Full Report
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates. [...]
Analysis Summary
# Vulnerability: Windows Always On VPN Connection Failure (Regression)
## CVE Details
* **CVE ID:** N/A (Functional Regression/Bug)
* **CVSS Score:** N/A
* **CWE:** N/A
* **Note:** This issue is a service disruption caused by a security update (regression) rather than a tracked security vulnerability.
## Affected Systems
* **Products:** Microsoft Windows 11
* **Versions:** Windows 11 version 24H2 and later.
* **Configurations:** Systems utilizing "Always On VPN" with automatic protocol selection (e.g., IKEv2 and SSTP) or protocol fallback enabled.
## Vulnerability Description
A bug introduced in the September 2026 security updates caused Always On VPN connections to fail during the initial handshake. When the client attempted automatic protocol selection or experienced a protocol fallback, the connection would hang in a "Connecting" state or fail entirely. Subsequent attempts often triggered a resource conflict error: *"The specified port is already in use,"* indicating the initial failed session did not properly release network resources.
## Exploitation
* **Status:** Not exploited (This is a functional stability issue).
* **Complexity:** N/A
* **Attack Vector:** N/A
## Impact
* **Confidentiality:** None
* **Integrity:** None
* **Availability:** **High** (Prevents remote users from establishing secure corporate network tunnels).
## Remediation
### Patches
Microsoft released cumulative updates on October 14, 2026, to resolve this issue:
* **Windows 11 24H2 and later:** KB5127648 and KB5127646.
### Workarounds
If patches cannot be immediately deployed, IT administrators can mitigate the issue by modifying the VPN profile:
* **Disable Automatic Selection:** Change the Always On VPN profile from "Automatic" protocol selection to a fixed protocol.
* **Force Single Protocol:** Manually select either **SSTP** only or **IKEv2** only, depending on the specific infrastructure requirements.
## Detection
* **Indicators of Compromise:** N/A (Functional bug).
* **Detection methods and tools:**
* Monitor VPN client logs for the error: *"The specified port is already in use."*
* Observe VPN client status stuck indefinitely in the "Connecting" phase.
* Review Event Viewer under `Applications and Services Logs > Microsoft > Windows > RasCfg > Operational`.
## References
* [Vendor Advisory - Microsoft Release Health](hXXps://learn[.]microsoft[.]com/en-us/windows/release-health/)
* [BleepingComputer Article](hXXps://www[.]bleepingcomputer[.]com/news/microsoft/microsoft-fixes-vpn-issues-caused-by-september-windows-updates/)
* [Microsoft Support KB5127648](hXXps://support[.]microsoft[.]com/en-us/help/5127648)