KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

Supply-PWC 1

After installing KB5127648, Windows 11 clients can no longer authenticate to our WPA2-Enterprise (802.1X/PEAP) wireless network. Authentication starts but never completes (Event 12014: OneX Held State timeout). WPA2-Personal networks continue to work. The issue reproduces across multiple hardware vendors and wireless chipsets. Uninstalling KB5127648 immediately restores connectivity. Has anyone else observed this with PEAP-based 802.1X environments?

Shaun 6 Reputation points

2026-10-14T01:38:13.3833333+00:00

Yes, we are experiencing the same issue with our wifi via 802.1X/PEAP. Uninstalling the update and wifi connectivity is restored.
OC 5 Reputation points

2026-10-14T01:44:33.82+00:00

We are also experiencing the same or a very similar issue, we are needing to uninstall the update so our users can access Wi-Fi.
Max Robertson 10 Reputation points

2026-10-14T03:03:43.59+00:00

Same issue observed. Across both WiFi and Ethernet 802.1X.
Trying rollback of KB5127648 to see if this changes anything.
成新斌 0 Reputation points

2026-10-14T03:20:30.0933333+00:00

今天发现公司同仁多台机器遇到类似问题，发现均为今天凌晨打的补丁，卸载KB5127648 更新后，网络恢复正常
K K 0 Reputation points

2026-10-14T03:53:48.28+00:00

遇到同样的问题，卸载KB后正常，用域账号做的wifi认证。
ra-v 5 Reputation points

2026-10-14T07:52:10.79+00:00

Hi,

I can confirm the issue with computer authentication in AD using 802.1x. The first thing I did was remove the recently installed KB5127648 package, which resolved the problem. Next, you need to perform the registry modification to prevent future issues on computers that haven't received the update yet.
Gaurav Kumar 0 Reputation points

2026-10-14T10:42:43.0266667+00:00

Currently we are using Security Protocol WPA2/WPA3-enterprise after uninstall the patch KB5127648 radius authentication is working, if we migrate only to WPA3-Enterprise then radius will work with MS Patch KB5127648 ?
Sam S Ranjith 0 Reputation points

2026-10-14T15:41:23.8933333+00:00

Is this issue occurring only on Windows 11 26H2, or does it also affect Windows 11 25H2 systems with this KB installed?
Nick Haffen 0 Reputation points

2026-10-14T16:48:07.6633333+00:00

The suggested registry fix seems to work fine. Lukily I noticed this before rebooting our other few WiFi clients that need this. I pushed out the registry modification through a group policy. You don't have to uninstall the update if you just modify the registry. I just plug into the network and run 'gpupdate /force' to get it.

14 answers

Alberto Nieto González 0 Reputation points

2026-10-14T14:37:19.44+00:00
Causa: Parche acumulativo KB5127648
Solución : Modificar el Registro de Windows

Puede deshabilitar esta restricción concreta sin necesidad de desinstalar la actualización de seguridad entera. [1]
1. Presione las teclas Win + R, escriba regedit y ejecute como Administrador.
2. Navegue hasta la siguiente ruta: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. En el panel derecho, busque o cree un nuevo valor DWORD de 32 bits.
4. Asígnele el nombre exacto de BlockNtlmv1SSO.
5. Establezca su información de valor en 0.
6. Reinicie el equipo. La autenticación 802.1X volverá a funcionar de inmediato
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
MarkGRubin-4760 0 Reputation points

2026-10-14T12:39:47.1833333+00:00

Dozens of machines in our org affected by this only recourse so far is to uninstall the update and restart
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Ashley C 0 Reputation points

2026-10-14T09:13:43.7633333+00:00

This is going down like a sack of potatoes here!
Was this answer helpful?

1 person found this answer helpful.
Ashley C 0 Reputation points

2026-10-14T09:48:19.8633333+00:00

Registry change does work, EAP-TLS here we come.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Spencer Mathews 0 Reputation points

2026-10-14T14:49:49.3966667+00:00

I am having the same problem in my network, but my question is this: If I uninstall the update, won't it just get installed again?
Was this answer helpful?
Dan 5 Reputation points

2026-10-14T21:39:56.7033333+00:00

@Spencer Mathews It will, but the BlockNtlmv1SSO=0 key allows it to work even after installing the update, and that update did have some zero-day fixes, so as unhappy as I am, I wouldn't recommend uninstalling it.

Set that key, reboot and it should reconnect. If you've already uninstalled it, set that key so it doesn't disconnect you when it does auto-install it again.

I guess we're gonna need to start checking how to migrate away from MSCHAPv2 because probably in a year or so that registry key might be removed completely.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

KB5127648 breaks WPA2-Enterprise (802.1X PEAP) Wi‑Fi authentication on Windows 11

14 answers

Your answer