Daily Cybersecurity News - March 15, 2026
Microsoft Hotpatches Critical RRAS Flaw
HighExecutive Summary
Microsoft has issued an out-of-band (OOB) hotpatch, KB5084597, to address three remote code execution (RCE) vulnerabilities, identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, in the Windows Routing and Remote Access Service (RRAS). The update is for Windows 11 Enterprise devices in the hotpatch program and is now patched.
Vulnerability Details
- Affected Product: Windows 11 versions 24H2, 25H2, and Enterprise LTSC 2024 for devices enrolled in the hotpatch program.
- Identifier: CVE-2026-26111, CVE-2026-25172, CVE-2026-25173
- CVSS Score: 8.0 (High) for CVE-2026-26111.
- Exploitation Status: No evidence of active exploitation has been reported.
Risk & Impact
- Triage: Immediate patching is recommended for affected enterprise devices.
- Attack Vector: An authenticated attacker on the domain could trick a user into sending a request to a malicious server via the RRAS Snap-in, leading to an integer overflow and allowing remote code execution.
- Ease of Exploit: The attack requires user interaction, where a user must be convinced to connect to a malicious server.
Action Plan
- Immediate Action: Apply the out-of-band hotpatch KB5084597 to affected systems. Devices not in the hotpatch program were protected by the standard March 2026 Patch Tuesday updates.
- Workaround: Disabling the Routing and Remote Access Service (RRAS) can serve as a temporary mitigation if immediate patching is not possible.
Relevant professional terms
- Out-of-Band (OOB) Hotpatch
- A software update released outside of the regular, scheduled update cycle to address a critical or time-sensitive security vulnerability. It allows for immediate in-memory patching without requiring a system reboot.
- Remote Code Execution (RCE)
- A type of vulnerability that allows an attacker to execute arbitrary commands or code on a target machine or in a target process over a network.
Source: BleepingComputer