Microsoft Fixes Always On VPN Failures Caused by September 2026 Windows Updates
What Happened — A September 2026 security update for Windows 11 (version 24H2) introduced a bug that broke Microsoft Always On VPN connections. Devices that attempted automatic protocol selection (IKEv2 / SSTP) could become stuck in a Connecting state or return “The specified port is already in use.” Microsoft released October cumulative updates (KB5127648, KB5127646) that resolve the issue and offered a temporary workaround that forces the VPN profile to a single protocol.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must detect configuration drift (e.g., automatic‑protocol fallback) that can silently disable remote‑access controls.
- Timely patch deployment and documented remediation provide defensible evidence for audit readiness and regulatory scrutiny.
- Mapping the VPN‑protocol setting to a control‑mapping inventory demonstrates due‑diligence in maintaining secure connectivity for remote workers.
Who Is Affected — Enterprises across finance, healthcare, technology, and other sectors that rely on Microsoft Always On VPN for remote access, including both domain‑joined and Entra ID‑joined Windows 10/11/Server devices.
Recommended Actions
- Deploy the October 2026 cumulative updates KB5127648 and KB5127646 to all affected endpoints.
- If immediate patching is not feasible, reconfigure the Always On VPN profile to use a single protocol (SSTP or IKEv2) as a temporary mitigation.
- Update your control‑mapping inventory to capture the VPN protocol configuration and verify connectivity through automated health‑checks. Source: BleepingComputer
Technical Notes
- The bug manifested when the initial VPN connection failed under automatic protocol selection, leaving the tunnel in a stuck state.
- Error messages included “The specified port is already in use.”
- The issue affected Windows 11 24H2 and later; Windows 10 devices with the same update were also impacted. Source: same