The September 2026 cumulative security updates for Windows 11 versions 26H1, 25H2, and 24H2 (KB5124012 and KB5124008) introduce a connectivity issue with Always On VPN. When Always On VPN is set to automatically select between IKEv2 and SSTP protocols, the VPN connection may fail to establish, remain stuck in a connecting state, or produce port usage errors. Microsoft advises IT administrators to mitigate this by configuring the VPN profile to use a single protocol rather than automatic selection. This issue affects Windows 11 systems after applying the specified updates. Microsoft is working on a permanent solution.

Affected Windows 11 systems may experience failed or unstable Always On VPN connections, potentially disrupting remote access to enterprise networks. The issue specifically impacts VPN configurations that use automatic protocol selection, causing connection attempts to hang or fail with port conflicts. This may affect user productivity and access to corporate resources relying on Always On VPN.

Microsoft recommends that IT administrators temporarily mitigate the issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, based on their environment and security requirements. A permanent fix is pending from Microsoft. Organizations should monitor official Microsoft communications for updates and apply the permanent fix once available.