Windows 11 24H2 RRAS RCE: Microsoft Issues OOB Hotpatch Fix

Microsoft has released an out-of-band (OOB) security update to address vulnerabilities in the Routing and Remote Access Service (RRAS) specifically affecting Windows 11 version 24H2. This release is unique as it targets systems configured to receive hotpatches rather than standard cumulative updates. According to BleepingComputer, the vulnerabilities could allow an unauthenticated attacker to execute code on affected servers and workstations by sending specially crafted packets to the RRAS service.

Technical Analysis of the RRAS Vulnerabilities

The primary vulnerabilities addressed in this OOB release are CVE-2024-43513 and CVE-2024-49053. Both flaws carry a CVSS base score of 8.8, indicating high severity. The Routing and Remote Access Service is a CVE target of interest because it provides fundamental networking capabilities, including multiprotocol routing, remote access via VPN, and site-to-site connectivity.

In a successful exploitation scenario, an attacker could achieve RCE without user interaction or elevated privileges. This is particularly dangerous for systems where RRAS is exposed to the public internet to facilitate VPN services. If compromised, an attacker could use the foothold for Lateral Movement across the internal network. While the standard October 2024 Patch Tuesday cycle addressed these flaws for the majority of Windows versions, the new Windows 11 24H2 builds that utilize the hotpatching feature required this specific OOB intervention to ensure parity.

The Role of Hotpatching in Windows 11 24H2

Hotpatching is a specialized deployment mechanism available for Windows 11 Enterprise 24H2, IoT Enterprise 24H2, and Azure Stack HCI. This feature allows Microsoft to update running code in memory without requiring a system reboot. This is a pillar of a Zero Trust infrastructure as it maintains high availability while reducing the window of exposure. However, because the initial Windows 11 24H2 hotpatch-enabled images did not include the RRAS fixes released for other versions, these specific enterprise environments remained at risk until this release. The Windows 11 24H2 RRAS security patch ensures that high-uptime environments remain protected against these memory-corruption class flaws.

Mitigating Remote Code Execution in RRAS

For organizations running affected builds, the priority is the application of the KB5046216 update. While hotpatching typically avoids reboots, administrators should verify the installation status via the Windows Update history or the SOC dashboard. Beyond patching, defenders should evaluate the necessity of exposing RRAS services directly to the internet.

How to detect CVE-2024-43513 exploit attempts

Effective detection requires monitoring for unusual service behavior. Security teams should configure their SIEM to alert on unexpected crashes of the rrasrv.exe process, as unsuccessful exploitation attempts often result in service instability. Furthermore, EDR tools should be tuned to monitor for anomalous child processes spawned by the RRAS service. Mapping these observations to the MITRE ATT&CK framework—specifically focusing on T1210 (Exploitation of Remote Services)—can help in identifying the broader TTP of an active intrusion. Organizations should also restrict RRAS access to known-good IP ranges whenever possible to reduce the overall attack surface.