Businesses that depend on automatic VPN connections for remote staff can restore reliable access by installing the October 2026 Windows updates, which Microsoft released on October 13 to fix a known Always On VPN problem. The flaw, introduced by the September 2026 Windows 11 security updates, left VPN connections stuck in a connecting state or failing after an initial attempt failed. The cumulative updates KB5127648 and KB5127646 address the issue on all affected systems.
What happened
According to Microsoft, the September 2026 Windows 11 security updates introduced a bug that caused Always On VPN connection failures when the first connection attempt did not succeed, for example when a profile used automatic protocol selection with IKEv2 and SSTP. Microsoft first acknowledged the problem in a service alert sent to IT administrators in late September, then shipped the KB5127648 and KB5127646 cumulative updates on October 13 to resolve it. Details are published in Microsoft’s KB5127648 release notes.
Always On VPN is the remote access technology that replaced the older DirectAccess feature. It works with domain-joined, non-domain-joined, and Microsoft Entra ID joined Windows 10, Windows 11, and Windows Server devices, running in the background to establish a secure tunnel back to the corporate network whenever a device connects to the internet.
Are you affected?
Microsoft says the bug affected up-to-date systems running Windows 11 24H2 and later that use Always On VPN with automatic protocol selection or protocol fallback configured. If your Always On VPN profile is set to pick a protocol automatically rather than a single fixed one, your devices fall into the affected group.
The symptoms Microsoft describes give IT teams a way to recognize it: "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed." Microsoft adds that "in some cases, subsequent connection attempts could display the error, ‘The specified port is already in use.’"
Check the Always On VPN profile on affected machines for the protocol setting, and look for connections that hang in the connecting state or report that the port is already in use. Those are the markers Microsoft ties to this issue.
What to do now
- Install the October 2026 security updates on affected devices. Microsoft identifies KB5127648 and KB5127646 as the cumulative updates that resolve the Always On VPN issue on all affected systems.
- If you cannot install the October update immediately, apply Microsoft’s temporary workaround. Microsoft says: "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration."
- Choose that single protocol deliberately. Microsoft advises that "organizations should select the protocol based on their environment, security, and deployment requirements."
- Before a wide rollout of KB5127648, test authentication on any WPA2-Enterprise wireless network. Administrators have reported in Microsoft’s support forum that the update stops Windows 11 clients from completing 802.1X PEAP authentication, with the client logging an Event 12014 OneX Held State timeout. Microsoft has not published a confirmed known-issue entry for this report.
- Review the authentication change in the same update. Microsoft notes that KB5127648 strengthens NTLMv1 security by switching the internal default to Enforce mode when the BlockNtlmv1SSO registry value is not set, a change that applies where Credential Guard is disabled and "might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication."
How this fits the other recent Windows fixes
The VPN fix follows a run of problems traced back to the September 2026 updates. Microsoft released emergency updates last month to fix Remote Desktop Services failures, Hyper-V issues, and USB audio problems affecting both home and enterprise Windows users. This week it also confirmed that non-admin users may have trouble connecting to devices via Remote Desktop after recent Windows updates when the "Administrator protection" security feature is enabled.
KB5127648 itself bundles several other fixes IT teams will care about, according to Microsoft’s release notes: a repair for Explorer.exe failing to start or crashing in multi-user environments such as Azure Virtual Desktop and FSLogix, a fix for AC-3 audio playback, a fix for tiered Storage Spaces Direct virtual disks that failed to come online, a printing fix for RAW and Generic Text Only drivers, a gaming mouse-input stutter fix, and a fix for fingerprint sign-in failing after a cold boot.
One item deserves attention for older hardware: Microsoft states that Windows 11 version 24H2 Home and Pro has reached end of updates, and the October 2026 monthly security update is the last update for those editions. Microsoft recommends upgrading to the latest version of Windows 11 to keep receiving monthly security protections.
FAQ
Which Windows updates fix the Always On VPN issue?
Microsoft released the KB5127648 and KB5127646 cumulative updates on October 13, 2026, and says they address the known Always On VPN issue on all affected systems.
What is the temporary workaround if I cannot install the October update?
Microsoft says IT administrators can change the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, chosen based on the environment, security, and deployment requirements.
Which systems were affected by the VPN bug?
Microsoft says the issue affected up-to-date systems running Windows 11 24H2 and later that had automatic protocol selection or protocol fallback configured, after the September 2026 Windows 11 security updates were installed.