Skip to the content
The Update Bureau
Windows 11 24H2 / 25H2 / 26H2 Windows 11 24H2 / 25H2 / 26H2 Security update
Patch Tuesday Zero-day Final update for this version

KB5127648

KB5127648: Cumulative update for Windows 11, versions 24H2, 25H2 and 26H2, October 2026. Exploited Shell bypass addressed; 24H2 Home and Pro reach end of updates

In short

Addresses an actively exploited Windows Shell security feature bypass and fixes several problems, including Explorer startup failures and game input stuttering. It is the final update for 24H2 Home and Pro.

Does it affect you? Applies to: Devices running Windows 11, versions 26H2 (build 26300.9711), 25H2 (build 26200.9711), or 24H2 (build 26100.9711). Version 24H2 Home and Pro have reached end of updates with this release.

Builds
26100.9711 · 26200.9711 · 26300.9711
Security
1,067 fixed · 25 critical · 1 exploited
Restart
Required

What changes

Fixes 6 changes

Windows Explorer

  • In some multi-user environments, Explorer no longer fails to start or repeatedly crashes after sign-in and causes a black screen.1
    Addresses Windows Explorer startup and crash issues in environments such as Azure Virtual Desktop and FSLogix.

Audio

Verified in package
  • Applications affected by the AC-3 audio playback issue no longer encounter that issue.2
    Fixes the AC-3 audio playback issue; the status page says the issue is resolved by this update.

Storage Spaces

  • Tiered Storage Spaces Direct virtual disks are less likely to fail to come online after certain security updates, which could otherwise make clustered workloads unavailable.3
    Fixes an issue affecting tiered Storage Spaces Direct virtual disks after installing certain security updates.

Printing

Verified in package
  • Printing works again in affected applications and on devices using RAW or Generic Text Only printer drivers.4
    Resolves printing failures that could occur after installing the August 2026 security update.

Gaming

  • Mouse input stuttering in some games is fixed.5

Windows Hello

  • Fingerprint sign-in works after a cold boot on devices affected by the issue.6

Improvements 6 changes

Security updates

  • The update includes security improvements, including an update that addresses an actively exploited Windows Shell security feature bypass.7
    Addresses CVE-2026-96951.

Secure Boot

Gradual rollout Verified in package
  • Eligible devices continue to receive newer Secure Boot certificates through Windows Update. Devices that have not received them can still start and receive standard Windows updates.8
    Deployment uses the latest high-confidence targeting data to identify eligible devices ready to receive the certificates automatically.

ReFS security

For: Devices using ReFS on externally attached storage

  • ReFS volumes on externally attached storage devices gain auditing and optional security controls. Auditing is on by default; enforcement remains off by default.9
    Adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. Enforcement controls remain disabled by default so administrators can evaluate and prepare for future hardening.

Authentication

For: Devices with Credential Guard disabled and no BlockNtlmv1SSO value

  • In some configurations, Windows now blocks NTLMv1-derived credentials for single sign-on by default. This might affect Wi-Fi, Ethernet, or VPN connections that use MS-CHAPv2 authentication.10
    When Credential Guard is disabled and BlockNtlmv1SSO is not set, the internal default changes from Audit mode (0) to Enforce mode (1).

AI components

Verified in package

For: Copilot+ PCs

  • The Image Search, Content Extraction, Semantic Analysis, and Settings Model AI components are updated.11
    These components are updated to version 1.2608.951.0. AI components apply only to Copilot+ PCs and do not install on other Windows client PCs or Windows Server.

Servicing stack update

Verified in package

For: Devices installing this update

  • The included servicing stack update improves the reliability of Windows update installation.12
    Includes KB5127647, build 26100.9703.

New feature 1 change

Date and Time

For: Devices using the Manitoba time zone

  • The time-zone list includes (UTC-05:00) Manitoba for the region’s November 1, 2026 time-zone change.13

Known issues

  1. Resolved Affects: Organizations and IT administrators

    Remote Desktop connections might fail for non-admin users with error 0xC000000D

    Non-admin users might be unable to connect to remote devices with Administrator protection enabled. The connection can fail with error 0xC000000D and the message “The token that was passed to the function is invalid.” This primarily affects enterprise-managed Remote Desktop hosts.14

    How to apply the workaround Group Policy / Intune

    IT administrators can temporarily turn off Administrator protection by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy.14

  2. Resolved Affects: Everyone Resolved by KB5129195

    USB audio devices might fail to start or produce no sound

    Some USB Audio Class 1.0 devices might fail to start or produce no sound. Symptoms can include Device Manager error Code 10, no audio output, unresponsive volume controls, or unavailable sound settings. KB5129195 partially resolved the issue for devices using 8-channel or 3D audio modes; other symptoms remain.15

    How to apply the workaround Workaround

    Some customers report restoring audio by switching to 2-channel mode. For symptoms not addressed by KB5129195, IT administrators can contact Microsoft Support for Business for assistance.15

  3. Resolved Affects: Everyone

    You might be unable to turn on Smart App Control

    On some devices, Smart App Control might be grayed out and unavailable to turn on if it was previously turned off. Devices where it is already on are not affected.16

