Act this weekWhat happenedMicrosoft fixed a bug where Always On VPN connections got stuck or failed after the September 2026 Windows 11 security updates.
Who is affectedWindows 11 users and IT administrators whose devices use Always On VPN with automatic protocol selection (IKEv2 and SSTP).
What to do- 1Check whether your company uses Always On VPN on Windows 11 devices.
- 2Install the October preview update KB5127936 to fix the problem.
- 3If you would rather wait for next month's update, set the VPN profile to one protocol, either SSTP only or IKEv2 only.
- 4Pick the protocol that fits your security and setup needs, and ask your IT provider if unsure.
Microsoft says it has fixed a bug that broke work VPN connections on Windows 11 computers after the September 2026 security updates. The fix is in an optional October update called KB5127936. Microsoft had earlier said the regular October updates solved this, and that turned out to be wrong.
What happened
Always On VPN is a Microsoft tool that runs quietly in the background. When a work computer connects to the internet, it builds a secure link back to the company network. Staff do not have to start it themselves.
After the September updates, some of those connections stopped working. Microsoft says they could stay stuck on "Connecting" or fail after a first attempt did not go through. Later attempts could show the message "The specified port is already in use."
Who it affects
The problem hit Windows 11 devices set to pick the connection method automatically. In practice that means two methods, called IKEv2 and SSTP, with the computer switching between them. Microsoft first warned IT administrators about it in late September.
If your company does not use Always On VPN, nothing in Microsoft's notice suggests you are affected. The same goes for VPN setups that use only one method. Staff who work remotely on Windows 11 with this tool are the people to check on.
What to do
The alert box above lays out the steps. In short, the preview update fixes the problem. Companies that would rather wait for next month's regular update can switch their VPN setup to one method only. Microsoft says the right choice depends on each company's setup and security needs, so ask your IT provider if you are unsure.
What happens next
Preview updates are optional and are meant as an early look at fixes that later reach everyone. Microsoft points to next month's Patch Tuesday, its regular monthly update day, as the route for those who wait. The material does not say how many devices were affected.
The same preview update also fixes a second bug. After the September updates, people without administrator rights could not connect to a computer through Remote Desktop when a security feature called Administrator protection was turned on. If staff reported that issue, this update covers it too.
Given Microsoft's earlier mistaken claim, it is worth confirming that a fix actually worked before telling staff the problem is solved.
The takeawayIf staff use Always On VPN on Windows 11, install KB5127936 or switch the VPN to a single method, and ask your IT provider which fits.