Windows 11 Fixes Stuck Always On VPN Connections
October's Windows updates address a specific work-VPN failure after September's patches. If your connection stays on Connecting, ask IT about the update—not a replacement VPN subscription.
The short version
What you need to know
- Microsoft's October update fixes an Always On VPN failure involving automatic protocol selection or fallback after an initial connection attempt failed.
- The symptoms include a connection stuck on Connecting and, in some cases, a port-already-in-use error. Those symptoms alone do not prove this bug is the cause.
- On a managed work computer, ask IT to confirm the applicable update. Do not remove security patches or change the company's VPN profile yourself.
What Microsoft has fixed
Microsoft's 13 October Windows 11 release notes for KB5127648 list a fix for Always On VPN connections affected after installing September's KB5124008 update. The notes describe a specific sequence: automatic protocol selection or protocol fallback was configured, an initial connection attempt failed, and the VPN then remained stuck in Connecting or failed to connect.
Some later attempts could report that the specified port was already in use. This is a connection-reliability issue, not a disclosure that everyone's VPN traffic was exposed. Microsoft's KB5127648 page covers Windows 11 versions 24H2, 25H2 and 26H2; BleepingComputer's 14 October report also identifies KB5127646 as a fix for the separate 26H1 release. Your IT team should match the update to the installed Windows version rather than treating those package numbers as interchangeable.
Why a work VPN needs a different response
Always On VPN is a remote-access setup used to connect a device back to an organisation's network. A fault here can prevent access to work resources even while ordinary websites still load. That does not mean the home router, internet provider or a consumer VPN subscription is necessarily at fault.
The useful distinction is between the employer's access tunnel and a personal VPN service. A retail VPN cannot substitute for the company's approved connection or grant access to its private systems. Buying another subscription is therefore not a remedy for this Windows bug.
What to tell IT—and what not to change
Record your Windows version, the exact error and when the failure began. Tell the help desk whether ordinary internet access still works and whether the problem followed a Windows update. Share screenshots only through an approved support channel, avoiding passwords, recovery codes and confidential information.
Ask whether the October fix applies to your device and when the approved update will arrive. Follow the organisation's restart and reconnection instructions, then report any continuing failure. A matching error is a troubleshooting clue, not a diagnosis: other network or configuration problems can produce similar symptoms.
For organisations unable to update immediately, BleepingComputer reports Microsoft's temporary mitigation: administrators can configure the Always On VPN profile to use only SSTP or only IKEv2 rather than automatic selection. The choice depends on the organisation's security and deployment requirements. This is an administrator decision, not advice for staff to edit profiles, disable protection or bypass access controls.
Where a VPN helps—and where it cannot
A working VPN can protect traffic carried through its tunnel, within the limits of that configuration. It cannot repair an operating-system connection bug simply by being installed. Keep the approved work VPN, operating-system updates and any personal VPN's purpose separate when troubleshooting.
This fix is not a reason to uninstall September's security updates or assume every unrelated VPN disconnect has the same cause. If your personal VPN app is failing rather than your employer's Always On VPN setup, use that provider's official troubleshooting guidance instead of applying a corporate-profile workaround.
Primary reading
Sources and further reading
We add plain-English context and practical advice. These links let you inspect the underlying reporting, research and official guidance directly.