Microsoft has confirmed that this month’s security updates are breaking Always On VPN connections for some Windows 11 users. The affected updates are KB5124012 for Windows 11 26H1 and KB5124008 for Windows 11 25H2 and 24H2. A permanent solution is still in progress. Always On VPN is Microsoft’s remote access technology, the successor to the old DirectAccess, and is available on Windows 10, Windows 11 and Windows Server.
It works with domain-joined, non-domain-joined and Microsoft Login ID devices, supports both IKEv2 and SSTP tunneling protocols along with multi-factor authentication, and automatically establishes its own secure tunnel in the background whenever a device connects to the Internet.
What’s wrong?
The problem, according to BleepingComputer, emerges on Always On VPN profiles configured for automatic protocol selection, where the client tries IKEv2 first and reverts to SSTP if the connection fails. After installing the September update, the fallback process stops. Affected connections may remain in the “Connecting” state or repeatedly attempt to connect unsuccessfully, and subsequent attempts may display the “The specified port is already in use” error. Microsoft’s warning was shared by Microsoft MVP Susan Bradley. In practice, an Always On VPN failure of this type would prevent affected devices from reaching the company’s internal resources through the automatic tunnel until the workaround was applied.
Microsoft’s workaround, for now
While Microsoft develops a permanent solution, it is telling IT administrators to change the Always On VPN profile from automatic protocol selection to a single protocol, SSTP only or IKEv2 only, choosing based on environment, security and deployment requirements. Microsoft hasn’t specified a particular management tool to make this change, so administrators should apply it via the method they already use to configure Always On VPN profiles.
This is one of several issues related to the September 2026 cumulative updates. Last week, Microsoft released emergency updates that address Hyper-V issues, Remote Desktop Services errors, and USB audio issues also triggered by the same updates. It also shared a workaround for a separate issue that prevents some users from logging in with valid domain credentials, and said it’s working to fix a bug affecting Windows’ file history backup feature.
