KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

Supply-PWC 71

After installing KB5127648, Windows 11 clients can no longer authenticate to our WPA2-Enterprise (802.1X/PEAP) wireless network. Authentication starts but never completes (Event 12014: OneX Held State timeout). WPA2-Personal networks continue to work. The issue reproduces across multiple hardware vendors and wireless chipsets. Uninstalling KB5127648 immediately restores connectivity. Has anyone else observed this with PEAP-based 802.1X environments?

Shaun 31 Reputation points

2026-10-14T01:38:13.3833333+00:00

Yes, we are experiencing the same issue with our wifi via 802.1X/PEAP. Uninstalling the update and wifi connectivity is restored.
OC 5 Reputation points

2026-10-14T01:44:33.82+00:00

We are also experiencing the same or a very similar issue, we are needing to uninstall the update so our users can access Wi-Fi.
Max Robertson 10 Reputation points

2026-10-14T03:03:43.59+00:00

Same issue observed. Across both WiFi and Ethernet 802.1X.
Trying rollback of KB5127648 to see if this changes anything.
成新斌 5 Reputation points

2026-10-14T03:20:30.0933333+00:00

今天发现公司同仁多台机器遇到类似问题，发现均为今天凌晨打的补丁，卸载KB5127648 更新后，网络恢复正常
K K 0 Reputation points

2026-10-14T03:53:48.28+00:00

遇到同样的问题，卸载KB后正常，用域账号做的wifi认证。
ra-v 5 Reputation points

2026-10-14T07:52:10.79+00:00

Hi,

I can confirm the issue with computer authentication in AD using 802.1x. The first thing I did was remove the recently installed KB5127648 package, which resolved the problem. Next, you need to perform the registry modification to prevent future issues on computers that haven't received the update yet.
Gaurav Kumar 0 Reputation points

2026-10-14T10:42:43.0266667+00:00

Currently we are using Security Protocol WPA2/WPA3-enterprise after uninstall the patch KB5127648 radius authentication is working, if we migrate only to WPA3-Enterprise then radius will work with MS Patch KB5127648 ?
Sam S Ranjith 0 Reputation points

2026-10-14T15:41:23.8933333+00:00

Is this issue occurring only on Windows 11 26H2, or does it also affect Windows 11 25H2 systems with this KB installed?
Nick Haffen 0 Reputation points

2026-10-14T16:48:07.6633333+00:00

The suggested registry fix seems to work fine. Lukily I noticed this before rebooting our other few WiFi clients that need this. I pushed out the registry modification through a group policy. You don't have to uninstall the update if you just modify the registry. I just plug into the network and run 'gpupdate /force' to get it.
Halla, Steve 0 Reputation points

2026-10-15T02:00:02.0733333+00:00

Yes, every laptop that installed the KB has experienced this provlem with PEAP-based 802.1X environments...every laptop.

Only solution has been to uninstall the KB and prevent updates to be reinstalled

15 answers

Felipe Perez Villegas 0 Reputation points

2026-10-14T12:35:41.16+00:00
Microsoft updates are getting out of hand. Seriously, how did something this critical get released without proper testing? It's ridiculous that companies have to deal with this kind of mess every time an update comes out.

Anyway, this PowerShell command fixed it for us:
```
New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0' -Name 'BlockNtlmv1SSO' -Value 0 -PropertyType DWord -Force
```
Just make sure you run PowerShell as Administrator. Keep in mind this changes an NTLM security setting, so I'd treat it as a temporary workaround until Microsoft fixes the issue properly.
Was this answer helpful?

10+ people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
golg3 0 Reputation points

2026-10-14T11:23:32.9466667+00:00

Yes, I was experiencing this issue with the 802.1x EAP-TLS/PEAP wired and wireless network at my company, and the problem was resolved after uninstalling update KB5127648.
Was this answer helpful?

4 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Alberto Nieto González 0 Reputation points

2026-10-14T14:37:19.44+00:00
Causa: Parche acumulativo KB5127648
Solución : Modificar el Registro de Windows

Puede deshabilitar esta restricción concreta sin necesidad de desinstalar la actualización de seguridad entera. [1]
1. Presione las teclas Win + R, escriba regedit y ejecute como Administrador.
2. Navegue hasta la siguiente ruta: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. En el panel derecho, busque o cree un nuevo valor DWORD de 32 bits.
4. Asígnele el nombre exacto de BlockNtlmv1SSO.
5. Establezca su información de valor en 0.
6. Reinicie el equipo. La autenticación 802.1X volverá a funcionar de inmediato
Was this answer helpful?

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Walid ALILOU 0 Reputation points

2026-10-14T08:55:04.4166667+00:00
We are seeing the same issue. As an immediate workaround, we uninstalled KB5127648, which restored Wi-Fi connectivity.

