Always On VPN bug from September Windows updates fixed

Microsoft has fixed a known issue that broke Always On VPN connections on Windows 11 systems after the September 2026 security updates were installed.

The fix ships in the KB5127648 and KB5127646 cumulative updates, which the company released on Tuesday as part of its October 2026 Patch Tuesday rollout. According to Microsoft, both updates address the problem on all affected systems.

What Always On VPN does

Always On VPN is Microsoft's remote access solution and the successor to the older DirectAccess technology. It supports Windows 10, Windows 11, and Windows Server devices, whether they are domain-joined, non-domain-joined, or joined to Microsoft Entra ID, the company's cloud-based identity service formerly known as Azure Active Directory.

The feature works quietly in the background. Whenever a device gets an internet connection, it automatically builds a secure tunnel back to the corporate network, so users don't have to start the VPN themselves. That makes it a common choice for organizations with remote and hybrid staff, and it also means a failure can cut employees off from internal resources without much warning.

How the bug showed up

Microsoft first told IT administrators about the problem in a service alert sent in late September. The issue affected up-to-date devices running Windows 11 24H2 and later.

The trigger was a failed first connection attempt. Many Always On VPN deployments use automatic protocol selection, where the client tries one tunneling protocol and falls back to another if the first does not work. A typical example is a profile that can use either IKEv2 or SSTP. On systems with the September updates, this fallback process did not behave as intended.

"When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," Microsoft explained.

Retrying did not always help. "In some cases, subsequent connection attempts could display the error, 'The specified port is already in use,'" the company added.

Workaround for delayed patching

Not every organization can deploy cumulative updates the day they are released. For those that need more time, Microsoft has described a temporary mitigation that removes the fallback logic from the equation.

"IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration," Microsoft said.

The company did not recommend one protocol over the other. "Organizations should select the protocol based on their environment, security, and deployment requirements," it noted.

The trade-off is clear: locking a profile to a single protocol avoids the bug, but it also gives up the resilience that automatic selection is meant to provide. Admins using this workaround will likely want to switch back once the October updates are in place.

Part of a wider pattern

The VPN problem is not the only side effect of the September 2026 updates. Last month, Microsoft pushed out emergency updates to fix Remote Desktop Services failures, Hyper-V issues, and USB audio problems hitting both home and enterprise Windows users. All of these were traced back to the same September release.

This week, Microsoft also confirmed another Remote Desktop issue. Non-admin users may have trouble connecting to devices over Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is turned on.

Why It Matters

For organizations that rely on Always On VPN, this fix is worth prioritizing. A remote access tool that silently fails to connect tends to land on the help desk as a flood of individual tickets rather than as one obvious outage, which can make the root cause harder to spot. Admins who switched profiles to a single protocol as a stopgap should plan to review that change after patching.

The bigger story is the number of problems linked to one monthly release. VPN failures, Remote Desktop breakage, Hyper-V issues, and audio bugs all trace back to the September updates. This suggests that enterprise-facing features continue to carry real regression risk with each cumulative update, and it puts pressure on IT teams that want to patch quickly for security reasons but also need stable remote access.

That tension is not going away, especially as Microsoft makes other big changes to how Windows is serviced, such as the upcoming Windows Update certificate expiry that will affect older PCs. A staged rollout, with a pilot group that includes VPN and Remote Desktop users, remains a sensible way to catch these issues early. It is also worth watching whether the October updates introduce any new known issues of their own, and whether Microsoft resolves the Administrator protection problem with Remote Desktop in the coming weeks.