Description: Always On VPN may stay on Connecting or say the specified port is already in use after KB5124008. Check affected configurations, the KB5127648 fix and safe workplace troubleshooting.
A work PC stuck on “Connecting” in Always On VPN after a Windows update may match a confirmed September 2026 bug. Microsoft says automatic VPN protocol selection or fallback could fail after KB5124008; the October 13 update KB5127648 fixes it.[1][2]
Why does it say the port is already in use?
Always On VPN automatically connects a managed Windows PC to its workplace network. With this bug, an initial connection attempt could fail and leave the VPN waiting indefinitely. Another attempt could show “The specified port is already in use.” The important condition is automatic protocol selection or fallback, not simply having any VPN app installed.[1]
KB5124008 arrived September 8 for Windows 11 24H2 and 25H2. The fixing KB5127648 applies to 24H2, 25H2 and 26H2. Microsoft did not publish an affected-device percentage in these notes.[1][2]
Four checks before changing settings
- Press Win + R, enter winver, and note your Windows version.
- Open Settings → Windows Update → Update history. Look for KB5124008 and KB5127648. The fixed October builds are 26100.9711 (24H2), 26200.9711 (25H2) and 26300.9711 (26H2).[1]
- Check Settings → Network & internet → VPN. Corporate profiles may be locked.
- Record the exact message, time and whether ordinary internet access works. Send this information to IT.
Confirmed fix and temporary option
Install KB5127648 or a later applicable cumulative update through your organization's approved update process. That is Microsoft's documented fix.[1]
If deployment must wait, IT may check gateway compatibility and consider fixing the protocol to IKEv2 or SSTP instead of using automatic fallback. This is a configuration-dependent temporary option, not a universal workaround guaranteed by the update notes. Microsoft says user tunnels support IKEv2 and SSTP, while device tunnels support IKEv2 only.[3]
Do not delete the VPN profile or certificates, disable security controls, or reset Windows to test this symptom. Those steps can remove the access needed for recovery.
Still failing after the fix?
Ask IT to examine gateway availability, certificates, authentication policies and network restrictions. The October update also changed certain older authentication behavior, which is a separate diagnostic path from this resolved fallback bug.[1]
Bottom line
KB5127648 fixes the Always On VPN connection failure associated with KB5124008. Verify the build and preserve the error message before changing anything. Knowing the update history beats guessing at VPN settings.
References (3)
[1] Microsoft Support, “October 13, 2026—KB5127648”, official Always On VPN fix and builds (2026-10-13). https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
[2] Microsoft Support, “September 8, 2026—KB5124008”, Windows 11 24H2/25H2 update (2026-09-08). https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5124008-windows-11-24h2-25h2-security-update
[3] Microsoft Learn, “About Always On VPN for Windows Server Remote Access”, user tunnel and device tunnel protocol support. https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn
