Microsoft has released an emergency security update, designated KB5084597, to address critical remote code execution vulnerabilities affecting Windows 11. The out-of-band hotpatch, issued on March 13, 2026, specifically targets devices enrolled in the hotpatch program and running Windows 11 versions 24H2, 25H2, and Windows 11 Enterprise LTSC 2024. This update comes shortly after the broader March 2026 Patch Tuesday release, which addressed the same vulnerabilities for standard Windows 11 installations. The urgency of this hotpatch highlights the severity of the security flaws and Microsoft’s commitment to rapid response in protecting its users.
The vulnerabilities, identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, reside within the Windows Routing and Remote Access Service (RRAS) management tool. According to Microsoft’s advisory, a successful exploit could allow an attacker who is already authenticated on the domain to execute arbitrary code on affected systems. This is achieved by tricking a domain-joined user into sending a request to a malicious server through the RRAS snap-in. The potential impact underscores the importance of applying this update promptly, particularly for organizations relying on RRAS for remote access and network management. The vulnerabilities were first addressed in the March 10 Patch Tuesday release, but the hotpatch ensures immediate protection for systems configured to receive them without requiring a reboot.
Understanding the Threat: Remote Code Execution in RRAS
Remote code execution (RCE) vulnerabilities are among the most critical security threats facing computer systems today. An RCE allows an attacker to take complete control of a compromised device, potentially installing malware, stealing sensitive data, or disrupting critical operations. In the case of these RRAS vulnerabilities, the attack vector requires an attacker to already have some level of access to the domain. Though, the ability to then execute code remotely significantly expands the potential damage. The RRAS service itself is a core component of Windows Server, enabling remote access, VPN connectivity, and network routing. Compromising this service could have cascading effects across an entire network infrastructure.
The specific vulnerabilities lie within the way RRAS handles requests through its management snap-in. The Microsoft Security Response Center (MSRC) details that an attacker can exploit these flaws by crafting a malicious request that, when processed by the RRAS snap-in, leads to the execution of unauthorized code. While the attacker needs to be authenticated, this doesn’t necessarily require high-level privileges, making the attack surface potentially broad within an organization. The MSRC advisory provides technical details about the vulnerabilities, including Common Vulnerability Scoring System (CVSS) scores, which indicate the severity and exploitability of each flaw. The Microsoft Security Response Center website is a valuable resource for staying informed about the latest security threats, and updates.
Hotpatch vs. Traditional Updates: A Critical Difference
Microsoft’s decision to release a hotpatch alongside the standard Patch Tuesday update highlights the benefits of this newer patching mechanism. Traditional cumulative updates, while comprehensive, typically require a system reboot to fully apply the fixes. This downtime can be disruptive, especially for mission-critical servers and systems that demand to remain online continuously. Hotpatch updates, leverage in-memory patching to apply fixes without requiring a reboot. This allows for immediate protection against vulnerabilities without interrupting ongoing operations.
The hotpatch process involves applying the vulnerability fixes directly to running processes, effectively patching the system in real-time. These changes are also written to disk, ensuring that the fixes persist even after a subsequent reboot. This approach is particularly valuable for organizations that manage large deployments of Windows devices and need to minimize downtime. The hotpatch program is currently available for Windows 11 Enterprise and Education editions and is managed through Windows Autopatch. Microsoft’s documentation on hotpatching provides detailed information about the program and its requirements.
Who is Affected and How to Apply the Update
The KB5084597 hotpatch applies specifically to Windows 11 Enterprise devices enrolled in the hotpatch update program. This includes devices running Windows 11 versions 24H2 and 25H2, as well as Windows 11 Enterprise LTSC 2024. Devices not enrolled in the hotpatch program received the fixes through the standard March 10, 2026, Patch Tuesday cumulative update. For organizations utilizing Windows Autopatch, the hotpatch will be deployed automatically without requiring any manual intervention. This streamlined deployment process is a key benefit of the hotpatch program, ensuring that critical security updates are applied quickly and efficiently.
Administrators can verify that the hotpatch has been applied by checking the installed updates list in Windows Update settings. The update will be listed as “March 13, 2026—Hotpatch KB5084597.” It’s significant to note that this is a cumulative update, meaning it includes all previous fixes and improvements. Installing KB5084597 will also ensure that systems are up-to-date with all other security patches released in March 2026. Microsoft recommends that all eligible devices install the update as soon as possible to mitigate the risk of exploitation. Regularly checking for and applying security updates is a fundamental best practice for maintaining a secure computing environment.
Key Takeaways
- Critical Vulnerabilities: Three remote code execution vulnerabilities were discovered in the Windows Routing and Remote Access Service (RRAS).
- Hotpatch Deployment: Microsoft released an out-of-band hotpatch (KB5084597) for devices enrolled in the hotpatch program, offering immediate protection without a reboot.
- Affected Systems: The update applies to Windows 11 versions 24H2, 25H2, and Windows 11 Enterprise LTSC 2024.
- Automatic Updates: Devices managed through Windows Autopatch will receive the update automatically.
- Importance of Patching: Promptly applying security updates is crucial to protect against potential attacks and maintain system security.
Microsoft has indicated that it previously released hotfixes for these vulnerabilities, but re-released KB5084597 to ensure comprehensive coverage across all affected scenarios. This proactive approach demonstrates Microsoft’s dedication to addressing security concerns and protecting its user base. The company continues to monitor for any further exploits and will provide updates as needed. Staying informed about the latest security threats and updates is essential for maintaining a secure digital environment.
Looking ahead, users should continue to prioritize regular security updates and maintain a robust security posture. The next scheduled Patch Tuesday release is slated for April 9, 2026, where Microsoft is expected to address additional vulnerabilities and provide further security enhancements. For more information about Windows security and updates, please visit the Microsoft Security Response Center website. We encourage readers to share their experiences and insights in the comments below.
Keep reading