KB5127936 preview update reported October 31, 2026; September 2026 updates caused the failures
Microsoft Fixes the Always On VPN Failures Its September Updates Caused, in the KB5127936 Preview for Windows 11
Microsoft has fixed the Always On VPN connection failures that its September 2026 security updates caused on Windows 11, according to the release notes of the KB5127936 preview update for Windows 11 versions 25H2 and 26H2. The failures hit systems where Always On VPN profiles used automatic protocol selection with IKEv2 and SSTP: affected connections could remain stuck in a Connecting state or fail after an initial attempt, and later attempts could display the error that the specified port is already in use. Microsoft first acknowledged the problem in a service alert to IT administrators in late September, then marked the issue as resolved in the October 2026 cumulative updates, then reopened it when the problem proved to still be present. The fix is available now to devices that install the optional October preview update; devices that skip the preview stay affected until the November Patch Tuesday cumulative updates. Organizations that cannot deploy the preview have a documented interim mitigation: change the Always On VPN profile from automatic protocol selection to a single protocol, SSTP only or IKEv2 only, chosen for the environment, and revert the profile once the fixed cumulative update is installed, since the mitigation removes the protocol fallback that automatic selection provides. KB5127936 also resolves a separate known issue in which non-admin users could not connect through Remote Desktop when the Administrator protection feature was enabled after the September preview update or later. Microsoft has not said whether the November cumulative release will include further changes to the VPN fix beyond what ships in KB5127936.
Executives
A broken always-on tunnel is a quiet productivity and security problem at once: staff who cannot connect either stop working or work around the managed connection. This episode also carries a process warning: the issue was marked resolved once, in the October cumulative updates, before being reopened, so a vendor resolved status is a claim to verify on a pilot group, not a closure. The choice this week is explicit: deploy the preview fix to affected devices now, or hold the single-protocol mitigation until the November cumulative update.
CIO / CISO
Scope by profile, not by fleet: the affected configuration is automatic protocol selection with IKEv2 and SSTP on Windows 11 25H2 and 26H2. Pilot KB5127936 on that group first and confirm connections succeed across an initial failure and retry, which is where the port-in-use error appeared. If you applied the single-protocol mitigation, record which devices carry it, because the fallback loss is a resilience change that should be reverted when the cumulative fix lands, and unattended mitigations have a habit of becoming permanent configuration.
Engineers
Reproduce before and after on one test device: automatic selection profile, a forced first-attempt failure, then a retry, checking that the connection completes rather than stalling in Connecting or reporting the port in use. Note the second fix in the same package, Remote Desktop connections for non-admin users under Administrator protection, when you write the change record, so helpdesk staff connect both symptom sets to the same update.
Everyone (non-IT)
If your work laptop VPN has been sticking on Connecting since September, this is the fix for that exact problem, arriving first as an optional preview update your IT team may push to you. Install it when offered and restart if asked. If your connection was switched to a single protocol as a workaround, nothing is wrong: that was the documented temporary measure, and it is reverted once the full fix is in.