Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Microsoft released out-of-band hotpatch KB5084597 on March 13, 2026, to address three security flaws involving the Windows Routing and Remote Access Service (RRAS) management tool. The restart-free update applies to a narrow group: hotpatch-enabled Windows 11 Enterprise client devices running version 24H2 or 25H2. Administrators should verify which update path each device uses—hotpatch or standard Windows servicing—rather than expecting every Windows 11 PC to receive KB5084597.
What Microsoft patched
KB5084597 addresses a security issue involving the Windows RRAS management tool, which administrators use from a client PC to manage remote RRAS servers. Microsoft says the issue could allow code execution when a user connects to a malicious remote server. This is a client-side management scenario; it should not be read as evidence that every RRAS server or every Windows 11 device is directly exposed.
Microsoft identifies the fixed vulnerabilities as CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111. The update was released out of band on March 13, 2026. Microsoft’s release notice and the KB5084597 support article describe its scope and behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the vulnerabilities mean for users
The attack scenario described by Microsoft starts with a user operating the RRAS management tool and connecting to a malicious server. A malicious response could trigger a vulnerability, disrupting the tool or potentially allowing code execution on the client. That is not the same as an arbitrary internet user being able to compromise any Windows 11 PC directly.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
For CVE-2026-26111, the National Vulnerability Database describes an integer-overflow flaw in Windows RRAS that can permit network-based code execution. Its record lists Microsoft’s CVSS 3.1 assessment as 8.0 High, with network access, low attack complexity, required privileges, and required user interaction. Do not assume those exact conditions apply identically to all three CVEs: the available Microsoft notice names all three but does not establish that each is unauthenticated, wormable, or exploitable under identical conditions. See the NVD entry for CVE-2026-26111.
Which devices should administrators check?
Hotpatch-enabled Windows 11 Enterprise clients
Check Windows 11 Enterprise devices on version 24H2 or 25H2 that are enrolled in hotpatch servicing, particularly administrator workstations and jump hosts used to manage remote RRAS servers. Microsoft’s out-of-band hotpatch is for this limited client scenario, not a universal update for all Windows editions and devices.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Devices on standard Windows servicing
A device that receives ordinary Windows updates is not expected to take the hotpatch-only deployment path. Verify that it has the applicable regular March 2026 cumulative security update instead; the existence of KB5084597 is not a reason to defer or uninstall a normal cumulative update.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Other editions, versions, and server installations
Do not infer applicability to Windows Server or to Windows editions and versions outside Microsoft’s stated hotpatch scope. The RRAS server role and the Windows client management tool are distinct parts of the scenario. Check the update guidance for the product and servicing channel actually in use.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
General Windows Autopatch availability does not mean every Autopatch-managed device qualifies for hotpatch. Microsoft’s eligibility guidance includes licensing, supported Windows version, baseline servicing, Intune management, policy configuration, and other device requirements. Review Microsoft’s Windows Autopatch FAQ before treating a device as eligible.
How to verify the correct update
- Check the device’s servicing path. In Intune and Windows Autopatch reporting, confirm whether the device is enrolled in hotpatch servicing and governed by a hotpatch-enabled quality update policy.
- Confirm Windows version and use. Identify whether the endpoint runs Windows 11 24H2 or 25H2 and whether its user connects to remote servers with the RRAS management tool.
- Check update status. Review Intune reporting or Windows Update history for KB5084597 on eligible hotpatch devices. For standard-update devices, verify the applicable regular March security update instead.
- Validate local inventory when needed. In PowerShell, run
Get-HotFix -Id KB5084597. An installed-hotfix record confirms that the KB appears in this inventory. No result alone does not prove the device is unpatched: first determine whether it should receive this hotpatch or a standard cumulative update.
The KB support article lists OS builds 26200.7982 and 26100.7982, while Microsoft’s release notice refers to 26200.7979 and 26100.7979. Because the published references disagree, do not use a build number alone as the definitive applicability test; check the live KB guidance and the device’s update applicability data. KB5084597 details and builds.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Why the hotpatch does not require a restart
On eligible hotpatch devices, KB5084597 takes effect without a restart. Hotpatching is an extension of Windows Update: devices receive periodic baseline cumulative updates, which can require a restart, and security changes in intervening hotpatch months can be applied without one. Avoiding a restart for this update does not remove the need to stay current with baselines or meet hotpatch servicing requirements.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Microsoft’s hotpatch documentation explains the baseline cycle and update behavior. Eligibility is not simply a switch available on every Windows 11 PC: Microsoft lists qualifying subscriptions, Windows 11 version 24H2 or later, a current baseline, Intune management, and a hotpatch-enabled quality-update policy among the relevant conditions. The FAQ also identifies Virtualization-based Security and device-management configuration requirements for its listed eligibility paths. Microsoft’s release information says hotpatching is not available on Windows 11 version 26H1.
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
- How Windows Autopatch hotpatch updates work
- Windows Autopatch eligibility FAQ
- Windows 11 release information
What to do if a device is not receiving KB5084597
First determine whether the device is supposed to receive a hotpatch. It may be outside the supported edition or version, not enrolled in the required Autopatch and Intune path, missing a required baseline, or temporarily ineligible because of configuration or security prerequisites. A device on standard Windows servicing should be assessed against the regular cumulative update, not treated as unpatched solely because KB5084597 is absent.
For hotpatch policy setup and deployment details, see Microsoft’s Intune hotpatch configuration guidance and Windows Autopatch prerequisites.
Reduce exposure while confirming deployment
Where an in-scope device has not yet received its applicable update, use temporary risk-reduction measures rather than treating them as substitutes for patching:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Limit RRAS management-tool use to hardened administrative workstations or jump hosts.
- Restrict management connections to known, inventory-controlled servers using appropriate network controls and allowlists.
- Review endpoint telemetry for unexpected RRAS management activity, connections to unfamiliar servers, and unusual child processes.
- Apply the regular Windows security update to devices outside the hotpatch deployment path.
The available Microsoft guidance supports applying the appropriate update; these controls reduce exposure but are not a replacement for it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
