Patch tracker / KB5127648
KB5127648: Windows 11 Version 24H2 Security Update (October 2026)
KB5127648 is a Critical security update for Windows 11 Version 24H2, released 2026-10-13. It closes 1009 CVEs with a maximum CVSS of 9.8. At least one of them is actively exploited (CISA KEV), so it is urgent, and Microsoft lists 3 known issues and 1 change that might affect your environment: test it before broad deployment. The most likely of them to be attacked is CVE-2026-96951, which FIRST.org rates at 10% probability of exploitation in the next 30 days.
Before you deploy: Microsoft lists 3 known issues and 1 change that might affect your environment for this update.
- You might be unable to turn on Smart App Control
- Remote Desktop connections might fail for non-admin users with error 0xC000000D
- USB audio devices might fail to start or produce no sound
- [Authentication] This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication. For more information, see KB5066470.
Our data comes from Microsoft, CISA and other public sources, and it can be wrong or out of date. If you are unsure, check the linked source before you act, and tell us when we are wrong so we can fix it.
Update summary
Fixes 1009 CVEs. At least one is actively exploited (CISA KEV). Most severe CVSS 9.8 (Critical). EPSS exploit probability up to 9.8%. Among the top half of tracked Microsoft updates by EPSS exploit probability.
Microsoft documents 3 known issues with this update.
- You might be unable to turn on Smart App Control
- Remote Desktop connections might fail for non-admin users with error 0xC000000D
- USB audio devices might fail to start or produce no sound
The full text, quoted from Microsoft
Microsoft also lists 1 change that might affect your environment, not under Known issues:
- [Authentication] This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication. For more information, see KB5066470.
Senserva AI Opinion and rich prompt for KB5127648
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
Full tracking and change history for KB5127648
- Released
- 2026-10-13
- Last changed
- 2026-10-25
- Changes tracked
- 5
Senserva began recording day-to-day change history on 2026-07-07, and refreshes it several times a day. Release dates are historical where Microsoft publishes them; revision history is tracked from that date forward, so it does not include changes made before then.
Microsoft revised KB5127648 on 2026-10-15: CVEs fixed 1008 to 1009.
- 2026-10-15 CVEs fixed 1008 to 1009
Recorded by Senserva on the dates shown, from the MSRC release feed. This is what moved and when, which neither the vendor advisory nor NVD publishes.
Check if KB5127648 is installed
Elevated PowerShell. No output means it is not installed.
Known issues, from Microsoft
Quoted from Microsoft's support article for KB5127648 (checked 2026-11-03). Microsoft lists 3 known issues. Verify against the article before acting.
1. You might be unable to turn on Smart App Control
Symptoms
After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out.
Devices where Smart App Control is already turned on are not affected and remain protected.
Resolution
This issue was resolved for Windows 11, versions 26H2 and 25H2, by Windows updates released on and after October 27, 2026 ( KB5127936 ) . We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.
If you install an update released October 27, 2026 ( KB5127936 ) or later, you do not need to use a workaround for this issue. If you are using Windows 11, version 24H2, or an update released before October 27, 2026, and have this issue, you have the option to apply one of the following workarounds.
Workaround
Important: This section contains information about modifying the registry. Before you modify the registry, back it up and make sure that you know how to restore it if a problem occurs. For more information, see How to back up and restore the registry in Windows .
Option #1: Modify the registry
You can modify the registry to restore the ability to turn on Smart App Control by following these steps:
Open a Command Prompt window by typing cmd in the Search box.
Select Run as administrator .
At the command prompt, enter the following commands. Then restart the device.
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
Option #2: Install a Group Policy
IT administrators can instead choose to mitigate this issue for enterprise-managed devices managed by IT departments by installing and configuring the special Group Policies listed below.
Group Policy downloads with Group Policy name:
Download #1 for Windows 11, versions 24H2, 25H2, and 26H2 — KB5074105 261015_19222 Feature Preview
Download #2 for Windows 11, versions 24H2, 25H2, and 26H2 — KB5074105 261015_19221 Feature Preview
Important : You should install and configure both Group Policies to resolve this issue. The first Group Policy is needed to turn on Smart App Control. The second Group Policy ensures that logging is available to assist with troubleshooting in case any problems arise.
