KB5127936: Cumulative update for Windows 11, versions 25H2 and 26H2, October 2026. File Explorer gains a customizable menu; recovery adds cloud rebuild

• The right-click menu opens faster and lets you choose which commands and app extensions it shows.¹
  Select Customize menu to change the commands, extensions, and layout. Hold Shift and right-click the desktop to see more options.

• The AutoPlay dialog has a refreshed look, supports dark mode and text scaling, and keeps its alerts in notification center.²

• File Explorer search results show file names, locations, and dates in a consistent layout.³
• You can type ~ in the address bar to go to your user profile folder or a folder inside it.⁴
  For example, enter ~\AppData to open that folder.
• The Folder Options dialog now supports dark mode.⁵

For: devices using XBOX mode

• Gaming Task View gets a navigation bar with quick access to the desktop and power options.⁶

• Privacy settings for the camera, microphone, and location are grouped together, with usage details shown on the main page.⁷
  The changes are on the Privacy & security page in Windows Settings.
• The Device Info card on Settings Home is becoming available in more markets for people signed in with a Microsoft account.⁸
  The card shows key PC specifications and usage. More details are under Settings > System > About.

For: Phone Link users

• Hover over a recent message or notification to preview it in Start without opening it.⁹
  Manage this feature under Phone Link > Settings > Start menu personalization.

• Magnifier adds a contrast theme that can reduce screen glare while keeping the original colors in photos, videos, and charts.¹⁰
  The default contrast theme is dark. Choose another under Settings > Accessibility > Magnifier.
• Each monitor can use its own zoom level, with the magnified view kept on that display.¹¹
  Per-monitor zoom is on by default and requires displays set to Extend. Adjust levels from the Magnifier toolbar or its Settings page.
• You can lock the magnified view on one monitor while moving the pointer to another.¹²
  This works with per-monitor zoom turned on. Press Ctrl + Windows key + K to lock or unlock a display; Windows key + Esc releases all locked displays.

For: Live Captions users

• A new setting lets Live Captions transcribe audio from screen readers; it is off by default.¹³
  Find Include screen reader audio under Settings > Accessibility > Captions. When off, captions do not transcribe screen reader audio.

For: Narrator users

• Narrator can read and help you explore math equations in supported apps and web content.¹⁴
  Math navigation works in supported Microsoft 365 apps, Edge version 153.0.4234.32 and later, and Chrome version 153.0.8010.18 and later. Supported reading languages are English (United States), English (United Kingdom), Traditional Chinese, Finnish, German, and Spanish.

• Windows recovery can reuse eligible Wi-Fi profiles already saved in Windows to connect during recovery.¹⁵
  This includes supported certificate-based networks. The feature is on by default, and IT administrators can disable it.

For: everyone; remote management for IT administrators

• Cloud rebuild can reinstall Windows using an image and drivers downloaded from Windows Update, even if Windows cannot start.¹⁶
  It can remove files or sanitize the drive using its hardware erase capability; sanitization cannot be undone. IT administrators can configure and start a rebuild remotely through the Recovery CSP.

For: people restoring a backup profile to a new device

• After you restore a backup profile to a new device, a summary shows what was restored.¹⁷
  The summary includes Windows settings and the list of Microsoft Store apps.

For: eligible devices

• Eligible PCs may turn on memory integrity during updates to improve protection and prepare for advanced security features.¹⁸
  The change respects existing user or IT administrator choices. Memory integrity is also known as HVCI.

For: organizations using IPv6-only networks

• IPv4-only apps can reach IPv4 services from IPv6-only networks on Wi-Fi and Ethernet.¹⁹
  IPv6 CLAT adds client-side 464XLAT translation. It requires SLAAC-based IPv6 addressing; DHCPv6 Prefix Delegation and WSL are not supported. Enable it with netsh interface clat set global permit=enabled pref64fromdns=enabled pref64fromra=enabled or the listed Group Policy setting.

For: people and apps using prompt-based protection

• A warning now says that prompt-based data protection will be retired in April 2027.²⁰
  Stop creating new prompt-protected data, use a supported non-interactive flow, and decrypt or migrate existing data before retirement. Other DPAPI operations are not affected.

