Loading story…
Microsoft released the out-of-band KB5084597 hotpatch for Windows 11 Enterprise hotpatch-enabled systems to address three vulnerabilities in the Windows Routing and Remote Access Service (RRAS) management tool: CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. The flaws can be exploited when a user or administrator connects the RRAS snap-in or management tool to an attacker-controlled or malicious server, creating a path for remote code execution and, in some scenarios, service disruption or denial of service. Microsoft said the issue affects a limited set of enterprise client scenarios involving remote server management on domain-joined devices.
The hotpatch applies to Windows 11 versions 24H2, 25H2, and Windows 11 Enterprise LTSC 2024 systems configured to receive hotpatches, and it is designed to install without requiring a reboot. Reporting indicates the vulnerabilities were already addressed in the March 2026 Patch Tuesday cumulative updates, but Microsoft issued the OOB hotpatch to protect systems that cannot be easily restarted, including mission-critical enterprise devices. The update is cumulative and includes the March security fixes, giving organizations a faster mitigation path for exposed RRAS management environments.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On March 13, 2026, Microsoft released out-of-band update KB5084597 to cover hotpatch-enabled Windows 11 Enterprise, 24H2, 25H2, and Enterprise LTSC 2024 systems affected by RRAS vulnerabilities. The hotpatch addressed the same three flaws without requiring a reboot and was made available for eligible managed environments.
On March 10, 2026, Microsoft included fixes for three Windows RRAS management tool vulnerabilities—CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111—in the standard March 2026 Patch Tuesday security updates for regular Windows 11 devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourceghacks.net
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for a series of vulnerabilities in **Windows Routing and Remote Access Service (RRAS)**, including multiple remote code execution issues tracked as `CVE-2024-49085`, `CVE-2024-49089`, `CVE-2025-21208`, `CVE-2025-33064`, `CVE-2025-49670`, `CVE-2025-49688`, and `CVE-2025-62549`. The advisories indicate that RRAS, a Windows component used for routing and remote access functions, was affected repeatedly across several release cycles, with Microsoft issuing fixes through its Security Update Guide. Microsoft also disclosed RRAS information disclosure flaws, including `CVE-2025-53798` and `CVE-2025-55700`, showing that the service faced both code execution and data exposure risks. While the referenced entries provide little technical detail, the concentration of advisories around RRAS highlights the need for organizations using the service to prioritize Microsoft security updates, review RRAS exposure on internet-facing and internal systems, and verify that vulnerable Windows servers have been remediated.
Jul 12, 2026
Microsoft released out-of-band hotpatch **KB5084897** to fix a Windows 11 Enterprise bug that caused connected Bluetooth devices to disappear from **Settings** and **Quick Settings** even though the devices remained operational. The issue affected **Windows 11 24H2 and 25H2** systems enrolled in the hotpatch program, and it also prevented users from pairing new Bluetooth devices because available hardware did not appear in the connection list. The update installs automatically in the background and does not require a reboot, reflecting Microsoft’s use of **hotpatch** delivery for eligible enterprise devices. Reporting indicates the fix is limited to hotpatch-enabled Enterprise systems rather than devices on standard cumulative updates, and Microsoft positioned it as an emergency release to quickly restore normal Bluetooth management functionality after a disruptive user-interface failure.
Jun 29, 2026
Microsoft shipped its January Patch Tuesday security updates for **Windows 10** (including ESU/LTSC) and **Windows 11**, addressing a large set of vulnerabilities and rolling in additional platform hardening changes. Windows 10’s *KB5073724* (ESU) updates systems to build `19045.6809` (and LTSC 2021 to `19044.6809`) and includes security/bug fixes plus a phased update to handle **expiring Secure Boot certificates**; it also removes legacy **Agere modem drivers** (`agrsm64.sys`, `agrsm.sys`, `smserl64.sys`, `smserial.sys`), which can break dependent modem hardware. Windows 11 cumulative updates *KB5074109* (25H2/24H2) and *KB5073455* (23H2) are mandatory and include fixes for issues such as WSL mirrored networking failures (“No route to host”) impacting VPN access and RemoteApp connection failures in Azure Virtual Desktop environments. Third-party analysis of the same Patch Tuesday release reported **112 vulnerabilities** (with **8 marked critical**) and at least one vulnerability observed exploited in the wild: **CVE-2026-20805**. The critical issues highlighted include multiple **remote code execution** vulnerabilities across Windows components and Office applications (including **LSASS**, Word, Excel, and Office), plus **elevation of privilege** flaws such as **CVE-2026-20822** (Windows Graphics Component, use-after-free leading to potential SYSTEM privileges) and **CVE-2026-20854** (LSASS RCE over the network without requiring elevated privileges). Organizations should prioritize rapid deployment of the January Windows updates, with particular attention to exploited-in-the-wild items and critical RCE/EoP paths.
Jun 29, 2026