Microsoft’s September 2026 cumulative update for Windows 11 — identified as KB5124008 — is causing widespread issues for enterprise users relying on Always On VPN with certificate-based authentication. The update, released September 8 for versions 24H2 and 25H2 (raising build numbers to 26100.9445 and 26200.9445), appears to break persistent VPN tunnels, rendering remote access unavailable until the patch is removed and the system is rebooted. These disruptions have been confirmed in Windows Server 2019 environments using Routing and Remote Access Service (RRAS) and Network Policy Server (NPS) combined with Intune-deployed VPN profiles.
What Exactly Goes Wrong
Administrators report that once KB5124008 is installed, the Always On VPN connection drops immediately. Tunnels that had been working flawlessly before the update refuse to establish again, even though RRAS, NPS, and Intune profiles haven’t changed. The only reliable fix so far is uninstalling the update and rebooting the affected machines.
Technical feedback suggests the fault lies in Microsoft’s networking stack or in how IPsec certificates are handled, not in misconfigured Intune policies or errors on server-side NPS. Diagnostic logs such as rasphone.pbk files, RasClient event logs, and NPS server logs are being flagged as essential evidence for troubleshooting or when opening support cases with Microsoft.
Security Trade-Offs and Enterprise Impact
The KB5124008 update also contains patches for a number of vulnerabilities, including two zero-day elevation-of-privilege flaws already under active exploitation: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in Windows Advanced Local Procedure Call. This makes KB5124008 a high-priority security release despite the VPN regression.
For many organizations, the decision is now how to balance remote access availability against the urgency of closing security gaps. Some are pulling back Always On VPN deployments via WSUS or Intune for the already affected clients while keeping the patch in place elsewhere. Others without Always On VPN setups are untouched.
Until Microsoft publishes a fix or registers this as a known issue, the strongest mitigation appears to be either temporarily halting KB5124008 on Always On VPN endpoints or using uninstall-and-reboot commands. Any pivot to alternative authentication methods (for example EAP-TLS) is considered only an unproven workaround, not official guidance.
Enterprises should monitor Microsoft’s updates closely; in the meantime, leadership should ensure that compliance mandates—if forcing deployment—are balanced against functional remote access requirements. Collecting detailed log data is essential for speeding up diagnostics and possibly facilitating a hotfix.
This situation underlines a recurring risk in large OS patches: fixes for one issue often trigger regressions elsewhere. Admin teams must remain vigilant. For affected users, temporarily pausing the rollout of KB5124008 to Always On VPN endpoints—or fully removing it if needed—is the safest path forward until Microsoft releases an official resolution.
