To address security flaws, Microsoft has provided a special update (out-of-band or OOB) for Windows 11 Enterprise computers that utilize hotpatch updates, an alternative to the standard Patch Tuesday updates.

Released yesterday, the KB5084597 hotpatch resolves weaknesses in the Windows Routing and Remote Access Service (RRAS) tool. These weaknesses could lead to remote code execution if a connection is made to a compromised server.

According to Microsoft, “A security vulnerability has been found in the Windows Routing and Remote Access Service (RRAS) management tool that enables remote code execution through connections to malicious servers.”

“This issue is limited to specific situations concerning Enterprise client devices using hotpatch updates for managing remote servers.”

The KB5084597 update applies to Windows 11 versions 25H2 and 24H2 and Windows 11 Enterprise LTSC 2024 versions.

Microsoft reports that the vulnerabilities addressed by this hotpatch are identified as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111, and they were originally patched in the March 2026 Patch Tuesday updates.

All three vulnerabilities share the description: “An authenticated attacker on the domain could leverage this vulnerability by enticing a domain-joined user to send a request to a malicious server through the Routing and Remote Access Service (RRAS) Snap-in.”

The company explains the hotpatch is a cumulative update incorporating all fixes and improvements present in the March 2026 Windows security update released on March 10.

While the Patch Tuesday updates addressed these issues, complete installation necessitates system restarts. However, certain mission-critical devices can’t handle interruptions easily.

To mitigate this problem, hotpatch updates apply security fixes by patching running processes in memory, as well as updating the existing files to ensure fixes continue after a reboot.

Microsoft indicated these fixes were previously released in other hotfixes but were re-released to “ensure broad coverage across all affected scenarios.”

However, the hotpatch will only install automatically on devices enrolled in the hotpatch update program and managed by Windows Autopatch, without requiring a reboot.