Microsoft Sep 2026 CUs break Always On VPN on some Win11 (KB5124008/KB5124012); auto IKEv2↔SSTP failover sticks Connecting
BleepingComputer (23 September 2026) reports a Microsoft service alert (also shared by MVP Susan Bradley) that September 2026 Windows 11 security updates can break Always On VPN when the profile uses automatic protocol selection between IKEv2 and SSTP. Affected tunnels may stay in Connecting, retry endlessly, or error with “The specified port is already in use.” Originating updates named: Windows 11 26H1 KB5124012; 25H2 and 24H2 KB5124008. Interim mitigation from Microsoft: pin the AoVPN profile to a single protocol (SSTP only or IKEv2 only) until a permanent fix ships. Public learn.microsoft.com release-health pages reviewed this pass still lack a dedicated Always On VPN known-issue entry — card primary remains the BC wire citing the Microsoft service alert. Same CU wave previously drove emergency fixes for Hyper-V, RDS, and USB audio.
- Product
- Windows 11 Always On VPN (IKEv2/SSTP automatic protocol selection)
- Versions
- Win11 26H1 after KB5124012; Win11 25H2/24H2 after KB5124008 (Sep 2026 security CUs)
- Exploited in Australia?
- unknown
- Patch to
- Until Microsoft ships a permanent fix: set AoVPN profile to a single tunnel protocol (SSTP or IKEv2) per environment; validate remote-access fleets after Sep CU; watch Microsoft release-health / service alerts for the official known-issue write-up and LCU
Primary: BleepingComputer — Sep 2026 CUs break Always On VPN (23 Sep 2026; cites Microsoft service alert) · Vendor: Microsoft — KB5124008 (Win11 24H2/25H2 Sep 2026 CU) · Microsoft — KB5124012 (Win11 26H1 Sep 2026 CU)