Microsoft has launched an out-of-band (OOB) replace to repair a safety vulnerabilities affecting Home windows 11 Enterprise units that obtain hotpatch updates as an alternative of the common Patch Tuesday cumulative updates.
The KB5084597 hotpatch replace was launched yesterday to repair vulnerabilities within the Home windows Routing and Distant Entry Service (RRAS) administration instrument that would enable distant code execution when connecting to a malicious server.
“Microsoft has recognized a safety subject within the Home windows Routing and Distant Entry Service (RRAS) administration instrument that would enable distant code execution when connecting to a malicious server,” reads an advisory from Microsoft.
“This subject solely applies to a restricted set of eventualities involving Enterprise consumer units working hotpatch updates and getting used for distant server administration.”
The KB5084597 replace is for Home windows 11 variations 25H2 and 24H2, in addition to Home windows 11 Enterprise LTSC 2024 methods.
Microsoft says the vulnerabilities mounted by this hotpatch are tracked as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, which have been mounted as a part of the March 2026 Patch Tuesday updates.
“An attacker authenticated on the area might exploit this vulnerability by tricking a domain-joined person into sending a request to a malicious server by way of the Routing and Distant Entry Service (RRAS) Snap-in,” reads the outline for all three flaws.
The corporate says the hotpatch replace is cumulative and consists of all fixes and enhancements from the March 2026 Home windows safety replace launched on March 10.
Whereas the vulnerabilities have been already mounted on Patch Tuesday, putting in cumulative updates requires units to be rebooted. Nevertheless, some units are used for mission-critical purposes and providers that can’t be simply rebooted.
To guard a lot of these units, hotpatch updates apply new vulnerability fixes by performing in-memory patching of working processes to ship fixes. On the identical time, they replace the information on disk in order that the subsequent time the system reboots, the fixes are nonetheless current.
Microsoft says it beforehand launched hotfixes for these flaws, however re-released them yesterday “guarantee complete protection throughout all affected eventualities.”
Nevertheless, Microsoft says the hotpatch will solely be supplied to units enrolled within the hotpatch replace program and managed by way of Home windows Autopatch, the place it is going to be put in routinely with out requiring a restart.
Malware is getting smarter. The Pink Report 2026 reveals how new threats use math to detect sandboxes and conceal in plain sight.
Obtain our evaluation of 1.1 million malicious samples to uncover the highest 10 strategies and see in case your safety stack is blinded.
