Microsoft says it mistakenly told administrators that a Windows 11 Always On VPN bug was fixed in the October 2026 cumulative updates. The issue was first acknowledged in a service alert in late September and appeared on systems running Windows 11 24H2 and later after the September 2026 security updates. When the first Always On VPN connection attempt failed, for example with automatic protocol selection between IKEv2 and SSTP, the connection could stay stuck in a “Connecting” state or fail to connect, and later attempts could show the error “The specified port is already in use.”
The alert was changed to Resolved on October 13, then returned to Mitigated in a later service alert, in which Microsoft said a resolution is planned for an update “in the coming weeks” and apologized for the confusion. Microsoft’s support article for the October update, KB5127648, has a change-log entry dated October 20 saying information about a fix for an Always On VPN connection issue was removed and that the change will be included in a future release. Always On VPN is the Windows feature that runs in the background and sets up a secure tunnel back to the corporate network whenever a device connects to the internet.
How to check if you’re affected
Affected versions are Windows 11 version 24H2 and later with the September 2026 security updates or newer, on devices whose Always On VPN profile uses automatic protocol selection or protocol fallback. Symptoms to look for are VPN connections that hang in “Connecting” or fail after a first failed attempt, or the “specified port is already in use” error. Installing the October update does not fix this, so do not treat the October patch level as proof you are safe.
Microsoft’s mitigation, which IT administrators apply, is to change the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, chosen to suit the organization’s environment, security and deployment requirements.