Should you update to KB5127646?
Yes, today. KB5127646 is a security update Microsoft released on 13 Oct 2026 for Windows PCs. It fixes 997 security flaws, 25 rated critical and 972 important by Microsoft.[1] One of them is already being used in attacks.
It is the newest Windows 11 26H1 release, so it’s the one to have.
Should you update?
Yes, today. One of the flaws it fixes is already being used in attacks. Every security update closes holes that become public the moment it ships, so the risk of staying on the old version only grows. Waiting a week to see if others hit problems is a common habit; with a security update it’s the wrong trade.
Is KB5127646 safe to install?
Yes. It’s Microsoft’s own security release, and updates rarely go wrong; a backup makes it painless if one does. The one unsafe way to get it is from a link: Microsoft never sends updates by email, text or pop-up, so install it only from Start → Settings → Windows Update.
What it fixes
Microsoft lists 997 security flaws, 25 rated critical and 972 important by Microsoft.[1] The 997 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-70147 | Critical | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability |
CVE-2026-70153 | Critical | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability |
CVE-2026-70229 | Critical | Windows Active Directory Domain Services Remote Code Execution Vulnerability |
CVE-2026-83917 | Critical | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2026-83934 | Critical | Windows GDI+ Remote Code Execution Vulnerability |
CVE-2026-88073 | Critical | Windows Graphics Kernel Elevation of Privilege Vulnerability |
CVE-2026-88074 | Critical | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2026-96913 | Critical | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2026-96914 | Critical | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2026-96952 | Critical | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
CVE-2026-97814 | Critical | Windows Text Shaping Remote Code Execution Vulnerability |
CVE-2026-100202 | Critical | Windows Message Queuing Queue Manager Remote Code Execution Vulnerability |
CVE-2026-100215 | Critical | Microsoft Graphics Component Remote Code Execution Vulnerability |
CVE-2026-100219 | Critical | Microsoft QUIC Remote Code Execution Vulnerability |
CVE-2026-100220 | Critical | Windows Media Video Decoder Remote Code Execution Vulnerability |
CVE-2026-102211 | Critical | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2026-102214 | Critical | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2026-102225 | Critical | Windows Text Shaping Remote Code Execution Vulnerability |
CVE-2026-105016 | Critical | Microsoft QUIC Remote Code Execution Vulnerability |
CVE-2026-105733 | Critical | Windows Hyper-V Remote Code Execution Vulnerability |
CVE-2026-108130 | Critical | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2026-108131 | Critical | Active Directory Federation Services (AD FS) Spoofing Vulnerability |
CVE-2026-108399 | Critical | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2026-108460 | Critical | Windows Message Queuing Remote Code Execution Vulnerability |
CVE-2026-108467 | Critical | Microsoft PostScript Printer Driver Remote Code Execution Vulnerability |
CVE-2026-49785 | Important | UEFI Secure Boot Security Feature Bypass Vulnerability |
CVE-2026-62687 | Important | Windows Backup Engine Information Disclosure Vulnerability |
CVE-2026-62879 | Important | Windows SmartScreen Tampering Vulnerability |
CVE-2026-68836 | Important | Windows kernel32.dll Elevation of Privilege Vulnerability |
CVE-2026-69326 | Important | Graphic Fonts Remote Code Execution Vulnerability |
| and 967 more | ||
Used in attacks
This fix closes a flaw that attackers were already using before the update came out, either on CISA’s list of flaws being used in attacks or in Microsoft’s own words.[2]
How to update, and how long it takes
Usually 15 to 60 minutes in all, with one or two restarts. You can keep working while it downloads.
- Save your work first.Windows restarts to finish the update, once or twice.
- Open Start → Settings → Windows Update.Select Check for updates. Windows downloads the month’s cumulative update; it includes every earlier fix.
- Restart when it asks.Select Restart now, or schedule it for tonight. Until it restarts, the fixes aren’t in place.
- Leave automatic updates on.In the same place, under Advanced options, turn on “Get me up to date” so restarts don’t wait for days.
To check it worked: Press Windows key + R, type winver and press Enter: it shows the OS build. It should say 28000.3231 or later.
Older devices
The same day, Microsoft released KB5127648 (1,009 security flaws), KB5126653 (965 security flaws) and KB5126657 (899 security flaws) for devices that stay on an older version. Each fixes the same holes where they apply.
KB5129194 vs KB5127646
KB5129194, released 14 Sep 2026, fixed 2 security flaws. KB5127646 fixes 997 security flaws and includes the fixes before it, so going straight to KB5127646 gets you both.
- Before: KB5129194, 14 Sep 2026, 2 security flaws
- After: none yet. This is the newest.
- Windows updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “KB5127646”, 13 Oct 2026.
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”.