Microsoft ships out-of-band Windows 11 hotpatch KB5084597 for RRAS RCE flaws
KB5084597 hotpatches three RRAS management tool RCE flaws (CVE-2026-25172, -25173, -26111) on Windows 11 Enterprise without a reboot. Who gets it and why.
On 13 March 2026 Microsoft released KB5084597, an out-of-band hotpatch for Windows 11 Enterprise devices that fixes three remote code execution flaws in the Routing and Remote Access Service (RRAS) management tool. The fixes had already shipped in that week's Patch Tuesday. The out-of-band release exists because hotpatch devices follow a different schedule, which makes it a useful case study in how no-reboot patching works and where its gaps are.
What happened
The March 2026 Patch Tuesday (10 March) fixed CVE-2026-25172, CVE-2026-25173 and CVE-2026-26111 in the RRAS management snap-in. Microsoft describes the attack this way: if the management tool connects to a malicious remote server, the attacker could disrupt it or run code on the admin's device. Microsoft's guidance frames it as an authenticated domain user getting a domain-joined admin to send a request to an attacker-controlled server through the RRAS snap-in.
Devices on the standard monthly cumulative update got the fix on Patch Tuesday, but that required a reboot. Devices enrolled in hotpatch, which patches running processes in memory and only takes a full baseline update with a reboot every few months, needed a separate package. KB5084597 moves those devices to OS builds 26200.7982 (25H2) and 26100.7982 (24H2). It includes the March security fixes and installs without a restart. heise reported that Microsoft later re-released the hotpatches to cover all affected scenarios and asked customers to apply the updated versions.
Who is affected
- Windows 11 Enterprise 24H2 and 25H2, and Windows 11 Enterprise LTSC 2024 devices enrolled in hotpatch and managed through Windows Autopatch. They get KB5084597 automatically through Windows Update. It isn't published to the Update Catalog or WSUS.
- In practice, the devices at risk are admin workstations that use the RRAS management tools to manage remote VPN or routing servers.
- Devices on standard monthly updates need no extra action beyond the March cumulative update.
What it means for developers and engineering teams
This bug type is easy to overlook: the client is the target. Admin consoles such as MMC snap-ins, database GUIs and Kubernetes dashboards parse responses from the servers they manage. If an attacker can make the console talk to a server they control, through a spoofed hostname, a poisoned DNS record or a convincing "please check this RRAS box" request, any parsing bug in the console becomes code execution on a privileged admin's workstation. That machine usually holds the credentials an attacker most wants.
The hotpatch side shows the trade-off in no-reboot patching. Hotpatching keeps uptime high by patching code in memory and on disk together, but it only covers changes Microsoft can apply that way and follows its own release rhythm. When a fix lands in the regular cumulative update first, hotpatch fleets can lag until an out-of-band package arrives. If you run a hotpatch fleet, you need to track that gap explicitly, not assume parity with Patch Tuesday.
It is also a reminder that "client-side" doesn't mean "low priority" in patch triage. Severity ratings and exploitability scores are usually framed around servers listening on the network. A management tool on an administrator's laptop only becomes reachable when someone uses it, but the person using it is exactly who an attacker wants. Many organisations patch servers on a tight SLA and leave admin workstations on a slower consumer-style cadence. For tools such as RRAS, MMC snap-ins, SQL Server Management Studio or cloud CLIs, it often makes sense to reverse that.
What to do now
- Confirm the build on hotpatch devices. Run
winverorGet-ComputerInfo | Select OsBuildNumber, OsHardwareAbstractionLayerand look for 26100.7982 / 26200.7982 or later. - Check Autopatch reports to confirm KB5084597, including the re-released version, has installed across your hotpatch rings.
- Make sure non-hotpatch devices installed the March 2026 cumulative update.
- Limit who uses the RRAS snap-in and from where. Run admin tools from hardened privileged access workstations, not daily-use laptops.
- Be wary of requests to "connect to this server" with management tools, and verify hostnames through DNS you control.