Microsoft fixes VPN failures from September updates, but only in a preview

A vendor update can change the backup path

Resilience features exist for bad days. If one route fails, the system tries another. Microsoft's release notes describe a case where a September Windows 11 security update disrupted that very behaviour.

The lesson here is that a vendor update can alter how your recovery path works. A fallback only reassures you if you know it still works after each update.

What Microsoft says happened

Microsoft's notes for KB5127936 describe a fix for Always On VPN. The trouble began after the September security update. Always On VPN is a Windows feature that runs in the background. BleepingComputer says it builds secure tunnels back to the company network whenever a device goes online.

Only some setups were affected. They were the profiles set to automatic protocol selection or protocol fallback. Microsoft says some connections could stay in a Connecting state. Others did not connect once a first attempt had failed. In some cases a later attempt showed the message "The specified port is already in use."

BleepingComputer reports that Microsoft first acknowledged the problem in a late-September alert to IT administrators. That alert tied it to automatic choice between two protocols, IKEv2 and SSTP.

How the failure works

A VPN protocol is a set of rules two computers follow to build an encrypted tunnel. IKEv2 and SSTP are two such rule sets. With automatic selection, Windows tries one and then the other if the first fails. That helps when a hotel or office network blocks one of them.

In the affected setups, that second step did not work as intended. The sources do not give a root cause. They describe only the symptoms: a connection that hangs, or a port error on the retry.

For an employee, this looks like a laptop that seems online but cannot reach company systems. For the help desk, it means tickets that start after a routine monthly update.

The fix comes with a choice

The fix is in KB5127936, an optional preview build. It reached Windows 11 25H2 and 26H2 on October 28. A preview update is an early release that comes ahead of the monthly Patch Tuesday update.

Teams that skip the preview have another route. Microsoft suggests editing the VPN profile to use a single protocol, either SSTP only or IKEv2 only. It says to choose based on "environment, security, and deployment requirements."

That workaround has a cost. It removes the automatic fallback. Teams trade flexibility for stability until a regular update carries the fix.

Why a pilot group matters

BleepingComputer also reports that Microsoft earlier marked this issue as fixed in the October 2026 cumulative updates. That was a mistake. It is one correction, so it shows no pattern. It does show why any fix deserves a trial on a small group before wide rollout.

Microsoft's notes also list a separate open issue. Since the September 8 security update, some USB Audio Class 1.0 devices may fail to start or stay silent. Microsoft says it is working on a resolution.

Questions to put to your IT team

Ask which VPN profiles use automatic protocol selection or fallback. Ask how many devices that covers. Ask who decides between a preview update and waiting for Patch Tuesday.

Ask whether a pilot group exists that mirrors your remote workers' networks. Ask whether it tests fallback behaviour after each update, not only the main connection.

Ask what the plan is if you pick a single protocol and a network blocks it. Finally, ask for a written record of how long recovery took the last time remote access failed after an update.

A backup path is part of the system the vendor can change. Check it each time the system changes.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Microsoft.

Follow this story: every update on Windows updates