"This disclosure was mistakenly updated to Resolved status on October 13, 2026. We have returned its status to Mitigated," Microsoft wrote in a service alert to IT administrators, acknowledging that the Windows 11 Always On VPN problem marked as fixed in October remained unresolved.
Microsoft's correction, timeline, and apology
Microsoft first acknowledged the Always On VPN problem in a service alert sent to IT administrators in late September, tying the issue to systems running Windows 11 24H2 and later after installing the September 2026 security updates. After shipping October Patch Tuesday cumulative updates, Microsoft briefly marked the bug as resolved but reversed that status in a Tuesday update, saying the issue was not actually addressed and that "a resolution for this issue is planned to be included in an update to be released in the coming weeks." The company apologized for "any inconvenience or confusion."
How Always On VPN connections fail after the September updates
Always On VPN — Microsoft’s replacement for the legacy DirectAccess technology that supports domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices running Windows 10, Windows 11, and Windows Server — runs in the background to establish secure tunnels back to corporate networks. Microsoft described a specific failure mode tied to the September cumulative updates: "When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed." In some instances, subsequent attempts produced the error, "The specified port is already in use."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildTemporary mitigation: pick SSTP only or IKEv2 only
While Microsoft continues to work on a permanent fix, it provided a workaround for affected customers: change the Always On VPN profile from automatic protocol selection to a single tunneling protocol. Administrators can configure the profile to use either SSTP only or IKEv2 only. Microsoft advised that "organizations should select the protocol based on their environment, security, and deployment requirements."
September updates spawned a string of other regressions
The September cumulative updates have been linked to multiple additional problems affecting both home and enterprise Windows users. In the days after that Patch Tuesday, Microsoft issued emergency out-of-band updates to address Hyper‑V issues, Remote Desktop Services failures, and USB audio problems. The company also published a temporary workaround for an issue that blocked some Windows 11 users from logging in with valid domain credentials and said it was working to address a separate bug that broke the Windows built-in File History backup feature.
What this means for IT administrators, organizations, and Windows 11 users
- IT administrators: Microsoft’s service alert directs IT teams to implement the single-protocol workaround (SSTP only or IKEv2 only) while awaiting the forthcoming cumulative update. Administrators should prioritize protocol selection "based on their environment, security, and deployment requirements" and monitor Microsoft’s status updates for the promised resolution.
- Organizations and procurement leaders: The regression sequence — September security updates followed by emergency out-of-band fixes and a mistaken "Resolved" status in October — underscores operational risk tied to cumulative updates. Organizations will need to weigh the tradeoffs of temporary protocol configuration changes against their existing VPN architectures and security policies.
- Windows 11 users: Devices running Windows 11 24H2 and later that rely on Always On VPN may see connections stuck in a Connecting state, fail to reconnect after an initial attempt, or encounter the "The specified port is already in use" error until administrators apply the temporary workaround or Microsoft ships the permanent fix.
The source material also includes a note about defense measurement: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments."
Microsoft has committed to including a full resolution in a forthcoming update "in the coming weeks." Until that update arrives, administrators must choose between changing VPN profiles to a single protocol or continuing to operate with a known connectivity regression — and watch Microsoft’s service alerts closely for the final fix.
