What Microsoft released: KB5127648 and KB5127646
On Tuesday, Microsoft shipped two cumulative updates — KB5127648 and KB5127646 — that the company says address a known Always On VPN connection issue affecting Windows 11 systems updated in September. Microsoft framed the release as a fix for the bug it first acknowledged in a late-September service alert to IT administrators.
Always On VPN: how the problem manifested and which devices are affected
Always On VPN, the remote access solution that replaced the legacy DirectAccess technology, is used on domain-joined, non-domain-joined, and Microsoft Entra ID–joined Windows 10, Windows 11, and Windows Server devices. The service runs in the background and automatically establishes a secure tunnel back to the corporate network whenever a device connects to the internet.
According to Microsoft, the bug surfaced on up-to-date systems running Windows 11 24H2 and later when the initial VPN connection attempt failed while automatic protocol selection or protocol fallback was in use — commonly when administrators configure the client to try IKEv2 and then fall back to SSTP (or vice versa). In some cases, subsequent connection attempts produced the error, "The specified port is already in use."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTemporary mitigation: a configuration change for IT administrators
For customers unable to immediately install the October 2026 Patch Tuesday cumulative updates, Microsoft published a temporary workaround that requires changing the Always On VPN profile. "IT administrators can mitigate this issue by changing the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only, depending on their environment and configuration," Microsoft said.
Microsoft added guidance that organizations "should select the protocol based on their environment, security, and deployment requirements," making the mitigation a trade-off between operational continuity and whatever constraints or protections the chosen tunneling protocol brings in a particular deployment.
Related update fallout: Remote Desktop Services, Hyper-V, USB audio, and Administrator protection
Microsoft acknowledged that the September 2026 updates triggered several other problems for both home and enterprise users. Last month the company released emergency updates to address Remote Desktop Services failures, Hyper-V issues, and USB audio problems — all tied back to the September updates. This week Microsoft also confirmed a separate symptom: non-admin users may have trouble connecting to devices via Remote Desktop after installing recent Windows updates if the "Administrator protection" security feature is enabled.
What this means for IT administrators, enterprise ops, and end users
- IT administrators: Install KB5127648 or KB5127646 when scheduling permits, or apply the temporary mitigation by changing Always On VPN profiles to SSTP only or IKEv2 only until the cumulative update can be deployed. Monitor Remote Desktop connectivity for non-admin users if "Administrator protection" is enabled.
- Enterprise operations and procurement leaders: Reassess deployment timing and testing windows for critical cumulative updates. Where automatic protocol selection is in use, expect to weigh immediate connectivity needs against protocol-specific security and deployment constraints when choosing the temporary mitigation.
- End users: Devices set to use Always On VPN may have experienced VPN sessions stuck in a Connecting state or failed connections after the September updates; installing the Tuesday cumulative updates or receiving a configuration change from IT should restore normal behavior.
Microsoft's fixes target a narrowly described failure mode — automatic protocol selection or fallback after an initial connect failure — but the company has linked the September updates to a broader set of disruptions (Remote Desktop Services, Hyper-V, USB audio, and the recent non-admin Remote Desktop connectivity issue). For organizations that cannot immediately deploy the October 2026 Patch Tuesday updates, the choice is explicit: accept a single tunneling protocol temporarily or apply the cumulative fixes when operationally feasible. Microsoft’s advisory leaves the decision up to each organization's judgment about environment, security, and deployment requirements.
