Windows 11 KB5127648: What October's Patch Tuesday Fixes

Microsoft shipped KB5127648 on October 13, 2026, the October Patch Tuesday cumulative update for Windows 11 versions 24H2, 25H2, and 26H2. Alongside unspecified security fixes, it patches a File Explorer crash on multi-user systems like Azure Virtual Desktop, repairs broken AC-3 audio playback, fixes Always On VPN connections that got stuck after last month's update, and keeps rolling out new Secure Boot certificates. It also quietly closes the book on Windows 11 24H2 Home and Pro, which reached end of servicing the day after this update landed.

What Is KB5127648?

KB5127648 is the standard monthly "B release" — Microsoft's term for the second Tuesday of the month — for Windows 11. According to Microsoft's own support article for the update, it applies to three feature versions at once: 26H2, 25H2, and 24H2, which all share the same underlying servicing branch. That's why one KB number covers three build numbers. Windows 11 23H2 is on a different branch and gets its own patch, KB5126653, while the newer 26H1 branch (used on some Snapdragon-era devices) is patched separately as KB5127646.

Like most monthly updates, the article's top-line description is brief: "This update includes security improvements," with the specifics reserved for Microsoft's Security Update Guide rather than the consumer-facing release notes. The rest of the article lists the quality fixes and known issues that are actually documented.

The reason three feature versions share one patch comes down to how Microsoft now builds Windows 11 releases. Since 24H2, each annual or semi-annual version has shipped as a small "enablement package" layered on top of a shared, continuously serviced core — rather than as a completely new set of files. That's why 24H2, 25H2, and 26H2 all get patched together under a single KB with three build numbers, while a genuinely different code branch, like the one behind 23H2 or 26H1, needs its own separate monthly KB. It's a detail that matters mainly when you're trying to match a KB number you read about online to the specific build sitting on your own PC, since the KB alone doesn't tell you which version you're on.

Which Windows 11 Versions Get This Update

If you're trying to work out whether this applies to your PC, here's how the builds line up, per Microsoft's servicing page:

In other words, if your taskbar's Windows Update page shows build 26100.9711, 26200.9711, or 26300.9711 after installing, you're on the October release. Anyone still running 23H2 or 26H1 should look for a different KB entirely — don't be alarmed if Windows Update doesn't offer you KB5127648 by that exact number.

What KB5127648 Actually Fixes

Beyond the undisclosed security patches, Microsoft's release notes list a short set of quality fixes. The headline one addresses a fairly disruptive bug: on shared, multi-user setups such as Azure Virtual Desktop and FSLogix profile environments, Explorer.exe could fail to start or crash repeatedly, leaving users staring at a black screen after signing in. That's now fixed. Other documented fixes include:

• Audio: AC-3 audio playback failing in some applications is resolved.
• Always On VPN: Connections that got stuck in a "Connecting" state after September's KB5124008 — including a "port is already in use" error — are fixed.
• Storage Spaces: Tiered Storage Spaces Direct virtual disks that failed to come online, taking dependent clustered workloads offline with them, now work correctly.
• Printing: Print failures in some apps and on devices using RAW or Generic Text Only drivers, introduced by August's security update, are resolved.
• Windows Hello: Fingerprint sign-in failing after a cold boot on some devices is fixed.
• Gaming: Mouse input stuttering in some games is addressed.
• Time zones: Manitoba's permanent shift to UTC-05:00, effective November 1, 2026, is now reflected correctly.

Microsoft also flags one behavioral change rather than a bug fix: where the BlockNtlmv1SSO policy isn't configured and Credential Guard is off, Windows now enforces (rather than just audits) blocking NTLMv1 single sign-on, which could affect some Wi-Fi, Ethernet, and VPN connections that rely on MS-CHAPv2.

The Secure Boot Certificate Rollout Continues

KB5127648 keeps pushing Microsoft's ongoing Secure Boot certificate update to devices Windows Update identifies as eligible — this has been rolling out gradually across several months of cumulative updates, not something new to October. The underlying issue is that the certificates many PCs have used to verify boot-time software since Windows 8 are set to expire, so Microsoft has spent much of 2026 quietly distributing newer, longer-lived replacements through ordinary cumulative updates rather than a single flag-day switch. Microsoft's notes are explicit that devices without the newer certificates can still start normally and keep receiving standard monthly updates in the meantime, so this isn't an urgent action item for most home users — it's mainly a background migration that IT admins managing fleets of older hardware should keep tracking, since Microsoft has said enforcement will tighten in later updates once the rollout is far enough along.

