Security1 publisher2 min readPublished
Always On VPN hangs on Windows 11 clients set to fall back between IKEv2 and SSTP
The September 2026 security updates leave affected tunnels stuck in Connecting. Microsoft's interim mitigation pins each profile to a single protocol and drops the fallback attempt while it works on a permanent fix.
The Watch · Security desk
What happened
- Microsoft has told IT administrators that Always On VPN connections may fail after the September 2026 Windows 11 security updates are installed.
- The fault appears where the VPN profile is set to try another connection method when the first one fails, such as automatic protocol selection between IKEv2 and SSTP.
- The interim mitigation is to change the Always On VPN profile from automatic protocol selection to a single protocol, either SSTP only or IKEv2 only.
- The same September cumulative updates drew emergency out-of-band fixes for Hyper-V, Remote Desktop Services failures and USB audio problems one week before this alert.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint The mitigation keeps the update installed and drops the retry, so a client that cannot complete a tunnel with the pinned protocol does not connect at all.
- decision Deciding which protocol survives is now an estate-by-estate judgement, and getting it wrong surfaces as remote users with no path back to internal resources.
- cost The change is a profile edit pushed to every enrolled client, and it has to be pushed a second time to restore fallback once Microsoft ships the fix.
- precedent Six acknowledged problems in one update cycle gives change-control boards a reason to hold Windows 11 cumulative updates. Holding them swaps a VPN outage for time spent unpatched.
The error text is the diagnostic. Microsoft said: "Affected VPN connections might remain in a 'Connecting' state or repeatedly attempt to connect without succeeding. Subsequent connection attempts might also display the error: 'The specified port is already in use.'" [3] A port still held by the failed first attempt is what the retry runs into, and the retry only exists where the profile is configured to try another connection method [2].
Microsoft put the protocol choice on the customer. "Organizations should select the protocol based on their environment, security, and deployment requirements," it said [6]. Always On VPN supports both IKEv2 and SSTP, along with multi-factor authentication, and it lets administrators define which apps and services use the tunnel [11]. The product also runs on Windows 10 and Windows Server and covers domain-joined, non-domain-joined and Microsoft Entra ID-joined devices [10]; the service alert is scoped to Windows 11 [1].
The notice reached administrators as a service alert seen by BleepingComputer and shared by Microsoft MVP Susan Bradley [7]. Microsoft has not given a date for the permanent solution [4].
Add the workaround for Windows 11 users blocked from signing in with valid domain credentials, and the File History backup bug Microsoft said it is working on, and the September 2026 cycle now has six acknowledged issues [9][13].
Nothing here involves an attacker. The failure mode is availability, on devices built to establish a tunnel back to the corporate network automatically whenever they connect to the internet [12]. Estates already running IKEv2 only or SSTP only do not meet the trigger condition Microsoft described [15].
What to watch
- Whether the permanent fix ships out-of-band or waits for October's cumulative update.
- Whether Microsoft publishes affected build numbers and says whether Windows 10 and Windows Server clients hit the same fault.
- Reports of the same port-in-use failure from estates already pinned to one protocol would move the fault away from fallback negotiation.