Windows 11 Always On VPN Stuck on Connecting: Who’s Fixed and Who’s Still Waiting

If your Windows 11 Always On VPN connection keeps hanging on “Connecting” after a failed first attempt, it isn’t your network and it isn’t you. Microsoft traced the problem to September’s security updates, and a real fix has now shipped, but only for some versions of Windows 11. Here’s who is covered, who is still waiting, and what to do in the meantime.

Here’s the short version before the details:

• Affected: Windows 11 24H2 and later, after the September 2026 security updates, according to BleepingComputer.
• Trigger: profiles that use automatic protocol selection with IKEv2 and SSTP fallback.
• Error you may see: “The specified port is already in use.”
• Fix: KB5127936, an October optional preview update, for Windows 11 25H2 and 26H2.
• Stopgap: set the profile to SSTP only or IKEv2 only.

If you manage VPN profiles for a team, the protocol setting is the first thing to check.

What the Windows 11 Always On VPN bug looks like

The symptoms are easy to spot. A tunnel that should come up on its own sits at Connecting, or it fails after the first attempt doesn’t work out. Later retries can throw “The specified port is already in use.” Microsoft says this happens when automatic protocol selection or protocol fallback is configured, using IKEv2 and SSTP.

The error text hints that the failed first attempt leaves the connection stuck, so the fallback can’t start cleanly. That’s my reading, though, not Microsoft’s explanation, and the sources I checked don’t give a deeper root cause.

The status of this bug has been messy. Microsoft acknowledged it in late September, marked it resolved after October’s Patch Tuesday updates, then admitted that was a mistake. As BleepingComputer reported on October 21, Microsoft returned the status to “Mitigated” and apologized for the confusion.

Which versions have the fix, and which are still waiting

The cleanest fix so far is the October preview update. BleepingComputer reported on October 30 that KB5127936 resolves the issue and covers Windows 11 25H2 and 26H2. Here is how that breaks down by version, based on that report and a Windows Forum write-up:

The table matters most for people on 24H2. According to ITdaily, KB5127648 was the last update for 24H2 Home, Pro, Pro Education and Pro for Workstations, and those PCs “must first upgrade to 25H2 or 26H2” to get later fixes. If you haven’t made that jump yet, our guide to getting Windows 11 26H2 takes about five minutes.

One more wrinkle: ITdaily also credited KB5127648 with fixing the VPN bug, which is the claim Microsoft later walked back. Trust the later reports over that early one.

The workaround for admins, and what it costs you

Microsoft’s stopgap is to stop relying on automatic fallback. In the Always On VPN profile, change automatic protocol selection to a single protocol: “either SSTP only or IKEv2 only, depending on their environment and configuration.”

There’s a catch. Windows Forum notes that forcing IKEv2 only can cut off users on networks that block IPsec, while SSTP only gives up IKEv2 entirely. It also suggests reviewing device tunnels and user tunnels separately.

For a small fleet, a sensible order looks like this:

• Run winver on a sample PC to confirm the build and Windows 11 version.
• Pilot one fixed protocol on a test group, including someone on a network that blocks IPsec.
• Switch back to automatic only after you’ve confirmed the fixed build and tested fallback.

That last test is the one people skip, and it’s the exact scenario that triggered the bug.

Install the preview now, or wait for November’s updates?

BleepingComputer said the workaround is temporary, until next month’s Patch Tuesday cumulative updates. Those landed on November 10 as KB5132061 and KB5131087, and BleepingComputer’s write-up says they are mandatory because they carry the November security patches.

That write-up doesn’t mention a VPN fix, and it says Microsoft isn’t aware of any new issues with this month’s release. So I can’t confirm the November rollup closes the gap for every version. Check the Windows release health page for your build before you remove the workaround.

We covered the rest of that release, including a live Outlook zero-day, in our November Patch Tuesday breakdown.

One scope note: Always On VPN is a Windows feature that organizations typically configure. A consumer VPN app on your home PC isn’t the same thing, so this bug probably isn’t behind your connection troubles there.

Frequently Asked Questions

Why is my Windows 11 Always On VPN stuck on Connecting?

If you installed the September 2026 updates on 24H2 or later and your profile uses automatic IKEv2 and SSTP fallback, this bug is a likely cause. Credentials and network problems can produce the same symptom, so rule those out too.

Does KB5127936 fix Windows 11 Always On VPN?

For 25H2 and 26H2, yes, according to BleepingComputer. It’s an optional preview update, so you’ll need to opt in or wait for it to roll into a monthly update.

Is Windows 11 24H2 still getting fixes?

It depends on the edition. ITdaily reports that Home and Pro devices got their last update in October. Windows Forum adds that Enterprise and Education editions still get monthly security updates, but no previews.

What’s the quickest workaround?

Edit the Always On VPN profile so it uses one protocol, either SSTP only or IKEv2 only, instead of automatic selection. Test it from a network that blocks IPsec first.

My verdict: fix the protocol first, then patch

If you’re on 25H2 or 26H2, test the fixed build on a pilot group and drop the workaround once fallback works from a network that blocks IPsec. If you’re on 24H2 Home or Pro, stop waiting for a patch that isn’t coming and plan the move to a newer version. The protocol setting buys you time, not a real fix.