Microsoft has fixed a Windows 11 bug that disrupted Always On VPN connections after its September 2026 security updates. The issue affected VPN profiles that used automatic protocol selection or switched protocols after a failed connection.
Microsoft released the fix on October 13 through its monthly security updates. KB5127648 covers Windows 11 versions 24H2, 25H2, and 26H2. KB5127646 covers Windows 11 version 26H1. Microsoft’s release notes confirm that both updates address the VPN issue.
The fix should help organizations restore reliable remote access. However, administrators who cannot install the updates right away can use Microsoft’s temporary workaround.
What caused the VPN problem?
Microsoft first acknowledged the issue in late September after IT administrators reported connection failures. The problem appeared on systems running the September 2026 security updates or later updates that included the affected code.
This problem impacted the profiles that made use of automatic protocol selection or fallback. For instance, if an Always On VPN profile started by using IKEv2, which stands for the Internet Key Exchange version 2, the profile could later switch to SSTP.
Under these conditions, the connection process could break. Windows might leave the VPN stuck on “Connecting” or fail to connect after the first attempt. Later attempts could also trigger this error: “The specified port is already in use.” Users might then keep trying to reconnect without restoring access to work systems.
Microsoft backs this up in its documentation. Still, they don’t claim that every Always On VPN connection broke, or that every device with the update ran into this bug.
Why the issue matters to businesses
Always On VPN gives employees secure access to all their workplace resources when they’re working from outside the office. It can set up a connection automatically when a device turns on, or when a user logs in, or when the network conditions change.
Microsoft designed this tech as a modern alternative to their older DirectAccess remote-access system. It has the option to connect domain-joined devices, workgroup computers and devices connected to Microsoft’s ID system. You can also manage those VPN profiles with tools like Microsoft Intune and Configuration Manager.
Microsoft is not the only company tightening security requirements across its platforms. Google is also introducing mandatory developer verification for Android, with the new requirement scheduled to begin on September 30.
If a VPN connection fails, employees won’t be able to get to internal websites or shared files, or even get to their business apps. For admins, a failed connection can also prevent them from managing remote devices when they rely on VPN access.
The impact depends on each organization’s setup. Employees with manual VPN profiles or configurations that avoid the affected automatic selection and fallback behavior may not experience the same problem.
Microsoft has not reported a data breach or security compromise linked to this bug. The documented issue concerns VPN connectivity. It does not show that attackers accessed corporate networks.
Microsoft releases two fixes
Microsoft’s October 13 security updates resolve the documented Always On VPN problem across the affected Windows 11 releases.
Update numbers depend on the version of Windows:
- KB5127648: Windows 11 versions 24H2, 25H2 and 26H2.
- KB5127646: Windows 11 version 26H1.
Administrators should check each device’s Windows version before choosing an update. They can use Windows Update or their usual go-to update management tools to get the right package installed.
Microsoft basically advises installing the latest security update that’s out. These monthly cumulative updates include not just all the security patches, but also a few other useful improvements and fixes for problems that have come up.
Organizations should maintain their usual testing and rollout procedures as in any other update. Their IT can test the update on a small group of devices first, before they deploy it widely. That way, it’ll be easier to catch any potential problems before they affect a whole bunch of your employees.
A temporary workaround for IT teams
Any organization that’s unable to install the October update right away can change their Always On VPN profile instead. Microsoft suggests swapping automatic protocol selection for just one protocol: either SSTP only or IKEv2 only.
It’s up to the admin to pick which one fits their VPN setup and what they need security-wise. Before making any changes , they should double check its compatible with their VPN gateway, auth settings and network policies.
IKEv2 is a good protocol for secure VPN connections and works with compatible VPN gateways. SSTP might be more useful if firewalls or proxy servers are interfering with other protocols. However, SSTP does not support every Always On VPN setup. Windows device tunnels, for example, support IKEv2 only.
The workaround needs careful planning. That one protocol suits one organization doesn’t guarantee it’ll be perfect for another organization. That’s why it’s essential that admins test the revised profile to be certain that users won’t lose access to the internal resources they need.
The revision may help reduce disruptions until there’s a lasting solution for the issue. Still, Microsoft recommends installing the applicable October update to resolve the documented Windows issue.
More problems after September updates
The VPN failure adds to several problems associated with Microsoft’s September 2026 updates. It is also worth noting that the company has sorted out some concerns related to Remote Desktop Services, Hyper-V, and USB audio.
All these cases demonstrate the difficulties in managing large Windows systems. While security updates protect systems from known threats, there may still be unexpected bugs springing up to cause disruptions.
Microsoft has also warned about a separate Remote Desktop issue. The company says some non-administrator users may struggle to connect to devices when the Administrator protection feature is enabled. However, that’s an entirely different case from the Always On VPN bug.
Both come with their own headaches and require different fixes. IT admins need to figure out which VPN profiles are affected, grab the right October update for each Windows version, and test those remote connections. If updating right away isn’t possible, there’s a single-protocol workaround to use while you prep for deployment.
What matters now is that Microsoft finally released a fix for the Always On VPN failure. Organizations should install the update that matches their version of Windows 11 and double-check that automatic connections are working.
