Windows 11 Always On VPN stuck on Connecting: fix is in KB5127936

Microsoft says the optional preview update KB5127936, released on 28 October 2026, fixes the Windows 11 bug that left Always On VPN connections stuck on "Connecting" after the September 2026 security updates. The fix comes after Microsoft briefly told administrators the problem was already solved in the October security update, then took that back. If your VPN profile uses automatic protocol selection, here is what is confirmed, what is not, and what to do.

Key points

• The bug affects Always On VPN profiles set to automatic protocol selection or protocol fallback (IKEv2 and SSTP) after the September 2026 Windows 11 security updates, according to BleepingComputer's account of Microsoft's service alert.
• KB5127936 (released 28 October 2026, builds 26300.9818 and 26200.9818, for Windows 11 versions 26H2 and 25H2) lists a fix for it, per Microsoft's update notes.
• On 13 October, Microsoft's Windows message center said the October security update (KB5127648) addressed the problem. Microsoft later said its internal alert had been "mistakenly updated to Resolved status on October 13, 2026," according to BleepingComputer.
• Until you install the fix, Microsoft's workaround is to set the profile to a single protocol, SSTP only or IKEv2 only.
• KB5127936 is a preview (optional) update, so it is not delivered through the normal security Patch Tuesday channel.

What to do

• Who is affected: Windows 11 devices with the September 2026 security updates that use an Always On VPN profile with automatic protocol selection or fallback between IKEv2 and SSTP. BleepingComputer says Microsoft's alert covered Windows 11 24H2 and later.
• Symptoms to look for: the connection sits in a "Connecting" state, or fails after a first attempt fails. Later attempts can show the error "The specified port is already in use."
• Fix: install KB5127936 on Windows 11 25H2 or 26H2 (Settings > Windows Update > optional updates, or through your update management tooling). Microsoft lists the builds as 26300.9818 and 26200.9818 (the page does not say which maps to which version).
• Workaround without the update: change the Always On VPN profile from automatic protocol selection to one protocol, either SSTP only or IKEv2 only. Microsoft says administrators should choose based on their environment, security and deployment requirements. BleepingComputer reports that Microsoft describes this as temporary, until the next Patch Tuesday cumulative updates.
• How to check if you are affected: look for connections stuck on "Connecting" and the port-in-use error after a failed first attempt, on devices whose profile does not pin a single protocol.

What happened

BleepingComputer reports that Microsoft acknowledged the issue in late September 2026, in a service alert to IT administrators, saying it followed the September security updates on Windows 11 24H2 and later. The trigger is a profile configured for automatic protocol selection or protocol fallback, which tries IKEv2 and SSTP. In affected setups, connections can stay stuck in "Connecting" or fail to reconnect after an initial attempt fails.

On 13 October 2026, the October security update, KB5127648, came out. Microsoft's Windows message center entry for that date, which we read directly, says the update "addresses an issue that could cause Always On VPN connections to become stuck in a connecting state or fail to reconnect when automatic protocol selection or fallback was configured."

That turned out to be wrong. BleepingComputer reported on 21 October that Microsoft had said the alert was mistakenly marked Resolved on 13 October and had returned it to Mitigated, and that Microsoft documented the correction in the KB5127648 notes by removing the information about a fix. At that point Microsoft said a resolution would come in "an update to be released in the coming weeks," with no date.

Then, on 28 October, Microsoft released KB5127936. Its support page, which we read, states that "This update fixes an issue that affects Always On VPN connections after installing September security update," and describes the same group of connections, those configured with automatic protocol selection or protocol fallback, which could stall or fail after a first attempt failed, with later attempts showing "The specified port is already in use." BleepingComputer's report of 30 October says Microsoft confirmed the fix in this preview update.

Background

Always On VPN is Microsoft's Windows-based remote-access feature that keeps a device connected to a corporate network without user action. Administrators define profiles; "automatic" protocol selection lets Windows try one protocol and fall back to another, which is convenient but is exactly the code path this bug affects. Pinning a single protocol avoids the fallback, which is why the workaround works.

The episode is a good example of why release-health notes need dates. The same fix claim appeared, was withdrawn, and appeared again within three weeks. When you read an advisory, check the date and the update it names: the October security update (KB5127648) was the one wrongly credited, and the one that actually carries the fix is the later preview, KB5127936.

What it means

For administrators, the practical decision is whether to deploy an optional preview update to fix this. Preview updates normally carry non-security fixes ahead of the next Patch Tuesday, and they are typically tested in a pilot ring first. The single-protocol workaround costs nothing to roll out through VPN profile management and is reversible, so many organisations will prefer it until the fix arrives in the regular monthly update. Microsoft's own wording of the workaround, as relayed by BleepingComputer, points to the next Patch Tuesday cumulative updates as the time it can be removed.

KB5127936 also carries other fixes. Microsoft lists, among others, a fix for Remote Desktop connections failing with error 0xC000000D for non-admin users when Administrator protection is enabled. We covered that issue in our earlier article on the Remote Desktop fix and the update's other changes in our KB5127936 write-up. Other items in the notes include fixes for Smart App Control, HDMI and DisplayPort audio on some AMD graphics cards, Windows Sandbox, BitLocker pre-boot PIN retries and WSL2 nested virtualization on AMD processors. The update's known-issues section still lists a USB Audio Class 1.0 problem with no resolution date.

A different VPN problem to rule out

If a VPN or Wi-Fi connection that uses MS-CHAPv2 authentication fails after October updates, the cause may not be this bug. Microsoft's message center posted on 14 October a "take action" notice that NTLMv1 hardening changes, starting with the October 2026 security update, might affect Wi-Fi, Ethernet and VPN connections that use MS-CHAPv2 on devices without Credential Guard. Microsoft says explicitly that this "is not a known issue" but a planned change, and recommends migrating to certificate-based authentication. The symptoms differ from the stuck-on-Connecting behaviour above.

What we don't know yet

• Whether Windows 11 24H2 gets the same fix. The service alert covered 24H2 and later, but the KB5127936 notes we read apply to 26H2 and 25H2, and the sources do not say how 24H2 will be handled.
• Whether the fix is complete. Microsoft says KB5127936 fixes the issue; independent confirmation from administrators had not appeared in the sources we reviewed.
• Which exact build to expect for each Windows version. Microsoft lists the pair 26300.9818 and 26200.9818 without the mapping we could confirm.
• When the fix reaches the regular security update channel. BleepingComputer reports Microsoft pointing to the next Patch Tuesday cumulative updates.
• The Windows 11 25H2 release health page we read on 30 October did not list this issue in its known-issues table, so the alert may be visible only in the admin center.

What to watch next

Watch the November Patch Tuesday notes for the VPN fix carried into the regular cumulative update, and for any mention of 24H2. Check the Windows release health dashboard and message center for status changes, and test on a small group of devices before deploying the preview update broadly.

Sources

• Microsoft: KB5127936 (OS Builds 26300.9818 and 26200.9818) Preview (primary source)
• Microsoft: Windows message center (13 and 14 October 2026 entries)
• Microsoft: Windows 11, version 25H2 known issues
• BleepingComputer: Microsoft finally fixes VPN issues caused by September updates
• BleepingComputer: Microsoft says October updates didn't actually fix VPN issues