Microsoft has withdrawn its claim that the October 2026 Windows 11 cumulative update fixed the Always On VPN failures caused by September's patches. The fix is now due in a later release.
What happened
The September 2026 Windows 11 security updates broke Always On VPN. Where a profile used automatic protocol selection or protocol fallback, typically IKEv2 with SSTP, the connection could stay in a Connecting state or fail after the first attempt, with later attempts returning the error that the specified port is already in use.
On 13 October Microsoft marked the issue resolved alongside the October cumulative updates. On 20 October it reversed that: the release health entry went back to Mitigated, and the note describing the VPN fix was removed from the KB5127648 changelog. Microsoft says a resolution is planned for an update in the coming weeks.
Who is affected
- Windows 11 devices on versions 24H2, 25H2 and 26H2 carrying Always On VPN profiles, whether device tunnel or user tunnel
- Remote and hybrid staff whose only path to file shares and line-of-business systems is an always-on tunnel
- Estates where VPN profiles are deployed by Intune, Group Policy or a third-party MDM with automatic protocol selection left on
- Help desks that closed September tickets believing the October patch had cleared them
What to do now
Edit every affected Always On VPN profile to use a single tunnelling protocol, IKEv2 only or SSTP only, and leave it that way until Microsoft ships the real fix.
- List all VPN profiles and flag any set to automatic protocol selection or fallback
- Pick the protocol your concentrator supports best, push the change, and confirm on a test laptop
- Reopen any September ticket closed as fixed by the October update and recheck those users
- Record the reason in the change log so the next engineer does not revert it
- Do not uninstall the October security update as a workaround; the fix is a profile change, not a rollback
What this means for South African businesses
Always On VPN is a domain-managed feature, so the exposure sits with organisations running Intune or Group Policy fleets and a Windows Server remote access role, not with a small office running a client-based SSL VPN. For those estates the practical damage is staff who cannot reach a file server from home, plus a support queue that believes the problem is closed.
My read: the more useful lesson for an SME is procedural. A vendor marking a bug as resolved is not evidence that it is fixed on your devices, and a five-minute test on one affected laptop would have caught this before the ticket closed.
Source: BleepingComputer - Microsoft says October updates didn't actually fix VPN issues.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.