Loading story…
Microsoft warned that September Windows 11 updates can prevent Always On VPN clients from connecting to enterprise networks when profiles automatically fall back between IKEv2 and SSTP after an initial failure. Affected devices may remain indefinitely in a “Connecting” state, repeatedly retry, or report that the specified port is already in use. Microsoft identified KB5124012 for Windows 11 26H1 and KB5124008 for Windows 11 25H2 and 24H2 as the originating updates, and advised organizations to configure affected VPN profiles for SSTP-only or IKEv2-only operation pending a permanent fix.
Microsoft’s KB5124010 September preview cumulative update for Windows 11 24H2 and 25H2 includes fixes for Sysmon malformed-header handling, an uninitialized-handle stop error, and erroneous Event ID 25 alerts involving smss.exe, but retains known issues from KB5124008 and later updates. Those issues include possible Active Directory domain-trust loss for Credential Guard-protected machine accounts using unsupported Machine Identity Isolation configurations, plus USB Audio Class 1.0 failures or lost audio. KB5124010 is the final preview release for Windows 11 24H2 before Home and Pro support ends October 13, 2026.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft released KB5124010, a non-security preview cumulative update for Windows 11 25H2 and 24H2. It fixed Sysmon malformed-header handling, an uninitialized-handle stop error, and false Event ID 25 alerts involving smss.exe, and included servicing stack update KB5124009.
Following the September 8 Windows security update, some USB Audio Class 1.0 devices failed to start or produce audio, including Device Manager Code 10 errors and unresponsive sound controls. Microsoft said it was investigating the issue without a resolution.
Microsoft warned that September 2026 Windows 11 security updates, including KB5124012 for 26H1 and KB5124008 for 25H2/24H2, could leave Always On VPN connections stuck connecting, retrying, or reporting that a port is already in use. It recommended using SSTP-only or IKEv2-only configurations until a permanent fix is available.
Microsoft identified that Credential Guard-protected machine accounts using unsupported Machine Identity Isolation configurations could lose their Active Directory secure channel after KB5124008 or later updates. Affected devices could reject valid domain credentials with a trust-relationship failure.
Microsoft stated that Secure Boot certificates used by most Windows devices began expiring, with replacement certificates distributed through Windows Update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourcecatalog.update.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's cumulative Windows 11 security update `KB5124008` is reportedly preventing certificate-based Always On VPN tunnels from connecting on some enterprise endpoints running Windows 11 24H2 and 25H2. Administrators using Intune-deployed VPN profiles with RRAS, NPS, and certificate authentication found that uninstalling the update and rebooting restored connectivity, indicating a likely client-side regression; Microsoft had not listed the issue in its known-issues documentation. The failure creates an operational and security tradeoff for affected organizations: pausing or removing the update may restore remote access, but `KB5124008` remediates numerous vulnerabilities, including two elevation-of-privilege zero-days reported to be actively exploited. Enterprises should identify affected Always On VPN clients, test mitigation options, and monitor Microsoft for an acknowledged issue and supported fix before broadly rolling back the security release.
Sep 11, 2026
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026
Microsoft confirmed that September Windows 11 security updates **KB5124008** and **KB5124012** can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error `Code 10`, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix. KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
Sep 16, 2026