Microsoft races to plug gaping ras hole before attackers weaponize it
Three zero-click RCE bugs sit in the Routing and Remote Access service that Windows enterprises rely on for remote server management. Microsoft issued KB5084597 on 11 March, but only machines enrolled in Windows Autopatch or the Expedited Update program get the no-reboot fix; everyone else waits for the slow lane.
Why the panic is justified
The RAS stack runs with SYSTEM privileges, giving any successful intruder the keys to the kingdom: browse every share, dump credentials, plant ransomware, pivot east-west. The trio of CVEs—2026-25172, 2026-25173 and 2026-2611—require nothing more than a malicious packet to an exposed RAS endpoint, no user click, no phish, no stolen password. For firms that left RAS open to the internet “temporarily” while engineers troubleshoot branch-office tunnels, that single packet is a skeleton key.
Microsoft’s own telemetry shows the service is active on roughly 8 % of Windows Server 2022 instances scanned last month. Patch Tuesday numbers rarely lie: if you run RAS, you’re already on the radar.
The fine print most miss
This is not the usual cumulative update. KB5084597 is an “in-memory” hot-patch; the fixed code is injected into running processes and flushed to disk later, eliminating the dreaded 2 a.m. reboot. Autopatch customers woke up protected, while the rest of the planet must still plan downtime or live exposed. It is a quiet admission that Microsoft can move at DevOps speed when the customer is big enough—and a reminder that SMBs remain second-class citizens.
Google Project Zero flagged similar RAS flaws in 2021; Redmond patched then, but the attack surface is sprawling, legacy code dating back to Windows NT 4.0. Every new remote-work spike resurrects it.
What to do before nightfall
Audit port 1723 and GRE 47 today; if either is open to the outside world, you are already late. Disable RAS where it is not mission-critical, or shove it behind a VPN with certificate auth. For those who must keep it live, manually pull KB5084597 from the Update Catalog—Autopatch or not, the patch exists, and hesitation is the only remaining vulnerability.
The clock is ticking: exploit code rarely stays private for more than a week once a CVE goes public. Close the hole, or someone will charge you a bitcoin to reopen your files.