Two VPN stories broke in the first two weeks of September 2026, and together they change how IT teams should think about choosing the best business VPN software this year. Microsoft patched a set of critical remote-code-execution flaws in its Always On VPN infrastructure, and a U.S. senator formally pressed the National Security Agency to warn Americans about a VPN spying technique that doesn’t require breaking any encryption at all. If your company still treats “we have a VPN” as a finished security checkbox, these two updates are a reminder that VPN security is never static.
This guide walks through both updates, explains what they actually mean for businesses (not just consumers), and lays out what to look for in business VPN software in 2026 — plus the vendors worth evaluating right now. If you’re starting from scratch, our guide to actually choosing a VPN covers the fundamentals first.
Latest VPN Security News You Need to Know (September 2026)
Microsoft Patches Critical Always On VPN Flaws
On September 8, 2026, Microsoft shipped patches addressing eight vulnerabilities in Routing and Remote Access Service (RRAS), the Windows component many Always On VPN deployments rely on, according to a detailed security advisory breakdown. Four of them are remote-code-execution bugs rated Critical, with a maximum CVSS score of 9.8 — about as severe as a vulnerability rating gets. The update also closed a Critical RCE in SSTP (Secure Socket Tunneling Protocol) and three Important-rated flaws in IKEv2, plus four issues in Active Directory Certificate Services covering privilege escalation, information disclosure, and tampering.
None of this means Always On VPN is unsafe to use — but it does mean any business still running unpatched RRAS or SSTP endpoints is exposed to remote code execution from the internet. If your IT team manages its own VPN gateway rather than relying on a managed business VPN provider, this patch should already be on this week’s to-do list.
A Senator Is Asking the NSA About VPN “Traffic Analysis” Spying
The same week, Sen. Ron Wyden (D-Ore.) asked NSA Director Gen. Joshua Rudd to update the agency’s public guidance on VPN risks, citing a Congressional Research Service analysis of a technique called traffic analysis. Instead of trying to break a VPN’s encryption, an attacker with visibility into both ends of a connection can match the timing and size of encrypted packets entering a VPN server with the packets leaving it — effectively de-anonymizing the user without ever decrypting anything. The CRS report notes this works especially well against single-hop VPNs, which is what most commercial and business VPN products use by default. Wyden has asked for an unclassified answer by October 14, 2026.
For most day-to-day business use, this is a nation-state-level threat model, not something the average small business needs to panic about. But it’s a useful reminder that “VPN” is not a single security guarantee — the architecture behind the product matters.
Why This Matters When You’re Choosing Business VPN Software
Put the two stories together and a pattern emerges: VPN security depends as much on how quickly a vendor patches and how the traffic is architected as it does on encryption strength. That has real implications for which VPN a business should run in 2026:
- A managed business VPN provider that patches its own infrastructure removes the “did IT apply this update yet” risk that hit Always On VPN deployments this month.
- Multi-hop or Zero Trust Network Access (ZTNA) architectures reduce exposure to traffic-analysis-style attacks compared with a single-hop VPN.
- Vendor transparency — public CVE disclosures, third-party audits, published no-logs reports — is now a genuine buying criterion, not just marketing copy.
What to Look for in the Best Business VPN Software (2026 Checklist)
- Zero Trust Network Access (ZTNA) or software-defined perimeter options, not just a traditional shared-tunnel VPN
- WireGuard or a modern equivalent protocol, with legacy protocols like PPTP disabled by default
- Independently audited no-logs policy, with the audit report publicly available
- Centralized admin console with device posture checks, SSO/SAML, and MFA enforcement
- A public, fast-moving security advisory and patch history
- Split tunneling and granular access controls by user, group, or resource
- Kill switch and DNS leak protection on every client, including mobile
Business VPN Options Worth Evaluating in 2026
No single VPN is “best” for every company — the right choice depends on team size, existing identity provider, and whether you need site-to-site connections or just secure remote access. These are widely used options worth putting on a shortlist (see our full enterprise VPN comparison for a deeper side-by-side breakdown):
- NordLayer — Built by the team behind NordVPN, aimed specifically at businesses, with ZTNA, site-to-site VPN, and centralized team management.
- Cisco Secure Client (formerly AnyConnect) — A long-standing enterprise choice that integrates tightly with Cisco’s Duo MFA and Identity Services Engine for larger, already-Cisco-heavy networks.
- Twingate — A ZTNA-first alternative to a traditional VPN, replacing the shared-tunnel model with per-resource access controls, which sidesteps some of the traffic-analysis concerns raised above.
- Cloudflare Zero Trust — Cloudflare’s take on ZTNA, useful for companies that already route traffic through Cloudflare and want to consolidate vendors.
- Proton VPN for Business — Built by the Swiss team behind Proton Mail, with a strong public track record on no-logs audits and transparency reporting.
Before committing, ask each vendor directly about their patch cadence, whether they’ve had a third-party security audit in the last 12 months, and how they’d respond to a traffic-analysis-style threat — the answers will tell you more than any marketing page.
VPN Security Update Checklist for IT Teams
- Confirm this month’s RRAS, SSTP, and IKEv2 patches are applied to any self-managed VPN gateway
- Ask your VPN vendor for their current CVE disclosure and patch history
- Review whether your VPN architecture is single-hop or supports multi-hop/ZTNA
- Confirm MFA is enforced for every VPN account, not just admin accounts
- Set a recurring quarterly review of VPN access — remove accounts for former employees and stale devices
Frequently Asked Questions
Is a traditional VPN still safe for businesses in 2026?
Yes, for most threat models. The vulnerabilities patched this month affect unpatched, self-managed VPN infrastructure specifically — a promptly updated VPN, whether self-hosted or provided by a managed vendor, remains a reasonable baseline security tool.
What’s the difference between a VPN and Zero Trust Network Access (ZTNA)?
A traditional VPN puts a user on the company network once they authenticate, with broad access to everything on it. ZTNA instead grants access resource-by-resource, checking identity and device posture continuously rather than once at login — which limits what an attacker can reach even if one credential is compromised.
How often should companies patch VPN software?
As soon as a vendor releases a security update. For the specific RRAS and SSTP vulnerabilities patched this month, Microsoft rated several as Critical with a 9.8 CVSS score — that’s high-priority-patch territory, not “get to it next sprint.”
The Bottom Line
The best business VPN software in 2026 isn’t just the one with the fastest servers — it’s the one whose vendor patches quickly, discloses transparently, and offers an architecture (ZTNA or multi-hop) that holds up against both old-fashioned exploits and newer traffic-analysis techniques. Use the checklist above the next time your company evaluates or renews its VPN, and keep an eye on the NSA’s response to Sen. Wyden by October 14 — it may reshape official guidance on VPN use for everyone.
