Update Windows Now: An Actively Exploited Flaw Is Crashing VPN Connections

In its latest security update, Microsoft fixed a vulnerability that should get every remote worker's attention: CVE-2026-21525, a flaw in the Windows Remote Access Connection Manager (RasMan) — the system service that manages VPN and dial-up connections. Microsoft confirms it is being actively exploited in the wild.

The bug is a NULL pointer dereference: by sending malformed input during connection negotiation, an attacker can crash the RasMan service. When RasMan dies, VPN connections drop with it — knocking out remote access and, depending on your setup, leaving traffic to continue over the unprotected connection.

The 2-Minute Fix

Why a Crashing VPN Is a Privacy Problem, Not Just an Annoyance

Most people think of a dropped VPN as an inconvenience — reconnect and move on. Security-wise, it's worse than that. The dangerous moment is the gap: your apps keep talking to the internet the instant the tunnel dies, and without protection those requests travel unencrypted with your real IP address. On a hostile network — public Wi-Fi, a compromised router — an attacker who can crash your VPN can effectively strip your protection on demand.

That's exactly what a kill switchexists for. It's a hard rule on your device: no VPN, no traffic. The crash still happens, but nothing leaks. If you take one habit away from this story, it's enabling the kill switch on every device — it turns a whole class of attacks and accidents into non-events.

Part of a Bigger Pattern

This patch lands in the same week that a CitrixBleed-style flaw in NetScaler VPN gateways came under active attack, and as VPN/edge exploitation hits 22% of all initial-access breaches. Attackers have decided the connective tissue of remote work — VPN services, gateways, and the software that manages them — is the softest target of 2026. We covered the full VPN attack wave here.

Frequently Asked Questions