    How to apply the workaround Registry / GPO

    The registry values restore the ability to turn on Smart App Control. The two Group Policies enable the feature and its troubleshooting logging.16

    Step-by-step instructions, command & download kit
    2 steps cmd.exe · Administrator Power-User Kit (.zip)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Open Command Prompt as administrator.
    2. Run both registry commands, then restart the device.
    cmd.exe · Administrator 
    > reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f> reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5124010, KB5129195, KB5124008, KB5120998
+62 earlier KB5121003, KB5101684, KB5121767, KB5101650, KB5095093, KB5094126, KB5089573, KB5089549, KB5083631, KB5083769, KB5086672, KB5079391, KB5085516, KB5079473, KB5077241, KB5077181, KB5074105, KB5078127, KB5077744, KB5074109, KB5072033, KB5070311, KB5068861, KB5067036, KB5070773, KB5066835, KB5065789, KB5068221, KB5065426, KB5064081, KB5063878, KB5062660, KB5064489, KB5062553, KB5060829, KB5063060, KB5060842, KB5058499, KB5061977, KB5058411, KB5055627, KB5059087, KB5055523, KB5053656, KB5053598, KB5052093, KB5051987, KB5050094, KB5050009, KB5048667, KB5046740, KB5046617, KB5044384, KB5044284, KB5043178, KB5043080, KB5041865, KB5041571, KB5040529, KB5040435, KB5039304, KB5039239
Replaced by
KB5134133
VersionBuildChannel
24H2 26100.9711 General availability
25H2 26200.9711 General availability
26H2 26300.9711 General availability

Security

1,067 vulnerabilities fixed
1 exploited 25 critical 1042 important
VulnerabilitySeverityCVSS
CVE-2026-96951 Exploited
Windows Shell Security Feature Bypass Vulnerability
 Important 8.8
CVE-2026-100202
Windows Message Queuing Queue Manager Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100219
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-105016
Microsoft QUIC Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70147
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-70153
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-97814
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-100220
Windows Media Video Decoder Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102214
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102225
Windows Text Shaping Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-105733
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108467
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-83934
Windows GDI+ Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-88073
Windows Graphics Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96913
Windows Kernel Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-96952
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-108460
Windows Message Queuing Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70229
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-100215
Microsoft Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-108130
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-88074
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
 Critical 7.5
CVE-2026-108399
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 7.2
CVE-2026-102211
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
 Critical 7.0
CVE-2026-83917
Windows ALPC Elevation of Privilege Vulnerability
 Critical 7.0

The table lists the 26 exploited, publicly disclosed or critical vulnerabilities. See all 1,067 vulnerabilities →

Updated components

4,648 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings64
Audio46
Graphics and display43
Bluetooth37
Remote Desktop30
Windows Update30
Hyper-V and virtualization29
Networking29
Security and sign-in27
Storage and file systems26
Printing19
Search17

Verified in package: changed files confirm Audio, Printing, Secure Boot, AI components, Servicing stack update.

Page history

  1. Known issue resolved: USB audio devices might fail to start or produce no sound (KB5129195)

  2. Added 58 vulnerabilities (58 important)

  3. Known issue resolved: You might be unable to turn on Smart App Control

    Known issue resolved: Remote Desktop connections might fail for non-admin users with error 0xC000000D

  4. Superseded by KB5134133

Sources

Updated
Cited passages from Microsoft's official notes (16)
  1. 1. This update fixes an issue that affects Windows Explorer in multi-user environments, such as Azure Virtual Desktop and FSLogix. support.microsoft.com
  2. 2. This issue was resolved by Windows updates released October 13, 2026 (KB5127648), and updates released after that date. learn.microsoft.com
  3. 3. Some virtual disks might fail to come online after installing certain security updates, making dependent clustered workloads unavailable. support.microsoft.com
  4. 4. This update resolves an issue where printing could fail in some applications and on devices using RAW or Generic Text Only printer drivers support.microsoft.com
  5. 5. This update fixes an issue that could cause mouse input to stutter in some games. support.microsoft.com
  6. 6. This update fixes an issue where fingerprint sign-in might not work after a cold boot on some devices. support.microsoft.com
  7. 7. [Security updates] This update provides security improvements. support.microsoft.com
  8. 8. Deployment through Windows Update remains ongoing across supported devices. support.microsoft.com
  9. 9. This update adds auditing and optional policy controls for ReFS volumes on externally attached storage devices. support.microsoft.com
  10. 10. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). support.microsoft.com
  11. 11. This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model. support.microsoft.com
  12. 12. Includes KB5127647 (Build 26100.9703), which improves the reliability of the Windows update installation process. support.microsoft.com
  13. 13. This update introduces the new (UTC-05:00) Manitoba time zone to support Manitoba’s November 1, 2026, time zone change. support.microsoft.com
  14. 14. IT administrators can mitigate this issue on devices affected by the Remote Desktop connection failure by using their existing policy management method to temporarily turn off Administrator protection. support.microsoft.com
  15. 15. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode. support.microsoft.com
  16. 16. You can modify the registry to restore the ability to turn on Smart App Control by following these steps: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 16 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake