Microsoft Hotpatches Critical RRAS Flaws in Windows 11

Microsoft released an out-of-band security update on March 13, 2026, for Windows 11 enterprise devices, addressing critical vulnerabilities in the Routing and Remote Access Service (RRAS) management tool that could enable remote code execution.

The update, identified as KB5084597, is a hotpatch designed specifically for systems enrolled in Microsoft's hotpatching program and managed through Windows Autopatch. It targets Windows 11 versions 24H2 and 25H2, as well as Windows 11 Enterprise LTSC 2024. According to Microsoft's advisory, the patch fixes three related flaws tracked as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. These vulnerabilities stem from integer overflows in the RRAS service, which handles remote access and routing functions.

An authenticated attacker on a domain could exploit the issues by deceiving a domain-joined user into sending a request to a malicious server through the RRAS Snap-in, potentially leading to arbitrary code execution on the targeted device. Microsoft described the risk in its documentation: "Microsoft has identified a security issue in the Windows Routing and Remote Access Service RRAS management tool that could allow remote code...