Loading story…
Microsoft's cumulative Windows 11 security update KB5124008 is reportedly preventing certificate-based Always On VPN tunnels from connecting on some enterprise endpoints running Windows 11 24H2 and 25H2. Administrators using Intune-deployed VPN profiles with RRAS, NPS, and certificate authentication found that uninstalling the update and rebooting restored connectivity, indicating a likely client-side regression; Microsoft had not listed the issue in its known-issues documentation.
The failure creates an operational and security tradeoff for affected organizations: pausing or removing the update may restore remote access, but KB5124008 remediates numerous vulnerabilities, including two elevation-of-privilege zero-days reported to be actively exploited. Enterprises should identify affected Always On VPN clients, test mitigation options, and monitor Microsoft for an acknowledged issue and supported fix before broadly rolling back the security release.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
A detailed report posted to Microsoft Q&A said certificate-based Always On VPN tunnels on Windows 11 24H2 and 25H2 enterprise clients failed after KB5124008 installation. Administrators reported that uninstalling the update and rebooting restored connectivity, indicating a possible client-side Windows networking or IPsec certificate-handling regression.
Microsoft released the KB5124008 cumulative security update for Windows 11 24H2 and 25H2, updating them to builds 26100.9445 and 26200.9445 respectively. The update included fixes for the actively exploited elevation-of-privilege vulnerabilities CVE-2026-81963 and CVE-2026-85880.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026
Microsoft released Windows 11 cumulative update **KB5124008** for versions 24H2 and 25H2 (OS builds 26100.9445 and 26200.9445), expanding high-confidence device targeting for automatic deployment of replacement Secure Boot certificates. The rollout addresses the expiration of 2011-era Microsoft Secure Boot certificates: the KEK CA and UEFI CA expired in June 2026, and the Windows Production PCA certificate expires on October 19, 2026. The update also includes servicing stack update KB5124007, security and reliability fixes, and updated AI components for Copilot+ PCs. Organizations and users should keep Windows Update enabled, apply applicable OEM firmware or BIOS updates, and verify that Secure Boot remains enabled in Windows Security. Microsoft said devices awaiting replacement certificates should continue to boot and receive regular Windows updates during the staged deployment. Administrators using Dynamic Update packages must include the version- and architecture-matched `boot.stl` file in installation media to prevent potential boot failures; Microsoft reported no known issues with KB5124008.
Sep 10, 2026
Microsoft has confirmed that the November 2025 non-security preview update KB5070311 and subsequent patches for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025 are causing RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. This issue primarily impacts enterprise users who rely on RemoteApp to stream individual applications, while full desktop sessions and personal devices running Windows Home or Pro are largely unaffected. The disruption stems from changes to Remote Desktop Protocol (RDP) shell handling introduced by the update, leading to widespread difficulties for organizations dependent on virtualized workloads. To address the problem, Microsoft has provided two main mitigation options: a manual registry edit requiring administrative privileges, and the use of Known Issue Rollback (KIR), which automatically reverts the problematic update for Pro and Enterprise devices. Enterprise administrators managing updates via IT policies can also deploy a targeted Group Policy using a specific MSI package. Microsoft has urged affected organizations to implement these workarounds promptly to restore RemoteApp functionality and minimize operational impact.
Jun 29, 2026