Threat Intelligence & APT BleepingComputer 3 weeks ago

Microsoft: September Windows updates break Always On VPN connections

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft has notified IT administrators that users may experience Always On VPN connection issues after installing the September 2026 Windows 11 security updates. Always On VPN is a remote access solution that replaces the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices. It is available on Windows 10, Windows 11, and Windows..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Windows

Microsoft has notified IT administrators that users may experience Always On VPN connection issues after installing the September 2026 Windows 11 security updates.

Always On VPN is a remote access solution that replaces the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices.

It is available on Windows 10, Windows 11, and Windows Server, and it runs seamlessly in the background, establishing a secure tunnel back to the corporate network automatically whenever a device connects to the internet.

Always On VPN also lets administrators define which apps and services can use the VPN connection, and it supports modern VPN protocols like IKEv2 and SSTP, plus multi-factor authentication (MFA) for better security.

In a service alert seen by BleepingComputer and shared by Microsoft MVP Susan Bradley, Microsoft says that affected customers may experience issues when their systems attempt to connect to their organization's enterprise network via Always On VPN.

"This issue can occur when the VPN is configured to automatically try another connection method if the initial connection fails (for example, when using automatic protocol selection with IKEv2 and SSTP)," Microsoft said.

"Affected VPN connections might remain in a 'Connecting' state or repeatedly attempt to connect without succeeding. Subsequent connection attempts might also display the error: 'The specified port is already in use.'"

Affected Versions Originating update
Windows 11, version 26H1 KB5124012
Windows 11, version 25H2 KB5124008
Windows 11, version 24H2 KB5124008
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →