Windows bugs and fixes November 3 2026: status

What broke on Windows?

BleepingComputer says KB5127648 blocked Smart App Control activation on some affected Windows 11 24H2 and later devices. The option could appear grayed out in the Windows Security app after Smart App Control had been turned off, according to BleepingComputer’s account of Microsoft’s acknowledgement.

BleepingComputer explains that Smart App Control uses Microsoft’s code integrity features and app intelligence services alongside SmartScreen and Microsoft Defender to block potentially harmful apps or binaries. The failure did not disable Smart App Control on every device, and it did not affect every user running those Windows versions.

A separate Windows 11 bug affected Always On VPN after the September 2026 security updates, according to gHacks, when profiles used automatic selection with IKEv2 and SSTP. Connections could remain stuck in a Connecting state or fail after an initial attempt, gHacks reports in its account of the KB5127936 release notes.

Microsoft had previously marked the VPN problem as fixed in the October 2026 cumulative updates, but gHacks says the company reopened the issue after it remained reproducible. These are documented Windows known issues with different triggers, even though KB5127936 addresses both.

Which Windows update fix has shipped?

BleepingComputer says KB5127936 fixes the Smart App Control problem, while gHacks says it fixes Always On VPN failures and is available for Windows 11 25H2 and 26H2. It is an optional October preview rather than the regular security update, according to gHacks, so installing it early is a choice rather than a requirement.

BleepingComputer reports that Microsoft confirmed the Smart App Control resolution for users who installed KB5127936 and recommended the latest security update containing the resolution. That wording does not resolve the version mismatch by itself: BleepingComputer identifies affected devices as 24H2 and later, while gHacks limits current preview availability to 25H2 and 26H2.

Betanews says Microsoft released KB5127936 on October 28 for Windows 11 25H2 and 26H2, while the preview title omits version 24H2. Its account says 24H2 stopped receiving non-security previews, although Education and Enterprise editions continue receiving monthly security fixes.

My reading is therefore version-specific. KB5127936 is a shipped fix for eligible 25H2 and 26H2 devices. I do not have a documented KB5127936 installation route for 24H2 from these reports.

Can Always On VPN work without the preview?

gHacks says administrators can temporarily select only SSTP or only IKEv2 instead of automatic protocol selection. The mitigation applies to affected Always On VPN profiles and can keep connections from entering the documented failure path while the optional preview remains undeployed.

According to gHacks, the mitigation removes the protocol fallback supplied by automatic selection, so administrators should reverse the profile change after installing a fixed cumulative update. That lost fallback is the cost of the workaround. I would choose the protocol only after checking which one the environment expects.

Devices that skip the preview remain affected until the next Patch Tuesday cumulative updates, according to gHacks, which describes the preview and mitigation as the available paths. For the next cumulative release, gHacks says Microsoft has not stated whether it will contain further changes beyond the VPN code already shipped in KB5127936 for affected Windows 11 devices.

The fix has shipped in preview. The later cumulative release described by gHacks has not shipped yet.

What else changes with KB5127936?

gHacks says KB5127936 also restores Remote Desktop access for affected non-administrator users. The failure occurred when the Administrator protection security feature was enabled after the September 2026 non-security preview update or later Windows updates, according to gHacks.

Betanews reports that KB5127936 also introduces a customizable File Explorer context menu for Windows 11 25H2 and 26H2, with delivery occurring in waves. The default layout requires no action, while a Customize option can open a dedicated Settings page when the feature reaches an eligible device.

According to Betanews, users can move Properties, replace the icon row with labeled commands, hide default commands, restore hidden commands such as Print, and control app extensions. Holding Shift while right-clicking the desktop keeps extra commands available, Betanews explains in its description of the preview.

For an offline installation, Betanews says Microsoft’s instructions require applying the KB5043080 checkpoint file first or directing DISM to a folder containing both files. I recommend Windows Update unless there is a specific reason to use an offline package.

What can you do today?

Check the Windows version first, then choose an action that matches it. Open Settings > System > About and record whether the device runs 24H2, 25H2 or 26H2 before treating a Windows KB update problem as resolved.

BleepingComputer documents a temporary registry route for enterprise-managed devices waiting for the later cumulative update. Its published account says to type cmd in Search and select Run as Administrator, but the supplied instructions stop before providing the registry commands. I would not guess those commands or copy unrelated registry edits.

On an eligible 25H2 or 26H2 device with broken Smart App Control, Always On VPN or affected Remote Desktop access, consider installing optional preview KB5127936. If preview updates are unsuitable, wait for the cumulative release described by gHacks and use the single-protocol VPN mitigation where required.

On 24H2, do not assume KB5127936 is available. Wait for a documented cumulative update or complete Microsoft registry instructions. My previous Windows status report provides the preceding daily position.

After any change, test Smart App Control in Windows Security, test the required VPN connection, and test Remote Desktop with the affected account type. Restore automatic VPN protocol selection after the fixed cumulative update is installed.