Windows 11 KB5124008 Breaks Certificate-Based Always On VPN
Active Exploitation · 2 sources · Updated 2mo ago · First seen Sep 11, 2026
Microsoft's cumulative Windows 11 security update KB5124008 is reportedly preventing certificate-based Always On VPN tunnels from connecting on some enterprise endpoints running Windows 11 24H2 and 25H2. Administrators using Intune-deployed VPN profiles with RRAS, NPS, and certificate authentication found that uninstalling the update and rebooting restored connectivity, indicating a likely client-side regression; Microsoft had not listed the issue in its known-issues documentation.
The failure creates an operational and security tradeoff for affected organizations: pausing or removing the update may restore remote access, but KB5124008 remediates numerous vulnerabilities, including two elevation-of-privilege zero-days reported to be actively exploited. Enterprises should identify affected Always On VPN clients, test mitigation options, and monitor Microsoft for an acknowledged issue and supported fix before broadly rolling back the security release.
