Microsoft Issues Emergency Patch for Critical Windows 11 RRAS Vulnerabilities

Microsoft released an out-of-band hotpatch for three critical RRAS vulnerabilities in Windows 11 (CVE-2026-25172, CVE-2026-25173, CVE-2026-26111) that can allow remote code execution or denial-of-service if an administrator or user connects to a malicious server; no active exploitation was reported and guidance includes applying the patch, restricting RRAS access, disabling unused RRAS roles, network filtering, segmentation, and deploying EDR and logging.