Three Known Issues Microsoft Is Tracking

Microsoft's support article lists three open issues tied to this update cycle, none of which currently have a permanent fix baked into KB5127648 itself:

1. Smart App Control may not turn back on. If Smart App Control was previously switched off on a device, it may fail to turn on afterward (devices where it's already on aren't affected). Microsoft's workaround involves two registry value changes under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides followed by a restart, or equivalent Group Policy settings on managed devices.
2. Remote Desktop fails for non-admin users with error 0xC000000D when the host has Administrator protection enabled. Microsoft says this was introduced starting with KB5124010 and continues here; the suggested mitigation is temporarily resetting the "User Account Control Type Of Admin Approval Mode" policy to disable Administrator protection.
3. Some USB Audio Class 1.0 devices fail to start or produce no sound, a regression that began with September's KB5124012. A separate out-of-band update, KB5129195, resolved the 8-channel and 3D-audio symptoms, but Microsoft says other symptoms are still under investigation, with no fix yet rolled into KB5127648.

If you hit any of these, Microsoft's guidance is to use the listed workarounds rather than waiting on an update, since none of the three issues is marked resolved in this release. It's also worth noting that Microsoft revised the KB5127648 article twice after release — adding the Remote Desktop issue on October 14 and the NTLMv1 authentication note on October 15 — a reminder that these pages are living documents, and it's worth rechecking Microsoft's article directly if you're troubleshooting something that isn't listed here today.

What About the Excel and File History Reports?

Some September coverage pointed to a File History backup failure and separate reports of an Excel cut-and-paste regression circulating after last month's updates. Worth clarifying here: the File History issue — where Microsoft's own September 8 KB5124008 notes describe backups failing to create or update — was already marked resolved in updates released on or after September 22, 2026, via the optional KB5124010 release, weeks before October's Patch Tuesday. It isn't something KB5127648 needed to fix, because it was already closed out. As for an Excel cut-and-paste bug, neither the September nor the October Windows 11 servicing articles from Microsoft mention Excel or clipboard behavior at all. That issue, if it's real, would be tracked through Microsoft 365's own update channel rather than a Windows cumulative update, and there's no confirmation of it in Microsoft's Windows release notes as of this writing.

The Last Update for Windows 11 24H2 Home and Pro

Buried in the announcements section, Microsoft notes that Windows 11, version 24H2 Home and Pro has reached end of updates — meaning KB5127648 is the final monthly update those editions will ever receive. Microsoft's own lifecycle documentation lists October 14, 2026 as the retirement date for 24H2 on Home and Pro, one day after this update shipped. Enterprise and Education customers on 24H2 get a longer runway, through October 12, 2027. Microsoft says unmanaged Home and Pro devices still on 24H2 will be moved automatically to a newer, supported version like 25H2, though users can still control exactly when the upgrade installs and restarts.

How to Check for and Install KB5127648

For nearly everyone, this update installs itself. Here's how to confirm it or force it if it hasn't shown up yet:

• Automatic install: Go to Settings > Windows Update and click "Check for updates." Most devices receive KB5127648 automatically through Windows Update or Microsoft Update.
• Confirm it installed: After updating, open Settings > System > About and check that the OS Build reads 26100.9711, 26200.9711, or 26300.9711 depending on your version.
• Managed devices: Windows Update for Business installs it according to whatever deferral and deployment rings an organization has configured.
• Manual/offline install: IT admins can pull the standalone package from the Microsoft Update Catalog. Microsoft's instructions note that the checkpoint update KB5043080 needs to be installed first on affected builds, and that all downloaded .msu files should sit alone in one folder before installing them in order, or via DISM /Online /Add-Package.
• WSUS: Approve it under product "Windows 11" and classification "Security Updates."

What's Next

With 24H2 Home and Pro now retired, the next few monthly cycles will matter most for anyone still on that version, since Microsoft's auto-upgrade path to 25H2 will start kicking in for unmanaged machines. Watch for November's Patch Tuesday update to land on November 10, 2026, which should be the first full monthly cycle to show whether the Smart App Control and Remote Desktop issues flagged here get a permanent fix, or whether Microsoft resolves them with another out-of-band release before then, the way it did for part of the USB audio bug with KB5129195. For most people, the practical takeaway is simple: let the update install, restart when prompted, and only dig into the registry or Group Policy workarounds above if Smart App Control or Remote Desktop access for non-admin users actually breaks on your machine.

Anyone evaluating a jump to 26H2 itself, rather than just this month's patch, can see the fuller feature rundown in our 26H2 overview, and Insiders testing newer search behavior ahead of general release can find details in our coverage of the inline quick-actions search update. And if you're also weighing which AI coding assistant to run on a freshly patched machine, our GitHub Copilot vs. Cursor pricing and agent comparison breaks down the current options.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage