Microsoft’s recent security update, labeled KB5124008, for Windows 11 has introduced complications for enterprise clients utilizing Always On VPN. Released as part of the September 2026 Patch Tuesday, the update became available on September 8 and has since caused connectivity issues.
Impact on VPN Connections
Administrators have observed that certificate-based VPN tunnels, which were fully operational before the update, fail to connect post-installation. The issue is resolved upon uninstalling the update and rebooting the affected devices, indicating a potential client-side regression rather than configuration errors with Intune profiles or Network Policy Server (NPS) failures.
The initial detailed report of the problem emerged on Microsoft Q&A on September 9, 2026, highlighting the challenges for systems running Windows 11 versions 24H2 and 25H2. These systems utilize certificate-based authentication and other services like Routing and Remote Access Service (RRAS).
Technical Analysis and Recommendations
According to independent advisor Domic Vo, the disruption aligns with modifications in the Windows networking stack or IPsec certificate processes. Vo recommended gathering diagnostic data such as rasphone.pbk and RasClient logs to aid in troubleshooting. Suggestions to adjust Intune profiles to EAP-TLS are considered temporary measures, lacking official endorsement from Microsoft.
The KB5124008 update, while mandatory and addressing numerous vulnerabilities, including two zero-day exploits (CVE-2026-81963 and CVE-2026-85880), inadvertently affects VPN connectivity. As such, IT teams face a dilemma between maintaining security posture and ensuring remote access functionality.
Strategic Approaches for IT Teams
Given the critical nature of the vulnerabilities addressed by the update, many IT departments are selectively pausing the rollout to systems dependent on Always On VPN. This approach maintains security for the broader network while troubleshooting the VPN issue in affected cohorts.
Enterprises are advised to continue regular updates for RRAS and NPS servers and escalate any findings through Microsoft support with comprehensive logs. If required for compliance, organizations should test any new authentication settings in a controlled environment before broader deployment.
With Microsoft yet to officially recognize the issue or release a hotfix, IT teams must tread cautiously, balancing security updates with operational needs. The situation underscores the complexities of managing security and connectivity in enterprise environments.
