KB5127646

Microsoft has released cumulative security update KB5127646 (Build 28000.3231) for Windows 11, version 26H1, as part of the October 2026 Patch Tuesday. This is a quality update and does not introduce new system features. It contains various security improvements for internal OS functionality. On this Patch Tuesday, Microsoft fixed 1411 security issues, including three zero-day vulnerabilities. The build also includes all fixes and changes from preview update KB5124006 (Build 28000.3086) for Windows 11, version 26H1. Most of the new features from it are being rolled out gradually.

• Changes from KB5124006 (Build 28000.3086). The ability to place the taskbar at the top, left, or right and to reduce its size, a choice of Start menu sizes and separate toggles for its sections, updated Windows Search that labels the source of results and lets you configure web suggestions, a faster File Explorer home page, new progress indicators during startup, restart, and update installation, administrator protection with temporary elevation of rights (off by default), and support for ML-KEM as a standalone key exchange algorithm in TLS.
• WMIC removal. The WMIC utility has been removed from Windows 11, version 26H1, while WMI remains supported.
• Secure Boot. The rollout of updated Secure Boot certificates continues. Up-to-date high-confidence data is used to identify devices that are ready to receive the new certificates automatically. The rollout through Windows Update continues on supported devices.
• Windows File Explorer. Fixed an issue with File Explorer in multi-user environments, including Azure Virtual Desktop and FSLogix. After sign-in, the Explorer.exe process might fail to start or crash repeatedly, causing a black screen.
• Always On VPN. Fixed an issue with Always On VPN connections after installing KB5124008. If automatic protocol selection or protocol fallback was configured, the VPN connection could hang in the connecting state or fail to establish after the first unsuccessful attempt. In some cases, repeated attempts produced the error The specified port is already in use.
• Storage Spaces. Fixed an issue with Storage Spaces Direct virtual disks that use storage tiers. After installing certain security updates, some virtual disks might not come online, making dependent cluster workloads unavailable.
• ReFS security. Auditing and additional policy-based controls have been added for ReFS volumes on external drives. Auditing is enabled by default and enforcement is disabled, so administrators can evaluate upcoming security hardening changes and prepare for them.
• Gaming. Fixed an issue that could cause intermittent mouse input handling in some games.
• Known audio issue. After installing KB5124012, some USB Audio Class 1.0 devices may stop playing sound. You may see the error This device cannot start (Code 10), volume control failures, and unavailable sound settings. Update KB5129195 fixes failures in 8-channel and 3D sound modes, but the other symptoms of the issue persist for now. In some cases, switching to stereo mode helps. Microsoft is working on a full fix.

To install the update via Windows Update, go to Settings > Windows Update and click Check for updates. A restart of the computer is required to complete the installation.

The last 10 Windows updates: