Microsoft has acknowledged that its October 2026 Patch Tuesday updates for Windows 11 did not actually resolve a connectivity bug affecting Always On VPN, reversing an earlier claim that the issue had been addressed.
Always On VPN serves as the successor to DirectAccess and functions across domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices on Windows 10, Windows 11, and Windows Server. The technology operates continuously in the background, creating encrypted connections to corporate networks whenever a device accesses the internet.
The underlying problem
Microsoft first notified IT administrators in late September about the defect, which emerged on systems running Windows 11 24H2 and later following installation of the September 2026 security updates. The issue manifests when an initial Always On VPN connection attempt fails, particularly when automatic protocol selection is configured with IKEv2 and SSTP.
When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed. In some cases, subsequent connection attempts could display the error, 'The specified port is already in use.'
Microsoft
Mistakenly marked as resolved
Following the release of October 2026 Patch Tuesday cumulative updates for Windows 11, Microsoft initially marked the bug as resolved. However, the company issued a correction on Tuesday, stating that the problem had not been fixed and that a proper resolution would arrive in subsequent weeks.
This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated. A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion.
Microsoft
Temporary workaround available
While developing a permanent fix, Microsoft has provided a temporary mitigation strategy for affected organizations. The approach involves modifying VPN configuration to bypass the problematic automatic protocol selection feature.
IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration. Organizations should select the protocol based on their environment, security, and deployment requirements.
Microsoft
Broader update issues
The September cumulative updates have been associated with numerous additional problems across both consumer and enterprise Windows installations. Microsoft released emergency out-of-band patches days after the monthly Patch Tuesday to address Hyper-V failures, Remote Desktop Services outages, and USB audio malfunctions.
The company also provided a temporary workaround for a separate issue preventing some Windows 11 users from authenticating with valid domain credentials. Additionally, Microsoft is investigating another defect that disabled the Windows File History backup utility.