Skip to the content
The Update Bureau
Windows 11 26H1 Windows 11 26H1 Security update
Patch Tuesday Zero-day Known issues

KB5127646

KB5127646: Cumulative update for Windows 11, version 26H1, October 2026. Exploited Windows Shell bypass patched; Explorer crashes fixed

In short

Attackers are exploiting a Windows Shell security bypass, and the update fixes Explorer crashes after sign-in on some multi-user systems.

Does it affect you? Applies to: Devices running Windows 11, version 26H1, on x64 or Arm64.

Build
28000.3231
Security
1,055 fixed · 25 critical · 1 exploited
Restart
Required

What changes

Improvements 4 changes

Security updates

  • The update includes security improvements.1

Secure Boot

Gradual rollout Verified in package

For: supported PCs and non-managed business devices

  • More eligible PCs can receive new Secure Boot certificates automatically.2
    Adds high confidence device targeting data. Certificate deployment continues over the coming months on supported PCs and non-managed business devices.

AI components

Verified in package

For: Copilot+ PCs

  • Image Search, Content Extraction, Semantic Analysis, and Settings Model update to version 1.2608.951.0.3
    The updated AI components apply only to Copilot+ PCs; they do not install on other Windows client PCs or Windows Server.

Servicing stack update

Verified in package
  • The included servicing stack update improves the reliability of Windows update installation.4
    Includes KB5127645, build 28000.3225.

Fixes 3 changes

Windows Explorer

For: devices in multi-user environments

  • In some multi-user setups, Explorer starts after sign-in instead of failing or repeatedly crashing to a black screen.5
    Fixes an issue in environments such as Azure Virtual Desktop and FSLogix.

Storage Spaces Direct

For: devices using tiered Storage Spaces Direct virtual disks

  • A problem that could keep tiered virtual disks offline after security updates is fixed.6
    The issue could make dependent clustered workloads unavailable.

Gaming

For: some gamers

  • Mouse input no longer stutters in some games.7

New feature 1 change

ReFS security

  • ReFS volumes on external storage gain audit logging and optional security controls.8
    Auditing is enabled by default. Enforcement controls are disabled by default so administrators can evaluate and prepare for future security hardening changes.

Known issues

  1. Resolved Affects: Organizations and IT administrators Resolved by KB5127653

    Remote Desktop connections might fail for non-admin users with error 0xC000000D

    Non-admin users might fail to connect to Remote Desktop hosts with Administrator protection enabled, seeing error 0xC000000D. KB5127653, released October 27, 2026, resolves this issue.9

    How to apply the workaround Group Policy / Intune

    On affected devices using an update from before October 27, 2026, temporarily turn off Administrator protection by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy.9

  2. Resolved Affects: Everyone Resolved by KB5132059

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices might fail to start or produce no sound. KB5129194 addresses symptoms with 8-channel or 3D audio, but other symptoms remain.10

    How to apply the workaround Workaround

    For multichannel audio symptoms, some customers report restoring sound by switching to 2-channel mode. For other symptoms, IT administrators can contact Microsoft Support for Business.10

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5124006, KB5129194, KB5124012, KB5120996
+13 earlier KB5121000, KB5101681, KB5101649, KB5095091, KB5095051, KB5089570, KB5089548, KB5083806, KB5083768, KB5079489, KB5079466, KB5077239, KB5077179
Replaced by
KB5134134
VersionBuildChannel
26H1 28000.3231 General availability
26H1 28000.3231 Release Preview Channel

Security

1,055 vulnerabilities fixed
1 exploited 25 critical 1030 important
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100219
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-105016
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-105733
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-88073
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108130
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-88074
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 26 exploited, publicly disclosed or critical vulnerabilities. See all 1,055 vulnerabilities →

Updated components

4,880 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings65
Audio47
Graphics and display41
Bluetooth39
Networking33
Windows Update30
Security and sign-in29
Hyper-V and virtualization27
Remote Desktop26
Storage and file systems22
Printing18
Search18

Verified in package: changed files confirm Secure Boot, AI components, Servicing stack update.

Page history

  1. Added 58 vulnerabilities (58 important)

  2. Known issue resolved: Remote Desktop connections might fail for non-admin users with error 0xC000000D (KB5127653)

  3. Superseded by KB5134134

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. This update provides security improvements. support.microsoft.com
  2. 2. This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  3. 3. This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  4. 4. This Windows update includes KB5127645 (Build 28000.3225), which improves the reliability of the Windows update installation process. support.microsoft.com
  5. 5. This update fixes an issue that affects Windows Explorer in multi-user environments, such as Azure Virtual Desktop and FSLogix. support.microsoft.com
  6. 6. This update fixes an issue that affects tiered Storage Spaces Direct virtual disks. support.microsoft.com
  7. 7. This update resolves an issue that could cause mouse input to stutter in some games. support.microsoft.com
  8. 8. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. support.microsoft.com
  9. 9. This issue is addressed by Windows updates released on and after October 27, 2026 (KB5127653). support.microsoft.com
  10. 10. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake