October’s Windows 11 updates were supposed to resolve an ongoing VPN connection problem. For affected businesses, the issue remains.
Microsoft has confirmed that its October 13, 2026, updates did not deliver the expected Always On VPN fix. The company subsequently changed the issue’s status from “Resolved” to “Mitigated,” leaving IT administrators with a temporary workaround while a permanent repair remains pending.
The problem can prevent managed Windows devices from reconnecting to corporate networks. Microsoft recommends configuring affected VPN profiles to use a single tunneling protocol instead of automatic protocol selection or fallback.
Microsoft withdraws its Windows 11 VPN fix claim
Microsoft’s Oct. 20 update history for KB5127648 confirms that the previously listed Always On VPN repair was removed from its release notes and deferred to a future release. The company made the same correction to KB5127646, which applies to Windows 11 version 26H1.
In an administrator advisory reported by BleepingComputer, Microsoft acknowledged the incorrect resolution status, apologized for the confusion and said a permanent fix was planned for a future update.
The bug followed September’s Windows security updates. Those patches also caused separate Remote Desktop and Hyper-V problems, prompting Microsoft to issue an emergency Windows update.
The Always On VPN issue affects configurations using automatic protocol selection or fallback between IKEv2 and SSTP. If an initial connection attempt fails, Windows may be unable to switch protocols, leaving connections stuck at “Connecting” or displaying the error “The specified port is already in use.” Employees may consequently lose access to internal applications despite having working internet connections.
Microsoft’s October documentation covers Windows 11 versions 24H2, 25H2, 26H1 and 26H2, although the issue affects specific VPN configurations rather than every device running those versions. The releases have different upgrade paths, including the Windows 11 26H2 rollout.
The correction follows Microsoft’s October Patch Tuesday release, reinforcing the need to validate fixes before removing temporary mitigations.
A single-protocol workaround until Microsoft delivers a fix
Microsoft recommends configuring affected Always On VPN profiles to use one tunneling protocol instead of automatic selection or fallback. Administrators can select IKEv2-only or SSTP-only connectivity, depending on their deployment.
Microsoft’s Always On VPN documentation specifies that device tunnels support IKEv2 only, while user tunnels can use IKEv2 or SSTP. Administrators must confirm tunnel types and gateway compatibility before changing profiles.
IT teams should:
- Identify affected devices and review their VPN profiles.
- Confirm tunnel types and supported gateway protocols.
- Configure a compatible single protocol.
- Test initial connections and reconnection attempts.
- Monitor Microsoft’s release notes for the permanent fix.
Using one protocol removes automatic fallback if that connection method fails. Administrators should test changes before wider deployment and document modified profiles for eventual restoration.
As of Oct. 26, 2026, Microsoft has not announced a release date or KB number for the permanent repair. Until it arrives, IT teams should maintain tested workarounds, continue applying security updates and verify the eventual fix before restoring automatic protocol selection.
Read more: A separate Windows 11 update problem has caused Remote Desktop connection failures on some enterprise-managed devices, with Microsoft identifying Administrator protection as a contributing factor.