Microsoft’s October 20 change log removed the Always On VPN fix note from Windows 11 update KB5127648 and said the change would be included in a future release. The update therefore did not deliver the fix. The reported temporary workaround is to set an affected profile to one VPN protocol, but the available choice depends on whether it uses User Tunnel or Device Tunnel.
What changed in KB5127648
Microsoft’s servicing page for KB5127648 says the Always On VPN fix information was removed on October 20 and deferred to a future release. The update applies to Windows 11 versions 24H2, 25H2 and 26H2. That is the update’s applicability; the reported VPN issue was described as affecting Windows 11 24H2 and later after the September 2026 security updates.
BleepingComputer reported that Microsoft mistakenly changed the issue’s status to “Resolved” on October 13, then returned it to “Mitigated.” That reported status change is separate from Microsoft’s October 20 servicing-page update.
Reported symptoms and workaround
According to BleepingComputer’s account of Microsoft’s service alert, connections could remain stuck at “Connecting” or fail after an initial attempt when automatic protocol selection or fallback was configured. A later attempt could show “The specified port is already in use.”
Microsoft’s reported mitigation is to change an affected profile from automatic protocol selection to a single protocol, either SSTP or IKEv2. Administrators need to identify the tunnel type before considering that choice: Microsoft documents different protocol support for User Tunnel and Device Tunnel.
Tunnel type determines the available protocols
| Tunnel type | Protocols documented by Microsoft | Relevance to the reported workaround |
| User Tunnel | SSTP and IKEv2 | Both protocols are supported for this tunnel type. |
| Device Tunnel | IKEv2 only | SSTP is not an option; Device Tunnel has no SSTP fallback. |
The reported single-protocol advice does not mean both options suit every deployment. In particular, SSTP-only is not compatible with Device Tunnel’s documented protocol support.
Microsoft’s October 20 change log says the change would arrive in a future release. BleepingComputer reported that Microsoft’s service alert described a planned update in the coming weeks.
