Key points
- Microsoft confirmed the Always On VPN issue persists in Windows 11 despite the October 13 update.
- The bug affects versions 24H2 through 26H2 when automatic protocol selection is enabled.
- Administrators must continue using the single-protocol workaround until a permanent fix arrives.
The short version
- Microsoft mistakenly marked the Always On VPN status as resolved in its October 13 security bulletin.
- The company has since corrected the status to mitigated, acknowledging the fix did not work.
- Affected systems continue to hang in a connecting state or report port-in-use errors.
The details
Microsoft has acknowledged that the Always On VPN connectivity issue remains active in Windows 11. According to The Register, the tech giant initially declared the problem resolved in its security update released on October 13, 2026. The company later issued a correction, stating the disclosure was mistakenly updated to resolved status. Microsoft returned the status to mitigated and apologized for the confusion. The issue was originally introduced in the September 2026 security updates. The bug affects Windows 11 versions ranging from 24H2 through 26H2.
It occurs when the VPN is configured to use automatic protocol selection, such as switching between IKEv2 and SSTP if the initial connection fails. Affected clients may remain in a connecting state or repeatedly attempt to connect without success. Subsequent attempts might display an error indicating the specified port is already in use. TechRadar reported that the cumulative updates KB5127648 and KB5127646 failed to cure the fault. The workaround remains pinning the VPN profile to a single protocol.
The context
Always On VPN is a feature designed to establish encrypted connections to corporate networks in the background. It operates without requiring user prompts for authentication. The feature has been present since Windows 10. The current issue disrupts this seamless connectivity for enterprise users relying on remote access. Microsoft’s admission follows reports of widespread frustration among IT administrators. The company’s initial claim of a fix created a false sense of resolution. The retraction highlights the complexity of maintaining legacy features in modern operating systems. Administrators are advised to monitor service bulletins for updates on the permanent fix.
What to watch
- Monitor Microsoft service bulletins for a confirmed permanent fix.
- Watch for new error messages related to port usage during connection attempts.
- Track the status of the Always On VPN disclosure in security updates.
- Observe any changes in the behavior of automatic protocol selection features.
What it means for organisations
Organisations should immediately review their VPN configurations to ensure the single-protocol workaround is applied. IT teams need to verify that all affected Windows 11 devices are using a pinned protocol rather than automatic selection. Management should be informed of the ongoing connectivity risk and the lack of a permanent vendor fix. Security operations must monitor for authentication failures that could impact remote workforce productivity. Departments relying on secure remote access should prepare contingency plans for potential outages. Communication channels should remain open between IT and end-users to report connection issues promptly.
What to do and how to stay safe: Microsoft
- Configure VPN profiles to use a single protocol instead of automatic selection.
- Monitor system logs for errors indicating ports are already in use.
- Inform users that connection delays may occur due to the ongoing bug.
- Check Microsoft service bulletins for updates on the permanent fix.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Windows 11 versions are affected by the Always On VPN bug?
The issue affects Windows 11 versions from 24H2 through 26H2.
Did the October 13 security update fix the VPN issue?
No, Microsoft admitted the update did not fix the issue and the status was mistakenly marked as resolved.
What is the current workaround for the Always On VPN problem?
Administrators should change from automatic protocol selection to a single protocol for affected VPN connections.