Our environment uses 802.1X with PEAP/MS-CHAPv2 and Windows single sign-on (to not let user need credential to connect to the Wi-Fi). The Wi-Fi configuration and trust certificates are deployed through Group Policy and Intune. After installing the update, the laptop appears to stop the authentication process before a valid RADIUS Access-Request is sent.

Based on the Microsoft guidance, the sustainable solution appears to be a migration from PEAP/MS-CHAPv2 to EAP-TLS, using machine certificates issued by a PKI and provisioned through Intune.

Our concern is the resulting dependency chain :
- The device must be enrolled and managed by Intune. OK
- The certificate connector must be operational. And if it break ?
- The PKI and certificate publication services must be available. OK
- The certificate must be issued, installed, valid, trusted, and renewed correctly. A lot of question when renewed...
- The Wi-Fi profile must select the correct certificate. OK
If any of these steps fails, the laptop may have no corporate Wi-Fi and no Internet access to retrieve the missing configuration or certificate. This is particularly problematic for Autopilot devices, wiped laptops, expired certificates, and remote users returning to an office. As we tried to remove Network cable and go full Wi-Fi...

It seems disproportionate that a security change requires such a heavy infrastructure and support model. Is Microsoft planning a simpler cloud-managed solution or a supported recovery mechanism for devices that lose access because their EAP-TLS certificate is missing or expired ? Or do we need a workaround (non-secure SSID Wifi, Network Cable), to get back Network when experience issue.
Was this answer helpful?

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
AI answer

2026-10-13T22:27:49.45+00:00
KB5127648 is not currently documented by Microsoft as causing a PEAP/802.1X regression, so first verify the exact package and resulting OS build on an affected client before treating KB5127648 as the originating update.

KB5127648 was released on October 13, 2026 for Windows 11 24H2, 25H2, and 26H2, producing builds 26100.9711, 26200.9711, and 26300.9711 respectively. Its published known-issues section does not list PEAP, 802.1X, or Wi-Fi authentication failures.^1^

Confirm the update chronology

On an affected client, capture the edition, build, installed packages, and installation dates:

Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID, InstalledOn Get-WindowsPackage -Online | Where-Object PackageState -eq Installed | Sort-Object InstallTime -Descending | Select-Object -First 15 PackageName, InstallTime

The expected post-KB5127648 builds are:

Windows 11 24H2: 26100.9711

Windows 11 25H2: 26200.9711

Windows 11 26H2: 26300.9711

If the affected build or installation date differs, identify the cumulative update that actually moved the client to that build. This is particularly important because KB5127648 incorporates earlier updates, so removing it can also remove changes inherited from an earlier cumulative update; rollback correlation alone does not isolate the individual change.

Interpret Event 12014 correctly

OneXHeldStateTimeout means the supplicant’s heldWhile timer expired and 802.1X authentication restarted. It identifies the state-machine outcome, not whether the underlying cause was PEAP negotiation, certificate validation, RADIUS rejection, or missing EAP traffic.^2^

Correlate the same authentication attempt on both sides:

Client: Event Viewer → Applications and Services Logs → Microsoft → Windows → WLAN-AutoConfig → Operational.

NPS server: Event Viewer → Windows Logs → Security.

Find the matching NPS event:

6272: authentication accepted.

6273: authentication rejected; record the Reason Code.

If no corresponding NPS event exists, capture traffic on the client and RADIUS side. Filter client traffic for EAPOL and server-side traffic for EAP.^3^

The result distinguishes three materially different cases:

No request reaches NPS: investigate the Windows supplicant/AP exchange.

NPS records 6273: investigate the recorded policy, credential, or certificate reason.

NPS records 6272 but Windows enters Held state: capture the return EAP/RADIUS exchange between NPS, controller/AP, and client.

Escalation

Because uninstalling the update already restores service across several adapter vendors, preserve one affected machine rather than changing its wireless profile or drivers. Collect:

Before/after OS build and package lists.

Exported WLAN-AutoConfig Operational log.

Matching NPS 6272/6273 events and reason codes.

Wireless/client EAPOL and NPS-side EAP traces.

SSID profile XML with usernames and certificate identifiers redacted.

Exact PEAP inner method and whether server-certificate validation is enabled.

A timestamped comparison from the same device before and after rollback.

Open a Microsoft support case with those artifacts if the affected machine is confirmed at one of the KB5127648 builds. At present, the public KB and release-health material do not establish KB5127648 as a known PEAP regression, so there is no documented Known Issue Rollback or PEAP-specific remediation to deploy.

References

October 13, 2026—KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100. ...

ONEX_AUTH_RESTART_REASON (dot1x.h) - Win32 apps

802.1X authentication issues troubleshooting - Windows Client
AI-generated content may be incorrect. Read our transparency notes for more information.
Was this answer helpful?

2 people found this answer helpful.

KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

15 answers

Confirm the update chronology

Interpret Event 12014 correctly

Escalation

Your answer