The special Group Policies can be found in Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2 , 25H2. After installing the Group Policies, configure the value for both settings to Enabled and restart your device(s) to apply the Group Policy settings.
Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.
2. Remote Desktop connections might fail for non-admin users with error 0xC000000D
Symptoms
After installing the September 2026 non-security preview update KB5124010 , or later updates, non-admin users might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled. Attempts to connect might fail with error 0xC000000D and display the message, “The token that was passed to the function is invalid.” This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled .
Note: If your organization uses Windows security baselines , published through the Microsoft Security Compliance Toolkit , Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently.
Resolution
This issue is addressed for Windows 11, versions 26H2 and 25H2, by Windows updates released on and after October 27, 2026 ( KB5127936 ). We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.
If you install an update released October 27, 2026 ( KB5127936 ) or later, you do not need to use a workaround for this issue. If you are using Windows 11, version 24H2, or an update released before October 27, 2026, and have this issue, you have the option to apply the following workaround.
Workaround
IT administrators can mitigate this issue on devices affected by the Remote Desktop connection failure by using their existing policy management method to temporarily turn off Administrator protection. Reset the User Account Control Type Of Admin Approval Mode policy in Microsoft Intune or Group Policy. For more information, see Administrator protection on Windows 11 .
3. USB audio devices might fail to start or produce no sound
Symptoms
After installing the September 8, 2026, Windows security update (KB5124012), some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:
The device displays an error in Device Manager: "This device cannot start (Code 10).”
No audio output.
Volume controls are unresponsive or remain at zero.
Sound settings are unresponsive or unavailable.
Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode.
This issue is limited to USB Audio Class 1.0 devices.
Resolution
This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129195) . This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.
IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.
Changes Microsoft says might affect your environment
Microsoft does not list this under Known issues. It is quoted from the list of changes in Microsoft's support article for KB5127648 (checked 2026-11-03).
[Authentication]
This update strengthens NTLMv1 security by changing the internal default behavior when the BlockNtlmv1SSO registry value is not set. Windows now uses Enforce mode (1) instead of Audit mode (0), blocking the generation of NTLMv1-derived credentials for Single Sign-On (SSO). This change applies only to devices where Credential Guard is disabled and the BlockNtlmv1SSO registry value is not set, and might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication. For more information, see KB5066470.
Windows release health for this update
From Microsoft's Windows release health for Windows 11, version 25H2; Windows 11, version 24H2, checked 2026-11-03. Microsoft's issue text is linked from each title.
Issues this update resolves
- Applications which require AC-3 audio decoding might close unexpectedly
Resolved. Microsoft last updated it 2026-10-13 10:13 PT. - Devices might experience a black screen or desktop loading issues after sign-in
Resolved. Microsoft last updated it 2026-10-13 10:13 PT.
From the Senserva blog
- A Cisco VPN deadline on Sunday, a Smart App Control fix, and a perfect-10 GitLab flaw
October 30, 2026 · Clay, Clay in the Morning - Open This Week: Windows 11 Known Issues and an Ivanti Zero-Day
October 18, 2026 · Mark Shavlik - Will This Patch Break Something? Read Past Known Issues
October 17, 2026 · Mark Shavlik
CVEs fixed by this update
Sorted exploited-first, then by CVSS. Every CVE links to its Senserva page with the full risk facts, references, and a ready-to-paste AI prompt.
Scope and sources
- Affected products
- Also released in October 2026
KB5126646
1041 CVEs · Critical · exploitedKB5126651
918 CVEs · Critical · exploitedKB5126653
965 CVEs · Critical · exploitedKB5126655
977 CVEs · Critical · exploitedKB5126657
899 CVEs · Critical · exploitedKB5126836
649 CVEs · Critical · exploitedKB5126868
769 CVEs · Critical · exploitedKB5127646
997 CVEs · Critical · exploitedThe full month, summarized: Microsoft Patch Tuesday.
- Authoritative references
See this and every Microsoft update ranked by real-world risk on the Microsoft Patch Tracker.