without authentication, disrupting VPN and dial-up connectivity for affected systems. **Actions for your SOC:** - Patch Windows systems immediately once Microsoft releases a security update for this CVE - Monitor for unexpected crashes or restarts of the Remote Access Connection Manager service (rasman.exe) as a detection indicator - Restrict local administrative access and enforce privilege boundaries to limit who can interact with the Remote Access Connection Manager API - If patching is delayed, consider disabling remote access services on systems that don't require them