Cyber Posture

CVE-2026-21243

High

Published: 10 February 2026

Published
10 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0009 25.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21243 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Microsoft Windows Server 2019. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Null pointer dereference in Windows LDAP enables remote exploitation causing service crash or resource exhaustion (T1499.004: Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

Deeper analysisAI

CVE-2026-21243 is a null pointer dereference vulnerability (CWE-476) in the Windows LDAP (Lightweight Directory Access Protocol) component. Published on 2026-02-10T18:16:25.480, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for remote denial-of-service impact.

An unauthorized attacker can exploit this vulnerability over a network with low attack complexity, requiring no privileges, user interaction, or special scoping changes. Exploitation triggers a null pointer dereference, enabling the attacker to cause a denial of service, such as service crashes or resource exhaustion, without compromising confidentiality or integrity.

Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21243 details available patches and recommended mitigation steps for affected Windows systems.

Details

CWE(s)

Affected Products

microsoft
windows server 2019
≤ 10.0.17763.8389
microsoft
windows server 2022
≤ 10.0.20348.4711
microsoft
windows server 2022 23h2
≤ 10.0.25398.2149
microsoft
windows server 2025
≤ 10.0.26100.32313

CVEs Like This One

CVE-2026-32071Same product: Microsoft Windows Server 2019
CVE-2026-21525Same product: Microsoft Windows Server 2019
CVE-2026-20875Same product: Microsoft Windows Server 2019
CVE-2025-21285Same product: Microsoft Windows Server 2019
CVE-2025-21218Same product: Microsoft Windows Server 2019
CVE-2026-26154Same product: Microsoft Windows Server 2019
CVE-2025-21330Same product: Microsoft Windows Server 2019
CVE-2025-21207Same product: Microsoft Windows Server 2019
CVE-2026-33096Same product: Microsoft Windows Server 2022
CVE-2025-21351Same product: Microsoft Windows Server 2019

References