Microsoft fixes Windows 11 VPN failures
A failed first connection could leave later Windows 11 Always On VPN attempts stuck or unable to connect. Microsoft included a fix in the October 2026 cumulative updates KB5127648 and KB5127646.
Microsoft's update history lists KB5127646 for Windows 11 version 26H2 on October 13, 2026. The update carries OS build 28000.3231, according to the Windows 11 26H2 update history.
The bug affected up-to-date systems running Windows 11 24H2 and later when automatic protocol selection or protocol fallback was configured. Microsoft said connections could hang at "Connecting" or fail outright. A later attempt could return the error "The specified port is already in use."
Choose one protocol if the update must wait
Organizations unable to install the October update right away can use a temporary workaround: change the Always On VPN profile to SSTP only or IKEv2 only. Microsoft advises administrators to make that choice based on their environment and security requirements. Deployment requirements also matter.
Always On VPN runs in the background and automatically creates a secure tunnel to a corporate network when a device connects to the internet. It replaced DirectAccess. The service supports Windows 10 and Windows 11 devices, as well as Windows Server. Supported devices may be domain-joined or non-domain-joined. Microsoft Entra ID-joined devices are supported too.
The September updates have also been linked to Remote Desktop failures for non-admin users when Administrator protection is enabled. Microsoft's separate guidance on that issue is covered in this Remote Desktop report.
