KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

Supply-PWC 101

After installing KB5127648, Windows 11 clients can no longer authenticate to our WPA2-Enterprise (802.1X/PEAP) wireless network. Authentication starts but never completes (Event 12014: OneX Held State timeout). WPA2-Personal networks continue to work. The issue reproduces across multiple hardware vendors and wireless chipsets. Uninstalling KB5127648 immediately restores connectivity. Has anyone else observed this with PEAP-based 802.1X environments?

Shaun 46 Reputation points

2026-10-14T01:38:13.3833333+00:00

Yes, we are experiencing the same issue with our wifi via 802.1X/PEAP. Uninstalling the update and wifi connectivity is restored.
OC 10 Reputation points

2026-10-14T01:44:33.82+00:00

We are also experiencing the same or a very similar issue, we are needing to uninstall the update so our users can access Wi-Fi.
Max Robertson 15 Reputation points

2026-10-14T03:03:43.59+00:00

Same issue observed. Across both WiFi and Ethernet 802.1X.
Trying rollback of KB5127648 to see if this changes anything.
成新斌 5 Reputation points

2026-10-14T03:20:30.0933333+00:00

今天发现公司同仁多台机器遇到类似问题，发现均为今天凌晨打的补丁，卸载KB5127648 更新后，网络恢复正常
K K 0 Reputation points

2026-10-14T03:53:48.28+00:00

遇到同样的问题，卸载KB后正常，用域账号做的wifi认证。
ra-v 5 Reputation points

2026-10-14T07:52:10.79+00:00

Hi,

I can confirm the issue with computer authentication in AD using 802.1x. The first thing I did was remove the recently installed KB5127648 package, which resolved the problem. Next, you need to perform the registry modification to prevent future issues on computers that haven't received the update yet.
Gaurav Kumar 0 Reputation points

2026-10-14T10:42:43.0266667+00:00

Currently we are using Security Protocol WPA2/WPA3-enterprise after uninstall the patch KB5127648 radius authentication is working, if we migrate only to WPA3-Enterprise then radius will work with MS Patch KB5127648 ?
Sam S Ranjith 0 Reputation points

2026-10-14T15:41:23.8933333+00:00

Is this issue occurring only on Windows 11 26H2, or does it also affect Windows 11 25H2 systems with this KB installed?
Nick Haffen 5 Reputation points

2026-10-14T16:48:07.6633333+00:00

The suggested registry fix seems to work fine. Lukily I noticed this before rebooting our other few WiFi clients that need this. I pushed out the registry modification through a group policy. You don't have to uninstall the update if you just modify the registry. I just plug into the network and run 'gpupdate /force' to get it.
Halla, Steve 0 Reputation points

2026-10-15T02:00:02.0733333+00:00

Yes, every laptop that installed the KB has experienced this provlem with PEAP-based 802.1X environments...every laptop.

Only solution has been to uninstall the KB and prevent updates to be reinstalled
Ibnu 0 Reputation points

2026-10-15T07:28:51.4933333+00:00

Is there any other solution for fix this issue ? if PC is connected to the AD server, and the registry settings are locked by Group Policy from the server. and I don't have access to the AD server.
Mohd Imran 0 Reputation points

2026-10-15T08:46:30.79+00:00

I found a small workaround.

Once the patch is installed, select the wireless network and forget it. Then reboot the system and try connecting to the Wi-Fi using your account. It should connect successfully.
Sigrid Torres Escobar 0 Reputation points

2026-10-15T09:17:04.1833333+00:00

Same issue for wired authentication 802.1x solves by uninstalling the update. Dif Microsoft say something about this??
Rui Pinto Ferreira 20 Reputation points

2026-10-15T09:54:26.7166667+00:00

I’ve discovered a workaround that might help until the RegKey solution is implemented or Microsoft releases a fix: if you select "Forget" for the Wi-Fi network you want to use and re-enter your credentials, it starts working (at least until the next restart).
Travis McKinney 0 Reputation points

2026-10-16T16:46:31.0833333+00:00

This will fix the problem. Run this in powershell administrator privilege.

