- Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug.
- The bug can leave VPN links stuck while connecting. It can also show a port-already-in-use error.
- IT admins can use only SSTP or only IKEv2 as a workaround until a permanent fix arrives.
Microsoft has admitted that its October 2026 Windows 11 updates did not fix an Always On VPN bug. The company had previously said it had solved the problem. That announcement has now proven wrong.
Many remote workers rely on this tool, so the correction matters to IT teams. Microsoft shared the news through an update to its service alert. The alert now tells a different story from the one admins saw on October 13.
Microsoft Takes Back Its Fix Claim
Microsoft changed its service alert on October 20 to correct the record. The company said it marked the problem as resolved by mistake on October 13. Microsoft then moved the issue back to mitigated status. According to the company, a permanent solution will come in an upcoming update. Microsoft also apologized for the confusion.
Microsoft’s earlier claim appeared in both its release notes and its service alert. Admins who installed the October updates may therefore still see the bug. They cannot rely on the earlier notes to say the problem is gone.
The mistake began with the October 13 release of cumulative security updates. These updates cover Windows 11 versions 24H2, 25H2, and 26H2, according to Microsoft’s release notes.
The first version of those notes listed the VPN bug among the problems the update addressed. Microsoft later removed that line from the notes. Reports say separate teams of journalists spotted the reversal on their own.
September Updates Started the VPN Trouble
Always On VPN is Microsoft’s remote access tool. It lets supported Windows devices join company networks automatically and safely, as shown in Microsoft’s guide. The tool works with domain-joined devices and devices that are not. It also works with devices joined to Microsoft Entra ID.
Microsoft first admitted the bug in late September. By then, users had installed the September 2026 security updates. The company says three things must happen together for the bug to appear. The device must run Windows 11 version 24H2 or later.
The first VPN connection attempt must fail. The VPN profile must also use automatic protocol selection or protocol fallback. The first means the VPN picks a method on its own. The second means it tries another method when the first one fails.
A protocol is simply a set of rules that a VPN follows to connect. When all three conditions meet, the VPN may stay stuck in the connecting stage. It may also fail to connect at all. Later attempts can bring up an error saying the port is already in use.
The bug matters most to groups that let their VPN switch between two protocols. These are Internet Key Exchange version 2 (IKEv2) and Secure Socket Tunneling Protocol (SSTP). The switch happens when one connection attempt fails. These are two different ways for a VPN to build its secure link.
Always On VPN gives employees a way into internal company resources. Constant connection failures can disrupt remote work. They can also make life harder for IT support staff. Still, Microsoft has not said that every device on these Windows versions is affected. The company describes the bug only under the conditions listed above.
Microsoft Shares a Temporary Workaround
Microsoft has a short-term tip for IT admins while it builds the permanent fix. Admins should change affected VPN profiles from automatic protocol selection to a single protocol. They can choose SSTP only or IKEv2 only. Either choice stops the automatic switching between protocols. The best choice depends on the network setup, security needs, and deployment goals. Microsoft advises each group to pick the option that suits its current systems.
This workaround needs a manual check of VPN settings. Admins should not assume that the October updates solved the problem. Organizations should also test the chosen protocol first. That test should happen before any change reaches the whole network.
Microsoft has not given an exact release date for the permanent fix. The company says only that a solution should arrive in an update within the coming weeks.
The VPN bug adds to other problems reported after the September security updates. Microsoft earlier released emergency updates outside its normal schedule. These updates addressed Hyper-V virtual machines, Remote Desktop Services, and some USB audio devices.
The VPN bug adds to other problems reported after the September security updates. Microsoft earlier released emergency updates outside its normal schedule. These updates addressed Hyper-V virtual machines, Remote Desktop Services, and some USB audio devices. Microsoft has also faced pressure to address actively exploited Windows vulnerabilities, including flaws covered in its recent security updates.
The company also posted temporary guidance for a separate Windows 11 domain sign-in problem. It also acknowledged an issue with File History, the built-in backup feature.
For now, groups facing the VPN failure should follow Microsoft’s recommended workaround. They should also watch the official Windows release health announcements for fresh updates from the company.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Canva Confirms Salesforce Data Exposure via Canny as Hackers Claim Millions of Records
Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business c...
Phonelyne Faces Unverified Data Leak Claim Involving eSIM Codes and API Keys
A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne. Th...
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
French Police Shut Down Reacher and Stryx, Arrest Three 17-Year-Olds
French police arrested three 17-year-olds for allegedly operating the Reacher and Stryx stolen data ...
