Loading story…
Microsoft will enable hotpatch security updates by default for eligible Windows devices managed via Microsoft Intune or the Microsoft Graph API, starting with the May 2026 Windows security update and delivered through Windows Autopatch. Hotpatch applies security fixes without requiring an immediate reboot, reducing the typical multi-day restart grace period that can leave endpoints exposed; Microsoft says this change can cut the time to reach 90% patch compliance roughly in half. Devices must meet prerequisites and have the April 2026 baseline installed; if a device is not on the baseline, Autopatch will first install it (requiring a restart) before subsequent hotpatches can apply without reboots.
Microsoft indicated additional administrative controls are coming, including a tenant-level opt-out in Intune expected to be available April 1, 2026, and admins can also scope hotpatch behavior to specific devices/groups. The default behavior is described as applying to devices not already governed by an existing quality update policy, while current configurations (e.g., update rings, deferrals, and any previously set hotpatch preferences) remain in effect. Administrators can validate readiness using Intune reporting (e.g., hotpatch/quality update reporting) and adjust the Autopatch tenant setting that controls “apply updates without restarting” behavior as needed.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Because April 2026 is a baseline month, Microsoft said hotpatch deployments would not begin until May 11, 2026, giving administrators time to review readiness and change settings. Organizations can use Intune reporting to verify which devices are eligible and hotpatch-ready before rollout begins.
Starting with the May 2026 Windows security update, Windows Autopatch will automatically deliver hotpatch security updates to eligible unmanaged-by-policy devices by default. Microsoft said this applies to supported systems such as Windows 11 version 24H2 or later and is delivered through Autopatch deployment rings.
Microsoft said devices must install the April 2026 baseline security update and meet all hotpatch prerequisites before they can receive hotpatch updates. Devices that do not qualify will continue receiving standard cumulative updates that require restarts.
Microsoft said tenant-wide controls to opt out of the new default hotpatch behavior will become available on April 1, 2026, with group-level control available through quality update policies. Existing update configurations and policy-level settings will continue to override the tenant default.
Microsoft said eligible devices managed through Microsoft Intune or the Windows updates API in Microsoft Graph will have hotpatch security updates enabled by default starting with the May 2026 Windows security update. The company said the change is intended to reduce restart-related patch delays and improve time to patch compliance.
Microsoft published documentation describing hotpatch updates for Windows Autopatch, including prerequisites such as Windows 11 24H2 or later, Intune quality update policies, Virtualization-based Security, and the latest quarterly baseline release. The documentation also outlined the quarterly cadence of baseline months requiring restarts and hotpatch months that install without restarts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
6 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourcetechcommunity.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released the out-of-band **KB5084597** hotpatch for Windows 11 Enterprise hotpatch-enabled systems to address three vulnerabilities in the **Windows Routing and Remote Access Service (RRAS) management tool**: `CVE-2026-25172`, `CVE-2026-25173`, and `CVE-2026-26111`. The flaws can be exploited when a user or administrator connects the RRAS snap-in or management tool to an attacker-controlled or malicious server, creating a path for **remote code execution** and, in some scenarios, service disruption or denial of service. Microsoft said the issue affects a limited set of enterprise client scenarios involving remote server management on domain-joined devices. The hotpatch applies to Windows 11 versions **24H2**, **25H2**, and Windows 11 Enterprise LTSC 2024 systems configured to receive hotpatches, and it is designed to install **without requiring a reboot**. Reporting indicates the vulnerabilities were already addressed in the March 2026 Patch Tuesday cumulative updates, but Microsoft issued the OOB hotpatch to protect systems that cannot be easily restarted, including mission-critical enterprise devices. The update is cumulative and includes the March security fixes, giving organizations a faster mitigation path for exposed RRAS management environments.
Jun 29, 2026
Microsoft released cumulative updates KB5066835 and KB5066793 for Windows 11 versions 25H2/24H2 and 23H2 as part of the October 2025 Patch Tuesday. These updates are mandatory and address a range of security vulnerabilities discovered in previous months, ensuring that systems remain protected against the latest threats. The updates can be installed automatically through Windows Update or manually via the Microsoft Update Catalog, providing flexibility for both end users and enterprise administrators. After installation, the build numbers for Windows 11 25H2 and 24H2 are updated to Build 26200.6899 and 26100.6899, respectively, while 23H2 is updated to 226x1.6050. This release marks the first Patch Tuesday update for version 25H2, which shares its codebase with 24H2, resulting in identical fixes and improvements across both versions. Notably, this is the penultimate update for Windows 11 23H2, as its support is scheduled to end in November 2025. The update resolves several issues, including a bug that caused the print preview screen to freeze in Chromium-based browsers, and a problem where apps and games became unresponsive if users signed in with only a Gamepad at the lock screen. PowerShell Remoting and Windows Remote Management (WinRM) timeouts have been addressed, improving reliability for remote administration tasks. An issue preventing audit events from being logged has also been fixed, enhancing system monitoring and compliance. The update improves the setup process for Windows Hello face recognition, particularly when using USB infrared camera modules, ensuring smoother biometric authentication. Microsoft emphasizes the importance of keeping security intelligence up to date in its antimalware products, such as Microsoft Defender Antivirus, to maintain robust protection against evolving threats. Security intelligence updates are delivered automatically via Windows Update, but users and administrators can also trigger manual updates to ensure immediate coverage. These updates leverage cloud-based protection and AI-enhanced detection to rapidly identify and mitigate new malware and attack techniques. Microsoft provides troubleshooting resources for users experiencing issues with automatic updates, ensuring that security patches and intelligence updates are applied promptly. The integration of third-party materials in security intelligence updates is disclosed, maintaining transparency in the update process. Overall, the October 2025 Patch Tuesday updates represent a comprehensive effort by Microsoft to address security vulnerabilities, improve system stability, and enhance user experience across supported Windows 11 versions.
Jul 12, 2026
Microsoft released out-of-band hotpatch **KB5084897** to fix a Windows 11 Enterprise bug that caused connected Bluetooth devices to disappear from **Settings** and **Quick Settings** even though the devices remained operational. The issue affected **Windows 11 24H2 and 25H2** systems enrolled in the hotpatch program, and it also prevented users from pairing new Bluetooth devices because available hardware did not appear in the connection list. The update installs automatically in the background and does not require a reboot, reflecting Microsoft’s use of **hotpatch** delivery for eligible enterprise devices. Reporting indicates the fix is limited to hotpatch-enabled Enterprise systems rather than devices on standard cumulative updates, and Microsoft positioned it as an emergency release to quickly restore normal Bluetooth management functionality after a disruptive user-interface failure.
Jun 29, 2026