Microsoft released the KB5127936 preview cumulative update for Windows 11 versions 25H2 and 26H2, with 41 changes, including File Explorer and Cloud rebuild improvements.
KB5127936 is a preview update that adds new features and fixes at the end of each month, letting IT admins and users test them before they roll out to the entire user base during next month’s Patch Tuesday.
However, unlike regular Patch Tuesday cumulative updates, monthly preview updates are optional and don’t include security patches.
The October 2026 preview update makes the File Explorer context menu faster and easier to customize, letting users choose which app extensions and commands appear and how they’re organized.
After you install KB5127936, Cloud rebuild can also reinstall Windows without USB media or a custom image, using an image and drivers downloaded directly from Windows Update, even when Windows won’t start.
Microsoft also updated XBOX mode to include a refreshed Gaming Task View with quick access to key system actions like Power Options and Exit to Desktop while gaming via a new navigation bar.
You can install the KB5127936 preview update by downloading it from the Microsoft Update Catalog or by opening Settings, going to Windows Update, and selecting “Check for Updates.”
Because this is an optional update, you will need to click the “Download and install” link unless you have “Get the latest updates as soon as they’re available” enabled (which prompts the OS to install it automatically).
Windows 11 KB5127936 highlights
Once installed, this optional non-security update will upgrade Windows 11 25H2 and 26H2 devices to builds 26200.9818 and 26300.9818, respectively.
The October 2026 preview update adds further changes and improvements, some of the more important ones highlighted below:
- New! This update improves the Privacy & security page in Windows Settings by grouping related Camera, Microphone, and Location privacy controls and elevating usage information from linked pages onto the main page.
- New! This update enables Windows recovery (WinRE) to automatically reuse eligible Wi-Fi profiles already saved in Windows, including supported certificate-based networks. Devices can now get online automatically during recovery scenarios such as quick machine recovery or cloud rebuild, without preconfiguring Wi-Fi credentials in WinRE. This capability is on by default, and IT admins can disable it. Microsoft disclosed this feature last month, and it is now beginning to roll out.
- New! This update introduces a Restore Summary that appears after you restore a backup profile to a new device. The summary clearly shows what was restored, including Windows settings and the list of Microsoft Store apps. This improves transparency during device transitions, helps you validate your restore results, and lets you continue setup on your new device with confidence.
- New! This update improves the adaptive hibernate policy to provide faster Modern Standby instant-on resumes while helping preserve battery life when the charge is low. Noticeable changes include less hibernation when the battery is above 80% and earlier hibernation below 10%.
This month, Microsoft also reminded users that updated Secure Boot certificates are rolling out to replace the original 2011 certificates, which will expire in late June 2027.
Microsoft first announced plans to refresh expiring Secure Boot certificates on eligible Windows 11 systems in January, after warning users and IT admins in November 2025 to update them before they expire.
The company also warned customers they may need to reboot one more time after installing the October 2026 optional update and updates rolling out over the next several months.
“With recent and upcoming Windows updates over the next few months, a limited number of consumer and business devices might experience one additional restart during installation,” Microsoft noted in a message center update. “This one‑time restart occurs after a Secure Boot certificate update is applied as part of the Secure Boot update process.”
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
