BleepingComputer (23 September 2026) reports a Microsoft service alert (also shared by MVP Susan Bradley) that September 2026 Windows 11 security updates can break Always On VPN when the profile uses automatic protocol selection between IKEv2 and SSTP. Affected tunnels may stay in Connecting, retry endlessly, or error with “The specified port is already in use.” Originating updates named: Windows 11 26H1 KB5124012; 25H2 and 24H2 KB5124008.

Interim mitigation from Microsoft: pin the AoVPN profile to a single protocol (SSTP only or IKEv2 only) until a permanent fix ships.

Public learn.microsoft.com release-health pages reviewed this pass still lack a dedicated Always On VPN known-issue entry — card primary remains the BC wire citing the Microsoft service alert. Same CU wave previously drove emergency fixes for Hyper-V, RDS, and USB audio.

UPDATE (21 Oct): Microsoft told IT admins in a service alert that the issue was 'mistakenly updated to Resolved status on October 13, 2026' after the October Windows 11 cumulative updates and has been returned to Mitigated; the October updates do not fix it, and a resolution is planned for an update 'in the coming weeks'. The single-protocol (SSTP only or IKEv2 only) mitigation still applies (BleepingComputer, 21 Oct).