Microsoft slams the brakes on three ras zero-days with emergency patch
Three remote-code-execution holes in Windows Routing and Remote Access Service were patched Tuesday without a reboot for Autopatch fleets, but the clock is ticking for every other enterprise server still exposing port 1723 to the internet.
Why ras bugs are a gift wrapped in system privileges
The service sits at the kernel’s elbow, running with NT AUTHORITYSYSTEM. Compromise it and you inherit the keys to the domain: attackers can enumerate every VPN profile, plant kernel drivers or flip the ransomware switch without ever touching a desktop. Microsoft tags the trio CVE-2026-25172, CVE-2026-25173 and CVE-2026-2611 — all authenticated RCE, all worm-friendly, all skipped the public eye only because Redmond kept them embargoed until KB5084597 dropped.
The fix is already live on Windows 11 24H2/25H2 for machines enrolled in Windows Autopatch; the hot-patch engine edits RASAPI32.dll in memory, so branch-office routers keep humming while the guardrails slam shut. Everyone else gets the traditional cumulative, which means a planned reboot and a help-desk ticket queue that stretches into the weekend.
Only corporate vpns are in the crosshairs — for now
Microsoft’s advisory stresses “enterprise configurations,” but the code path is identical for the built-in VPN client you use to reach the office from your couch. If your IT team hasn’t pushed KB5084597 yet, disable RAS temporarily or firewall SSTP and PPTP ports until they do; proof-of-concept chatter is already ricocheting inside red-team Slack channels.
Lo que nadie cuenta es que the bugs were reported privately three weeks ago, giving Fortune-500 security teams a head start. The rest of us are playing catch-up with a service that has spent two decades masquerading as a humble dial-up assistant while holding root privileges the entire time.
Patch now, or spend Friday night explaining to the board why the back-up domain controller is suddenly speaking Russian.