Microsoft released KB5127648 on October 13, 2026 as the monthly security update for Windows 11. It brings builds 26100.9711 (24H2), 26200.9711 (25H2) and 26300.9711 (26H2). Windows 11 26H1 gets a separate package, KB5127646 (build 28000.3231). Here is what the update fixes, the problems people are running into and how to solve them.
Why You Should Install KB5127648
This update patches CVE-2026-96951, a Windows Shell command-injection flaw that attackers are already using to bypass Mark of the Web, the warning Windows shows for files downloaded from the internet. It needs you to open a crafted file or click a malicious link, which is exactly how most real attacks start. The update also fixes a publicly disclosed .NET Framework bug, CVE-2026-108398, which Microsoft says has not been exploited.
What KB5127648 Fixes
- Black screen after sign-in in multi-user setups such as Azure Virtual Desktop and FSLogix, caused by Explorer failing to start or crashing repeatedly.
- Always On VPN connections stuck on “Connecting” or failing after a first attempt.
- Printing failures in some apps and on RAW or Generic Text Only drivers after the August 2026 update.
- Mouse stutter in games.
- Windows Hello fingerprint sign-in failing after a cold boot.
- AC-3 audio playback in some apps.
- Storage Spaces Direct tiered virtual disks not coming online.
- A new (UTC-05:00) Manitoba time zone for the November 1 change.
KB5127648 Known Problems and How to Fix Them
1. Smart App Control is grayed out
After installing KB5127648, you might be unable to turn Smart App Control on. This only affects PCs where it was already off; if it was on, it stays on. Microsoft is working on a fix. Until then, it suggests this workaround. Back up your registry first, then open Command Prompt as administrator and run:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /fRestart the PC, then go to Windows Security → App & browser control → Smart App Control. Businesses can apply the same change through Group Policy, as described in Microsoft’s release notes.
2. VPN or Wi-Fi stops connecting (NTLMv1)
KB5127648 changes the default for NTLMv1 single sign-on from audit to enforce when the BlockNtlmv1SSO value is not set and Credential Guard is off. As a result, older Wi-Fi, Ethernet or VPN setups that use MS-CHAPv2 may stop working. This mostly affects company networks. Ask your IT team, who can follow Microsoft’s guidance in KB5066470, rather than turning off the protection yourself.
3. Remote Desktop error 0xC000000D
Non-admin users connecting to a PC that has Administrator protection turned on may see error 0xC000000D. This started with an earlier update and is still open. Microsoft’s temporary workaround is to disable Administrator protection on the host until a fix arrives.
4. USB audio devices not working
This problem predates KB5127648: some USB Audio Class 1.0 devices show a “Code 10” error or play no sound since an earlier update. The September out-of-band update KB5129195 fixes part of the problem. If your device still fails, try another USB port or a driver from the manufacturer.
KB5127648 Is the Last Update for 24H2 Home and Pro
This is the big KB5127648 detail many people miss. Microsoft confirms that Windows 11 version 24H2 Home and Pro has reached end of servicing, and the October 2026 update is the last security update these editions will get. From November, a PC still on 24H2 Home or Pro stops receiving security fixes.
How to check your version
Press Win + R, type winver and press Enter. The window shows the version (for example 24H2 or 25H2) and the build number.
How to upgrade to 25H2
- Open Settings → Windows Update.
- Turn on Get the latest updates as soon as they’re available.
- Click Check for updates. If your PC is eligible, the 25H2 feature update appears. Install it and restart.
- If nothing appears, use the Windows 11 Installation Assistant from Microsoft’s official download page.
After KB5127648, going from 24H2 to 25H2 is usually quick, because the two versions share the same base and the upgrade mainly switches on new features. Still, back up important files first.
How to Uninstall KB5127648
Only do this if the update causes a serious problem, because removing it also removes the zero-day fix. Go to Settings → Windows Update → Update history → Uninstall updates, select the update and click Uninstall. Then pause updates for a week and check Microsoft’s release health page for a fix.
Frequently Asked Questions
Is KB5127648 safe to install?
Yes, for most people. It fixes an actively exploited vulnerability, and the known issues affect specific setups such as Smart App Control, company VPNs and Remote Desktop with Administrator protection.
Why is Smart App Control grayed out after the October update?
It is a known issue in KB5127648 on PCs where Smart App Control was already turned off. Microsoft published a registry workaround and is preparing a permanent fix.
Is Windows 11 24H2 still supported?
24H2 Home and Pro got their last update in October 2026. Upgrade to 25H2 to keep receiving security updates.
What build number does KB5127648 install?
26100.9711 on 24H2, 26200.9711 on 25H2 and 26300.9711 on 26H2.
Sources
- Microsoft: KB5127648 release notes
- PCWorld: Smart App Control fix
- CyberInsider: October updates fix zero-day
- Microsoft: Windows 11 release health
Also this week: if you run a website, read our guide to PHP2Shell, the critical PHP vulnerability. And generate a strong new password with our free password generator.