Windows 11 KB5127648 Breaks Some VPN and Wi-Fi Logins: Who's Affected and How to Fix It

Microsoft’s October 2026 security update for Windows 11 is causing login failures on some VPN, Wi-Fi and wired networks. The update, KB5127648, switches on an NTLMv1 block by default, and anything that still authenticates with MS-CHAPv2 can stop working.

If you use a work VPN or a corporate Wi-Fi network on Windows 11, this could be why you can’t connect since Tuesday. If you use a consumer VPN app like NordVPN or Proton VPN, you’re very likely fine. Here’s the detail.

What happened

Microsoft released KB5127648 on 13 October as part of its monthly Patch Tuesday. It covers Windows 11 versions 24H2, 25H2 and 26H2. A matching update, KB5126646, went out for Windows Server 2025.

Within two days, IT admins were reporting that laptops could no longer join WPA2-Enterprise Wi-Fi. Pureinfotech reported on 15 October that affected PCs start 802.1X/PEAP authentication but never complete it, while home WPA2-Personal networks kept working. A thread on Microsoft Q&A collected similar reports.

On 16 October, Windows Report wrote that Microsoft had confirmed the updates can cause “authentication failures on some Wi-Fi, Ethernet, and VPN connections,” specifically on networks that rely on MS-CHAPv2.

Why it breaks: NTLMv1 goes from audit to enforce

The cause is a security hardening change. Windows has been preparing to retire NTLMv1, an old and weak authentication protocol, for some time. Until now the relevant setting, BlockNtlmv1SSO, ran in Audit mode: legacy logins still worked and Windows just logged a warning.

With KB5127648, on devices where Credential Guard is disabled and the setting hasn’t been set explicitly, Windows now enforces the block. MS-CHAPv2, which many older VPN and network setups use to check usernames and passwords, depends on NTLMv1-derived credentials. Block one and the other fails.

So this isn’t really a bug. It’s Microsoft closing an old door, and some networks were still walking through it.

MS-CHAPv2 has been on borrowed time for years

None of this should surprise network admins. MS-CHAPv2 is old, and its weaknesses are well known. Back in August 2012, Microsoft published Security Advisory 2743314 after exploit code appeared that could recover credentials from an intercepted MS-CHAPv2 handshake on PPTP VPNs. Microsoft’s advice then was to wrap MS-CHAPv2 inside PEAP, or move to a stronger tunnel such as L2TP, IKEv2 or SSTP.

Many organisations took the first option, PEAP-MSCHAPv2, and stopped there. That’s exactly the setup that now fails, because PEAP still relies on the same NTLMv1-derived credentials underneath. Fourteen years later, Microsoft is finally enforcing the clean-up.

For a consumer, the takeaway is simpler. If any VPN you use still offers PPTP, don’t use that option. Our VPN protocols explainer covers which protocols are safe in 2026.

Who is affected

The failures hit connections that authenticate with MS-CHAPv2. In practice that means:

• Enterprise Wi-Fi using 802.1X with PEAP-MSCHAPv2 (common in offices, universities and hospitals)
• Wired 802.1X on some corporate Ethernet networks
• Corporate VPNs set up through Windows’ built-in VPN client with username-and-password authentication over MS-CHAPv2, often on L2TP, PPTP or SSTP profiles
• Managed VPN deployments that use PEAP-MSCHAPv2 for user authentication

Home Wi-Fi with a normal password (WPA2-Personal or WPA3-Personal) is not affected, according to the reports so far.

Does this affect NordVPN, Proton VPN and other VPN apps?

Very unlikely. Consumer VPN apps install their own client and connect with modern protocols, mainly WireGuard, OpenVPN and IKEv2 with certificate-based authentication. They don’t rely on Windows’ MS-CHAPv2 login path.

None of the reports we’ve read so far name a consumer VPN app as broken by this update. TechRadar noted on 15 October that one Reddit user even said their Surfshark connection became faster and more stable after installing it. That’s one anecdote, not a test, but it fits the technical picture.

If your consumer VPN did stop working after the update, look elsewhere first: a reset network adapter, a firewall rule or an app that needs updating. Our VPN keeps disconnecting fixes cover the usual causes. If you set up a VPN manually in Windows settings with a username and password (rather than using the provider’s app), that’s the one case to check, and switching to the official app is the easiest fix. Our Windows 11 VPN setup guide shows both methods.

How to tell if KB5127648 is the cause

Before you change anything, confirm the update is the problem.

1. Open Settings, then Windows Update, then Update history. Look for KB5127648 (or KB5127646 on Windows 11 26H1) under quality updates, installed on or after 13 October.
2. Check what’s failing. If your home Wi-Fi works but the office network doesn’t, or your company VPN rejects a password it accepted last week, that fits the pattern.
3. Check which VPN you’re using. If it’s your provider’s own app with WireGuard or OpenVPN, the update is unlikely to be the cause. If it’s a connection you added under Settings > Network & internet > VPN with a username and password, it might be.
4. Ask a colleague on an unpatched machine to try the same network. If theirs connects and yours doesn’t, you have your answer.

The irony: the same update fixes another VPN bug

KB5127648 also fixes a real VPN problem. CyberInsider reported that it resolves Always On VPN failures where connections using automatic protocol selection got stuck or failed, sometimes with the error “The specified port is already in use.” So for some organisations, the update fixed one VPN issue and created another.

Microsoft’s workaround

Microsoft’s temporary workaround, as reported by Windows Report and Pureinfotech, is to put the NTLMv1 setting back into Audit mode:

1. Back up your system or create a restore point.
2. Open Registry Editor as an administrator.
3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0.
4. Create a DWORD (32-bit) value named BlockNtlmv1SSO, or open it if it already exists.
5. Set its value to 0.
6. Reconnect to the network, and restart if it still fails.

Administrators can push the same setting through Group Policy.

Read the warning before you do this. Microsoft itself says that “restoring Audit mode weakens security protections.” It’s a stopgap. The real fix is to move Wi-Fi, VPN and network authentication off NTLMv1-based methods, for example to certificate-based EAP-TLS for Wi-Fi or IKEv2 with certificates for VPN.

Some users also report success by forgetting the Wi-Fi network and reconnecting, or by uninstalling KB5127648. Uninstalling removes all of October’s security fixes, including a zero-day patch, so it’s the worst option.

If you’re on Windows 11 24H2 Home or Pro

One more detail from this month’s release: CyberInsider notes that October’s update is the final monthly security update for Windows 11 24H2 Home and Pro. If you’re still on 24H2, you’ll need to move to a newer version to keep getting security fixes. That matters for everything, VPN included: an unpatched OS undermines a VPN’s protection. We covered a similar Windows VPN patch earlier this year in our piece on the SSTP vulnerability.

What to do now

If you’re a home user with a VPN app: install the update. It patches a zero-day and is very unlikely to affect your VPN. Keep your VPN app updated too.

If your work VPN or office Wi-Fi stopped working: tell your IT team rather than editing the registry on a managed laptop. They may already be applying the workaround centrally.

If you’re an admin: apply the BlockNtlmv1SSO workaround where you must, and plan the move away from MS-CHAPv2. Microsoft is clearly not going to keep Audit mode around forever.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Picking a VPN for Windows 11

If you’re choosing a consumer VPN for Windows, look for a native app with WireGuard support, an audited no-logs policy and a working kill switch. In our database NordVPN leads at 4.63/5, with 5/5 on speed and a PwC-audited no-logs policy. NordVPN costs $68.85 for a year (about $5.74 a month). Proton VPN (4.24/5, $47.88 a year) is the privacy pick. Our best VPN for Windows 11 roundup has the full list.