Originally reported by BleepingComputer
TL;DR
Microsoft released an out-of-band hotpatch update for Windows 11 Enterprise systems to fix a remote code execution vulnerability in the Routing and Remote Access Service. The emergency patch targets enterprise environments using hotpatching instead of standard cumulative updates.
RCE vulnerability requiring OOB patch indicates significant risk, but limited to Windows 11 Enterprise hotpatch recipients and no confirmed active exploitation mentioned.
Microsoft deployed an out-of-band hotpatch update to address a remote code execution vulnerability in Windows 11 Enterprise systems. The emergency patch specifically targets organizations using Microsoft's hotpatching mechanism rather than traditional Patch Tuesday cumulative updates.
The vulnerability affects the Routing and Remote Access Service (RRAS), a Windows component that enables remote network connectivity and VPN functionality. RRAS typically runs with elevated privileges, making successful exploitation particularly concerning for enterprise networks.
The decision to release an OOB update outside the standard monthly patching cycle suggests Microsoft assessed the vulnerability as posing significant risk to enterprise environments. Hotpatching allows organizations to apply security fixes without requiring system reboots, making it attractive for critical infrastructure and high-availability systems.
The patch applies specifically to Windows 11 Enterprise editions configured to receive hotpatch updates. This deployment model is primarily used by large organizations seeking to minimize downtime from security updates.
Organizations using standard Windows Update or Windows Server Update Services (WSUS) for patch management should verify their systems receive appropriate security updates through their normal channels.
Enterprise administrators should prioritize deploying this hotpatch, particularly in environments where RRAS is actively used for remote access or VPN services. The RCE classification indicates potential for full system compromise if successfully exploited.
Organizations should also review their RRAS configurations and consider network segmentation to limit potential impact from RRAS-related vulnerabilities.
Originally reported by BleepingComputer