Microsoft Deploys OOB Hotpatch to Neutralize RRAS RCE Threat

Microsoft has issued an out‑of‑band (OOB) hotpatch update to address critical vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool. The flaws, tracked as CVE‑2026‑25172, CVE‑2026‑25173, and CVE‑2026‑26111, could allow attackers to achieve remote code execution (RCE) by tricking domain‑joined users into connecting to malicious servers.

What’s New in KB5084597

• Scope: Applies to Windows 11 versions 25H2, 24H2, and Enterprise LTSC 2024 systems enrolled in the hotpatch program.
• Delivery method: Hotpatching updates processes in memory without requiring a reboot, while also updating files on disk for persistence after restart.
• Coverage: Includes all fixes from the March 2026 Patch Tuesday cumulative update, ensuring comprehensive protection.
• Targeted scenario: Enterprise client devices used for remote server management that cannot afford downtime.

Why Hotpatch Matters

• Mission‑critical systems: Traditional cumulative updates require reboots, which can disrupt services.
• Continuous protection: Hotpatching allows vulnerabilities to be fixed instantly without downtime.
• Resilience: Ensures fixes remain in place after the next reboot, combining immediate defense with long‑term stability.

Risk Profile

• Attack vector: Authenticated domain attackers can exploit RRAS Snap‑in requests to malicious servers.
• Impact: Remote code execution, privilege escalation, and potential lateral movement in enterprise environments.
• Urgency: While already patched in March’s cumulative update, hotpatch ensures no reboot gap for high‑availability systems.

Defensive Recommendations

• Apply KB5084597 immediately on eligible devices enrolled in the hotpatch program.
• Verify Autopatch enrollment to ensure automatic installation.
• Audit RRAS usage: Limit exposure by restricting access to trusted servers.
• Monitor for exploitation attempts: Watch for suspicious RRAS Snap‑in activity.

Final Thought

This release highlights Microsoft’s evolving approach to zero‑downtime patching. By leveraging hotpatch technology, enterprises can protect mission‑critical systems against RCE threats without sacrificing availability. For defenders, the lesson is clear: patch speed and uptime are no longer trade‑offs — hotpatching delivers both.