The windows 11 vpn bug that Microsoft said it had fixed in October is still active — the company has reclassified it as unresolved after discovering its own patch didn’t actually repair the problem. If your Always On VPN connections have been dropping or failing to negotiate a protocol since late summer 2026, you’re not imagining it, and reinstalling updates won’t help yet.
What Is the Windows 11 VPN Bug, and Why Did Microsoft Reclassify It?
The issue traces back to the September 2026 security update, KB5124008, released on September 8, 2026. That update broke Always On VPN connections configured to automatically try another protocol when the first one fails — typically falling back between IKEv2 and SSTP. Devices with that automatic fallback setting simply stopped connecting.
Microsoft then shipped KB5127648 on October 13, 2026, and told customers it had resolved the Always On VPN failure. Weeks later, that claim fell apart. Microsoft’s own support documentation confirms that, since October 2026, the KB5127648 article has been revised to remove the entry describing the VPN repair, with Microsoft stating the fix never actually shipped as described.
Why Microsoft Walked Back the October Fix Claim
According to reporting on the reversal, Microsoft discovered the discrepancy after customers kept reporting the same Always On VPN failures even on systems fully patched with KB5127648. Rather than quietly leaving the inaccurate note in place, Microsoft confirmed to BleepingComputer that it mistakenly flagged the bug as fixed in the October cumulative updates and that work on an actual resolution is ongoing. In other words, the Windows 11 VPN bug never left — it was simply marked “resolved” by mistake.
Who Is Affected by the Windows 11 Always On VPN Issue
This bug targets a fairly specific but widely used configuration: Windows 11 devices using Microsoft’s Always On VPN feature with automatic protocol selection enabled, most commonly deployed to corporate laptops through Intune or Group Policy. Confirmed affected platforms include:
- Windows 11, version 24H2
- Windows 11, version 25H2
- Windows 11, version 26H2
Home users on a standard third-party VPN client are generally not affected — this is specific to the native Always On VPN device and user tunnel architecture built into Windows, which is far more common in managed business and government environments than on personal PCs. IT administrators who rely on Always On VPN for remote access security are the ones feeling the brunt of this Windows 11 Always On VPN issue. The stakes are real: Verizon’s 2026 DBIR found that edge devices and VPNs accounted for 22% of exploitation-driven breaches, up from 3% a year earlier, according to VPN Statistics 2026.
VPN Connectivity Bug on Windows 11: Timeline of Key Updates
Keeping track of which patch did what matters here, since the fix status has flipped more than once. Here’s the sequence:
- September 8, 2026 — KB5124008 ships and introduces the Always On VPN connection failure tied to automatic protocol fallback.
- October 13, 2026 — KB5127648 is released; Microsoft’s support notes initially credit it with resolving the VPN issue.
- Mid-to-late October 2026 — Reports continue of failed Always On VPN connections on fully patched devices.
- October 20, 2026 — Microsoft revises the KB5127648 support article, removes the fix claim, and confirms the Windows 11 VPN bug remains unresolved.
This back-and-forth is also why checking your current patch level alone won’t tell you whether you’re safe — the presence of KB5127648 does not guarantee the connectivity problem is gone.
What to Do While the Windows 11 VPN Bug Remains Unresolved
There’s no permanent patch yet, so the practical path is mitigation rather than waiting it out. The good news is the known workaround is simple to apply and doesn’t require rolling back security updates.
Workaround for IT Administrators and Always On VPN Profiles
The documented mitigation is to change the Always On VPN profile from automatic protocol selection to a single, fixed protocol — either IKEv2 or SSTP, rather than letting the client try one and fall back to the other. This removes the exact condition that triggers the failure. Steps for most environments:
- Open your VPN profile configuration (Intune, GPO, or PowerShell deployment script).
- Locate the protocol selection setting and switch it from automatic to a single protocol.
- Redeploy the profile to affected device tunnels and user tunnels.
- Test the connection on a pilot group before pushing it fleet-wide.
If your organization was also hit by the related Smart App Control problem tied to the same KB5127648 update, it’s worth auditing that update’s other known issues at the same time rather than troubleshooting each symptom separately.
What Individual Users Can Try at Home
If you manage your own device and rely on a corporate Always On VPN profile, you have fewer levers to pull, but a few things help:
- Ask your IT team whether the single-protocol workaround has been applied to your profile yet.
- Manually reconnect rather than waiting for automatic reconnection, which is more likely to hit the fallback failure.
- Avoid uninstalling KB5124008 or KB5127648 to “fix” the VPN on your own — removing security updates reopens patched vulnerabilities and may not even resolve the connection issue.
- If a VPN connection is active while you’re troubleshooting Windows activation on a new install, disable it first — an active VPN is a known cause of activation failures unrelated to this bug, and temporarily turning it off often clears that specific error.
How to Protect Your PC While This Windows 11 VPN Bug Persists
Staying current with updates is still the right default, even with one feature temporarily broken — skipping security patches to dodge a single known issue exposes you to much bigger risks. The smarter approach is to apply updates normally, but test VPN connectivity immediately after each Patch Tuesday cycle so you catch regressions early rather than discovering them mid-workday.
It also helps to be running a clean, properly licensed copy of Windows 11, since troubleshooting steps like checking update history, rolling back a specific KB, or reconfiguring network profiles are far more reliable on a genuine installation than on an unlicensed one. If you’re setting up a new machine or replacing an aging install, a genuine Windows 11 Pro license gives you full access to Microsoft’s update history and support tools, which matters when you need to track exactly which patch changed your VPN behavior. For ongoing update issues beyond this one, our Windows Troubleshooting resources cover other Patch Tuesday regressions as they’re confirmed.
Frequently Asked Questions
What causes the Windows 11 VPN bug?
The bug originates in the September 2026 security update, KB5124008, which broke Always On VPN connections configured to automatically fall back between protocols like IKEv2 and SSTP. The October update that was supposed to fix it, KB5127648, did not actually resolve the underlying issue.
Does the Always On VPN bug in Windows 11 affect Windows 10 too?
Microsoft’s confirmed affected platforms for this specific bug are Windows 11 versions 24H2, 25H2, and 26H2. If you’re on Windows 10 and experiencing VPN issues, it’s worth checking your own update history separately, since this particular reclassification applies to Windows 11 builds.
How can I tell if I’m affected by this VPN connectivity bug on Windows 11?
You’re most likely affected if your organization uses Always On VPN with automatic protocol selection and your connections started failing or dropping after installing the September or October 2026 cumulative updates. Devices using a single fixed protocol, or third-party VPN clients instead of the native Always On VPN feature, are not part of this particular issue.
Will uninstalling KB5127648 fix the issue?
No — uninstalling the update is not a recommended fix. It removes other security protections included in that cumulative update without guaranteeing the VPN connection issue disappears, since the bug originated in the earlier September update.
When will Microsoft release a permanent fix?
Microsoft has acknowledged the Windows 11 VPN bug is unresolved and stated that work on a real fix is ongoing, but no confirmed release date has been published. Until then, the recommended path is the single-protocol workaround on affected VPN profiles.
