Microsoft has confirmed that the October 2026 cumulative updates for Windows 11 did not fix the Always On VPN connection bug the company had already marked as resolved.

The correction appeared in a service alert sent to IT administrators on Tuesday, and it applies to systems running Windows 11 24H2 and later. A permanent fix is planned for an update in the coming weeks.

According to Microsoft, the known issue entry was "mistakenly updated to Resolved status on October 13, 2026." The status is back to Mitigated. In practice, the documented workaround remains the only option for affected organizations until the fix ships, and installing the October updates on their own changes nothing.

"A resolution for this issue is planned to be included in an update to be released in the coming weeks. We apologize for any inconvenience or confusion," the company told administrators.

Microsoft first acknowledged the problem in late September. The bug shows up on Windows 11 24H2 and later devices after the September 2026 security updates are installed, and it is triggered when the initial Always On VPN connection attempt fails, for example on profiles that use automatic protocol selection with IKEv2 and SSTP.

"When automatic protocol selection or protocol fallback was configured, affected VPN connections could remain stuck in a Connecting state or fail to connect after an initial connection attempt failed," Microsoft explains. Later attempts can also return the error "The specified port is already in use."

Always On VPN replaced the older DirectAccess technology. It runs in the background and opens a secure tunnel to the corporate network whenever a device connects to the internet, with support for domain joined, non domain joined, and Microsoft Entra ID joined devices on Windows 10, Windows 11, and Windows Server. When the tunnel fails, remote employees lose access to internal resources.

The mitigation Microsoft recommends takes automatic protocol selection out of the picture. Administrators should move the Always On VPN profile to a single tunneling protocol:

1. Open the Always On VPN profile assigned to affected Windows 11 24H2 and later devices.
2. Replace automatic protocol selection with one protocol, either SSTP only or IKEv2 only.
3. Choose between SSTP and IKEv2 based on the environment, security, and deployment requirements of the organization, as Microsoft advises.
4. Push the updated profile and check that connections no longer stay stuck in the Connecting state.

The trade-off is the loss of fallback between IKEv2 and SSTP while the workaround is active, so the protocol that remains has to work on every network employees use.

The September updates caused other problems too. Microsoft shipped emergency out-of-band updates for Hyper-V issues, Remote Desktop Services failures, and USB audio problems days after the September Patch Tuesday, and it published a workaround for a bug that blocked some users from signing in with valid domain credentials.

The October 13 release did resolve separate issues, including the Windows 11 black screen and Explorer crash fixes, but the VPN bug was not among them. Microsoft has not named a release date for the permanent Always On VPN fix beyond "the coming weeks."