Windows 11 24H2 with KB5055523 patch causes Critical issue with the OpenVPN and others

[bitroniq]

Problem Statement

There is an issue reported by our end-users impacted by the use of OpenVPN 2.6.12

All the cases are reported by the users with Windows 11 Pro with the upgrade of 24H2, with the patch KB5055523.

General information about Windows 11 Release History and Updates

• KB5055523 is a - 2025-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5055523)- 1.2 GB
  • released on 4/8/2025

This is the latest update for Windows 11 24H2

Summary

• KB5055523 - which is the 2025-04 Cumulative Update for Windows 11 Version 24H2 impacts only users with Windows 11 - 24H2
• 24H2 upgrade is available only for machines with TPM2.0
  • 23H2 - (EOL 2026-11-10)` is still ok, and users can still use it.
  • that Windows 11 version will not get the KB5055523 update, which is only available for 24H2

Reference:

• https://www.catalog.update.microsoft.com/Search.aspx?q=KB5055523
• https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
• https://support.microsoft.com/en-us/topic/april-8-2025-kb5055523-os-build-26100-3775-277a9d11-6ebf-410c-99f7-8c61957461eb

To Reproduce

• Use the Windows 11 (pro/home) - version 24H2 with patch KB5055523
• Install latest OpenVPN 2.6.x
• Try to connect

Expected behavior

• Connection should work every time
• Connection should work after the reboot

Version information (please complete the following information):

• OS: Windows 11 Pro with the upgrade of 24H2, with the patch KB5055523.
• OpenVPN version: v2.6.12

Remarks

• https://learn.microsoft.com/en-us/answers/questions/2246832/vpn-connectivity-issues-after-installing-windows-1

After the installation, I attempted to connect to our corporate networks using Cisco VPN and FortiClient VPN, as I do daily. Both VPN clients successfully established connections. However, I was unable to access any internal servers, applications, or URLs that are normally accessible once connected.

And many other people report they have problems with their VPN software.

Looks like it is global issue affecting VPN software in general.

[cron2]

There is lots of information about windows versions and such, but what exactly is the "Criticial issue" reported here? Logfiles, screenshots, anything, please. Otherwise there is nothing we can do about it.

[bitroniq]

Additional log files:

b6c2553b0b48280cbd7d21861e54a2c5.log

[bitroniq]

There is a ticket on MS forum, that this version and patch causes an issue with many other VPNs

• https://learn.microsoft.com/en-us/answers/questions/2246832/vpn-connectivity-issues-after-installing-windows-1

"After the installation, I attempted to connect to our corporate networks using

• Cisco VPN
• and FortiClient VPN, as I do daily.
• Both VPN clients successfully established connections. However, I was unable to access any internal servers, applications, or URLs that are normally accessible once connected.

[cron2]

Looks as if this Win11 version is more broken than usual, aka "messing with routing in new ways". The OpenVPN log you have shared looks basically as expected (= no crash or connection error or anything inside OpenVPN) but "something in the interface config" seems to be failing (OpenVPN signals the TAP driver what I address to present with DHCP, but this address never shows up in windows ipconfig).

I see that you are not using the interactive service and running OpenVPN as privileged user instead, and also are not using the win-dco driver but falling back to tap-windows6 and DHCP. This is all old stuff, so you really want to run openvpn.exe as unprivileged user, and want to use DCO. This will avoid using DHCP and use more recent windows API than netsh so might just work.

[cron2]

oops, didn't intend to close it, misclicked. Sorry.

[bitroniq]

General information about Windows 11 Release History and Updates

• KB5055523 is a 2025-04 Cumulative Update for Windows 11 Version 24H2 for x64-based Systems (KB5055523) - 1.2 GB
  released on 4/8/2025

This is the latest update for Windows 11 24H2

My VM is 23H2 - not getting 24H2 due to lack of the TPM2.0

• That's why I'm not getting that problematic update KB5055523

Summary

• KB5055523 - which is the the 2025-04 Cumulative Update for Windows 11 Version 24H2 impacts only users with Windows 11 - 24H2
• 24H2 upgrade is available only for machines with TPM2.0
• 23H2 (EOL 2026-11-10) is still ok, and users can still use it.
  • that Windows 11 version will not get the KB5055523 update, which is only available for 24H2

Reference:

• https://www.catalog.update.microsoft.com/Search.aspx?q=KB5055523
• https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information
• https://support.microsoft.com/en-us/topic/april-8-2025-kb5055523-os-build-26100-3775-277a9d11-6ebf-410c-99f7-8c61957461eb

[bitroniq]

Now we have to make a business decision

• ACC - Acreto Connect Client - https://acc.acreto.io
  • that uses OpenVPN (latest with DCO)

ACC on Windows - questions regarding Windows 11 with 24H2 and KB5055523

• situation for 2025-04-25

Case 1: end-users with 24H2 and KB5055523

• should we tell them to uninstall KB5055523 ?
• or maybe ask to install ACC 2.9.14? (OpenVPN 5.x)
• or just warn the users to not install ACC 2.10.2 (OpenVPN 2.6.x) ( on Windows 24H2 with KB5055523)?

Case 2: end-users with 23H2

• apparently there is no issue with any OpenVPN or ACC version here
• it is safe to use ACC 2.10.2 with DCO on Windows 11 23H2

[bitroniq]

@cron2 FYI - I asked the end-user to install latest OpenVPN community:

• https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I001-amd64.msi>

And try one more time:

1. The logs show us that netsh.exe failed
2. the TAP interface received 169.254.x.x IP
3. The final result was error

You've got the error result in the log file I've shared before.

[bitroniq]

My team tried to uninstall the KB5055523

All problems are gone without the KB5055523 using OpenVPN 2.5.x and 2.6.x

[lstipakov]

I cannot comment on ACC (by some reasons it doesn't use dco and interactive service), but do you have logs from openvpn-gui ?