- Microsoft's October 13 update fixes a bug that, after the September 8 update, could leave Always On VPN connections stuck when a first attempt failed.
- The workaround, locking the profile to SSTP only or IKEv2 only, removes the fallback path and forces a design choice on administrators.
- Check whether your VPN profiles use automatic fallback, confirm the October update has arrived, and pilot updates on remote devices first.
A company's remote-access tunnel is the part of security that nobody notices when it works. A September Windows update showed what happens when it stops working. Microsoft has now fixed the fault. The details are worth a close read.
What happened
Microsoft's October 13 release notes for KB5127648 describe a bug in Always On VPN. It began after devices installed the September 8 update, KB5124008.
Microsoft says the fault appeared in profiles that let Windows choose the tunnel type. It also appeared where the profile switched to another type after a failure. If the first attempt failed, the connection could stay in a "Connecting" state or never complete. Some users saw the error "The specified port is already in use."
BleepingComputer reports that Microsoft first warned IT administrators in a service alert in late September. It says the affected systems run Windows 11 24H2 and later. The October 13 cumulative updates, KB5127648 and KB5127646, fix the problem on all affected systems.
How the failure works
Always On VPN is built to stay out of sight. BleepingComputer describes it this way: once a device reaches the internet, the service opens an encrypted link to the office network. The user does not have to start it.
Many organisations let the device pick how to connect. It tries one tunnelling method first. If that fails, it tries another. BleepingComputer gives IKEv2 and SSTP as an example pair.
The bug sat in that second step. The route meant for bad network days was the route that failed.
The notes give no cause for the fault. The problem is described only after a first attempt fails. It is not described for every VPN connection. Neither source says how many organisations were affected.
The workaround is a policy decision
Microsoft also offered a stopgap for teams that could not install the October update at once. Administrators can lock the VPN profile to a single tunnel type. The two choices are SSTP only or IKEv2 only.
Microsoft told administrators to pick based on "their environment, security, and deployment requirements." That is a design choice made under time pressure.
As general context, fallback exists so users on networks that block one tunnel type can still connect. Locking a profile to one type gives that up. The sources do not say how many users this would affect.
The lesson: patching is a trade, not a switch
Security teams are told to install updates fast. This case shows the other side of that advice. An update meant to reduce exposure can also interrupt the tunnel that serves remote staff.
Last month, BleepingComputer says, Microsoft also released emergency fixes for Remote Desktop Services, Hyper-V and USB audio faults tied to the September updates.
Microsoft's notes list two problems still open. Non-admin users may fail to start Remote Desktop sessions to devices with Administrator protection on. Some USB Audio Class 1.0 devices may not start. Microsoft calls that issue partly resolved.
One month is not a trend. It is a month in which the update process itself needed careful handling.
This is WebPulse's view, not Microsoft's. A release that fixes 1,411 flaws makes a strong case for installing updates. The VPN bug makes an equally strong case for testing each one on remote devices first.
Questions to put to your IT team
Ask whether any Always On VPN profile uses automatic protocol choice or fallback. If so, ask whether those devices installed KB5124008. Then ask whether the October update has reached them.
Ask who gets the call when remote staff cannot connect. Ask how quickly the team hears about vendor service alerts. Ask how it tests an update before wide rollout.
Ask whether a small pilot group of remote devices gets each update first. Test machines that deliberately fail a first connection attempt could have exposed this fault early.
One more point for planners. Microsoft's notes say the Home and Pro editions of Windows 11 24H2 get no monthly updates after this October release. Check which editions your fleet runs.
A secure network depends on the path to it as much as on the locks. Test the fallback path before an update tests it for you.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Microsoft.