For: Windows 11 versions 25H2, 26H2, and 26H1 users with Edge version 150 or later

• Microsoft Edge opens faster and more consistently, especially when the PC is busy.²¹
  Available on Windows 11 versions 25H2, 26H2, and 26H1 with Microsoft Edge version 150 or later. It streamlines launches when Edge is already running in the background.

For: users of supported PIV smart cards

• Supported PIV smart cards can use RSA-3072 keys with the Windows smart card minidriver.²²
  Adds RSA-3072 key support in the Windows smart card minidriver for supported Personal Identity Verification (PIV) smart cards.

• The temporary files section in Storage settings gets small visual changes.²³
  The section is under Settings > System > Storage.

• App window previews animate better when you move the pointer across taskbar icons.²⁴
• Taskbar settings for multiple monitors are better preserved when monitors connect or disconnect.²⁵

For: families using age-restricted parental controls

• Messages are clearer when parental controls block an app because of its age rating.²⁶

• The PC can resume faster from Modern Standby while saving battery when the charge is low.²⁷
  The policy reduces hibernation above 80% battery and hibernates sooner below 10%.

For: Windows Spotlight users

• Changes to the underlying platform are intended to make Windows Spotlight more reliable on the lock screen.²⁸

• Windows can display and shape text from Unicode 17.0, including newly encoded characters and scripts.²⁹
  Unicode 17.0 added 4,803 characters and four scripts: Beria Erfe, Sidetic, Tai Yo, and Tolong Siki.

• IT administrators can use policy-based removal of supported built-in apps in multi-session environments.³⁰
  Applies to Windows 11 Enterprise and Education devices in multi-session environments.

• Windows PowerShell and its ISE now include version 5.1 in their names. Some existing Start menu shortcuts might keep their old names.³¹
  The update adds version 5.1 to the names of Windows PowerShell and Windows PowerShell Integrated Scripting Environment (ISE).

For: devices using BitLocker pre-boot PINs

• Pre-boot PIN handling helps prevent repeated submissions from causing a TPM lockout and recovery.³²
  Improves BitLocker pre-boot PIN retry handling to prevent unintended repeated submissions from causing TPM dictionary-attack lockout and recovery.

For: Copilot+ PCs

• AI components are updated to version 1.2610.1063.0.³³
  The updated components are Image Search, Content Extraction, Semantic Analysis, and Settings Model. AI components apply only to Copilot+ PCs and do not install on other Windows client PCs or Windows Server.

• The included servicing stack update improves the reliability of Windows update installation.³⁴
  Includes KB5132402, build 26100.9815.

• Non-admin users can connect to remote devices with Administrator protection enabled instead of getting error 0xC000000D.³⁵
  The status page says this issue was resolved by KB5127936. It primarily affected enterprise-managed Remote Desktop hosts with Administrator protection enabled.
• The policy for trusted Remote Desktop certificate thumbprints can be configured through Microsoft Intune again.³⁶
  The affected policy is “Specify thumbprints of certificates representing trusted .rdp publishers.”

• On affected devices, you can turn Smart App Control back on in the Windows Security app.³⁷
  Fixes the option being grayed out after Smart App Control was turned off.

For: devices with certain AMD graphics cards

• HDMI and DisplayPort audio playback works again on affected AMD graphics cards.³⁸

For: devices where the method is used

• The device is less likely to be prevented from starting after the specified policy update method is used.³⁹
  Addresses a startup issue after using the PS_UpdateAndCompareCIPolicy CIM method.

For: devices using a non-Microsoft CNG key storage provider

• TPM identity certificate enrollment is less likely to stop responding in the described provider error cases.⁴⁰
  Addresses cases where a non-Microsoft CNG key storage provider reports a malformed algorithm name or faults during provider enumeration.

For: Windows Sandbox users

• Windows Sandbox is less likely to close unexpectedly with error 0x80370106 while in use.⁴¹

For: devices using Always On VPN with automatic protocol selection or fallback

• Affected VPN connections are less likely to stay stuck on Connecting or fail after a connection attempt fails.⁴²
  Addresses issues after the September security update when automatic protocol selection or fallback is configured. Later attempts could show “The specified port is already in use.”

For: WSL2 users with AMD processors

• Nested virtualization is available again in WSL2 on affected devices with AMD processors.⁴³
  Fixes nested virtualization not being available in Windows Subsystem for Linux version 2 on devices with AMD processors.