Microsoft ships emergency Windows 11 hotpatch for RRAS remote code execution flaws

Microsoft has released an out-of-band hotpatch for Windows 11 versions 24H2 and 25H2 to fix three security flaws in the Windows Routing and Remote Access Service, or RRAS, management tool. The update is KB5084597 and brings systems to OS Builds 26100.7982 and 26200.7982.

Microsoft says the update fixes CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. In the official release notes, the company says that if a user connects to a malicious remote server through the RRAS management tool, an attacker could disrupt the tool or execute code on the device.

The main point of this release is speed and minimal disruption. Microsoft delivered it as a hotpatch, which means eligible systems can get the fix without a restart. That matters for organizations that use hotpatch-enabled Windows 11 fleets and want to close serious remote access risks quickly.

What the update fixes

Microsoft’s release notes group the three bugs under networking security fixes tied to RRAS. The company’s wording says the problem appears when someone connects to a malicious remote server, which then allows an attacker to interfere with the RRAS management tool or run code on the victim system.

Public vulnerability records describe CVE-2026-26111 as an integer overflow or wraparound issue in Windows RRAS that can lead to code execution over a network. NVD now lists the flaw as requiring an authorized attacker and user interaction.

Affected versions

Source: Microsoft support release notes.

What makes this release different

This is not a normal Patch Tuesday package. Microsoft labels KB5084597 as an out-of-band hotpatch, which means it targets hotpatch-enabled devices outside the usual monthly cycle. The company also says the latest servicing stack update is included with the release.

Microsoft’s support page says the update is available for Windows 11 on both x64 and Arm64 systems that are set up for hotpatching. Devices that do not use hotpatch are not offered this exact package.

What admins should do

• Check whether eligible Windows 11 24H2 and 25H2 devices support hotpatch and received KB5084597.
• Prioritize systems used for RRAS administration or remote connectivity management.
• Review Microsoft’s CVE entries for CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111 for risk tracking and documentation.
• Confirm that standard patch management workflows do not miss this release just because it arrived outside the regular monthly schedule.

FAQ