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" /v BlockNtlmv1SSO /t REG_DWORD /d 0 /f

20 answers

golg3 0 Reputation points

2026-10-14T11:23:32.9466667+00:00

Yes, I was experiencing this issue with the 802.1x EAP-TLS/PEAP wired and wireless network at my company, and the problem was resolved after uninstalling update KB5127648.
Was this answer helpful?

4 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Ashley C 0 Reputation points

2026-10-14T09:13:43.7633333+00:00

This is going down like a sack of potatoes here!
Was this answer helpful?

1 person found this answer helpful.
Ashley C 0 Reputation points

2026-10-14T09:48:19.8633333+00:00

Registry change does work, EAP-TLS here we come.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Walid ALILOU 10 Reputation points

2026-10-14T08:55:04.4166667+00:00
We are seeing the same issue. As an immediate workaround, we uninstalled KB5127648, which restored Wi-Fi connectivity.

Our environment uses 802.1X with PEAP/MS-CHAPv2 and Windows single sign-on (to not let user need credential to connect to the Wi-Fi). The Wi-Fi configuration and trust certificates are deployed through Group Policy and Intune. After installing the update, the laptop appears to stop the authentication process before a valid RADIUS Access-Request is sent.

Based on the Microsoft guidance, the sustainable solution appears to be a migration from PEAP/MS-CHAPv2 to EAP-TLS, using machine certificates issued by a PKI and provisioned through Intune.

Our concern is the resulting dependency chain :
- The device must be enrolled and managed by Intune. OK
- The certificate connector must be operational. And if it break ?
- The PKI and certificate publication services must be available. OK
- The certificate must be issued, installed, valid, trusted, and renewed correctly. A lot of question when renewed...
- The Wi-Fi profile must select the correct certificate. OK
If any of these steps fails, the laptop may have no corporate Wi-Fi and no Internet access to retrieve the missing configuration or certificate. This is particularly problematic for Autopilot devices, wiped laptops, expired certificates, and remote users returning to an office. As we tried to remove Network cable and go full Wi-Fi...

It seems disproportionate that a security change requires such a heavy infrastructure and support model. Is Microsoft planning a simpler cloud-managed solution or a supported recovery mechanism for devices that lose access because their EAP-TLS certificate is missing or expired ? Or do we need a workaround (non-secure SSID Wifi, Network Cable), to get back Network when experience issue.
Was this answer helpful?

8 people found this answer helpful.
Noah DeLaughter 0 Reputation points

2026-10-15T16:59:45.4533333+00:00

Thanks Walid. Very similar environment here. Spent hrs. troubleshooting Wi-Fi/Radius only to realize it was a Windows issue then found this page. Uninstalled the update and immediate service restoration. Do you have a link to Microsoft's guidance? I agree it's a bit ridiculous to kill many organization's Wi-Fi due to MS having a preference for a much more complicated model. Especially if you can't use Intune.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Hüseyin NAZLI 0 Reputation points

2026-10-14T08:30:44.7166667+00:00
```
Hello,
I am experiencing the same issue; machines that received the update cannot connect to Wi-Fi using 802.1X. As a workaround, we connect using a different SSID with a username and password, or we uninstall the latest update.
```
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Dan 10 Reputation points

2026-10-14T07:54:52.63+00:00

BlockNtlmv1SSO=0 worked for me as well. Added it to a GPO for the time being.

This is a complete disaster though. I usually do testing and gradual updates when there's a new feature update, not on every single Patch Tuesday. Since when does Microsoft introduce breaking changes in routine monthly updates?
Was this answer helpful?

10+ people found this answer helpful.
SD Daniel 0 Reputation points

2026-10-14T08:38:21.9933333+00:00

Same thing here, we changed the registry and it fix the issue

Bryan Dam 30 Reputation points

2026-10-14T14:59:05.75+00:00

They've been doing this for years. It's literally standard operating procedure for dealing with certain kinds of security flaws. They add a reg key to enable (or sometimes disable) the protection, then they change that key's default value to be secure, then they remove the key entirely and enforce the protection globally.

In this case, they told us over a year ago that this was coming: https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update

Dan 10 Reputation points

2026-10-14T21:36:44.0166667+00:00

@Bryan Dam Right, but I naively assumed those changes would be as part of 26H2 update or something of the sort. It's a bit unreasonable to assume every admin would check every doc they write for things that could require action, and now I need to be concerned of every routine patch.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

20 answers

Your answer