cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Microsoft Releases No-Reboot Hotpatch for Windows RRAS RCE Flaws

· Original article ↗

Summary

Microsoft’s KB5084597 hotpatch addresses three RRAS RCE flaws on certain Windows 11 Enterprise devices. It applies fixes in memory without a restart and is automatically delivered to eligible Windows Autopatch devices.

Key points

  • KB5084597 addresses CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 in the Windows Routing and Remote Access Service (RRAS) management tool.
  • The vulnerabilities affect specified Windows 11 Enterprise systems, including versions 25H2 and 24H2 and Enterprise LTSC 2024.
  • An attacker authenticated on the domain could exploit the flaws by tricking a domain-joined user into sending a request to a malicious server through the RRAS snap-in.
  • Microsoft says the flaws were already fixed in the March 2026 Patch Tuesday updates; the out-of-band hotpatch is intended for eligible devices that cannot easily be rebooted.
  • Hotpatching applies fixes to running processes in memory and updates files on disk so the fixes remain after a later reboot.
  • The hotpatch is automatically installed only on devices enrolled in the hotpatch program and managed through Windows Autopatch.

Article Details

Vulnerability Types
  • Remote code execution
Affected Versions
  • Windows 11 25H2
  • Windows 11 24H2
  • Windows 11 Enterprise LTSC 2024
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-25172Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreThe cumulative hotpatch (covering CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) applies in-memory fixes to avoid reboots and is automatically delivered to devices enrolled in the Windows Autopatch hotpatch program.CVE-2026-25173Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreThe cumulative hotpatch (covering CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) applies in-memory fixes to avoid reboots and is automatically delivered to devices enrolled in the Windows Autopatch hotpatch program.CVE-2026-26111Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +19 moreThe cumulative hotpatch (covering CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) applies in-memory fixes to avoid reboots and is automatically delivered to devices enrolled in the Windows Autopatch hotpatch program.

Vendors

MicrosoftMicrosoft released an out-of-band hotpatch, KB5084597, to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise devices.

Products

Windows 11Microsoft released an out-of-band hotpatch, KB5084597, to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise devices.Windows AutopatchThe cumulative hotpatch (covering CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111) applies in-memory fixes to avoid reboots and is automatically delivered to devices enrolled in the Windows Autopatch hotpatch program.Windows Routing and Remote Access Service (RRAS)Microsoft released an out-of-band hotpatch, KB5084597, to fix remote code execution vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool affecting certain Windows 11 Enterprise devices.

Related Articles