Yesterday I wrote about reading past the Known issues section before you deploy. This weekend I sent Senserva Watch members the issues that are still open, and two of them deserve more room than an email gives them. Here is what is open, and what Microsoft and CISA say to do about it.
Windows 11: three known issues on KB5127648
As of October 18, Microsoft's article for KB5127648, the October 13 update for Windows 11 24H2, 25H2 and 26H2, lists three known issues, and Microsoft says it is working on fixes for all three. None of them is a reason to hold an update that fixes an exploited vulnerability. Each one has something you can do now.
Smart App Control
Microsoft says "some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off." Devices where it is already on "are not affected and remain protected." Microsoft gives two ways back: a registry change, or, for managed devices, two Group Policy downloads that must both be installed. If your fleet never turns Smart App Control off, this one is unlikely to touch you.
Remote Desktop
This one is not new with October. Since the September preview update KB5124010, Microsoft says "non-admin users might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled", with error 0xC000000D. The detail that matters for most of you: Microsoft notes that Administrator protection is on by default in its Windows 11 24H2, 25H2 and 26H2 security baselines. If you deploy those baselines and your help desk or contractors connect without admin rights, check this first. Microsoft's mitigation is to temporarily turn off Administrator protection in Intune or Group Policy, which trades one protection for access, so scope it to the hosts that need it.
USB audio
Since the September 8 update, Microsoft says "some USB Audio Class 1.0 devices might fail to start or produce audio." The September 14 out-of-band update fixed only the 8-channel and 3D audio cases. For the rest, Microsoft points admins who need a workaround to Microsoft Support for Business. Headsets in conference rooms are where I would look first.
One more line from the same article: Microsoft says "The October 2026 monthly security update is the last update available" for Windows 11, version 24H2 Home and Pro. If any of those editions are still in your environment, they will get no further security updates.
Every quote above is on our KB5127648 page, with Microsoft's full text and a PowerShell check for whether the update is installed.
Ivanti Connect Secure: why a Microsoft admin should care
If you do not run Ivanti Connect Secure, skip to the end. If you do, or a partner does, read on.
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13. It is an authentication bypass that "allows a remote unauthenticated attacker to execute arbitrary commands." Rapid7 notes that "exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers." CISA's alert names the affected versions: "25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior." SecurityWeek reports that Ivanti has patched it in versions 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1.
Here is the Microsoft part. SecurityWeek reports that the attackers "searched Active Directory for LAPS passwords and BitLocker recovery keys." A VPN appliance is a door into the directory, and LAPS passwords and BitLocker keys are exactly what lets an attacker move from that door to every machine.
Two more points from CISA. Organizations checking for compromise "will need to conduct network and memory forensics to identify evidence of exploitation," because the Integrity Checker Tool "may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory." And if a compromise is suspected, CISA recommends Ivanti's recovery procedures, including: "Reset passwords for all accounts, including domain, administrator, and local accounts." If that applies to you, I would add the LAPS passwords and BitLocker recovery keys the attackers went looking for to that list.
As of October 14, The Register reported that a separate privilege escalation used in the same attacks was not yet fixed, and that Volexity said Ivanti plans a fix "in the coming weeks."
Where to find it
Both items are on our pages, quoted from the source and linked, and we update them as Microsoft and Ivanti revise their notes. When Microsoft changes a known issue, the next morning's post on Microsoft Known Issues, Daily quotes what changed. To get alerts like this one by email, join Senserva Watch; it is free.
Mark