Microsoft rushes out silent ras patch to stop crown-jewel raids
Three zero-click RCEs in Windows Routing and Remote Access have been bleeding enterprise servers since at least January, and Redmond only admitted the mess after autopilot fleets were already immunised.
The bugs—CVE-2026-25172, CVE-2026-25173, CVE-2026-2611—live deep inside the kernel-level plumbing that lets IT teams dial home to branch offices. Exploit chain takes minutes: authenticate once, spray the heap, inherit SYSTEM. From there it’s game-over: shadow-copy the mail store, loot the domain database, push ransomware to every satellite box before anyone notices the CPU spike.
Why ras is the perfect trampoline
Most admins still picture RAS as dusty dial-up wizardry. Wrong. The service is baked into every Windows Server SKU, runs at boot, and listens on port 1723 and assorted GRE tunnels. That ubiquity is exactly why APT crews love it: you get a privileged interpreter without the hassle of phishing executives. Microsoft’s own CVSS scores land north of 9, but the real punchline is exposure radius—anyone with a domain user ticket can light up the exploit.
Patch Tuesday, 10 March, delivered KB5084597 only to machines enrolled in Windows Autopatch, Microsoft’s cloud nanny for procrastinating enterprises. The rest of the planet gets the same fix wrapped inside a cumulative update that still demands the sacred reboot. Translation: if your shop isn’t on autopilot you’re running a time-share server for intruders until the next maintenance window.
Redmond swears the flaws were “not observed in the wild,” a phrase that usually precedes the disclosure of six-figure ransom notes. CISA has already slapped the trio onto its must-patch roster, giving federal agencies until Friday to comply. Miss the deadline and you’ll spend the weekend explaining to auditors why the intranet is speaking Russian.
The fix works by hot-patching svchost in memory—no disk write until the next cycle—so you won’t even see the tell-tale blue reboot screen. Clever, but also opaque: sysadmins can’t audit what changed without reverse-engineering the delta. Microsoft calls this “seamless”; attackers call it Christmas.
Bottom line: if you run Windows Server and the words “Routing and Remote Access” appear anywhere in your topology, stop reading and open Windows Update. The exploit kit is already on GitHub, and the clock started last Tuesday.