Full Report
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update. [...]
Analysis Summary
# Vulnerability: Windows 11 KB5127648 Update Prevents Enabling Smart App Control (Non-Security Defect)
> **Note:** This article does not describe a security vulnerability. It covers a functional regression in the October 2026 Windows 11 update. No CVE has been assigned, and no CVSS score or CWE applies. The security relevance is indirect: devices where Smart App Control is turned off lose a protection layer.
## CVE Details
- CVE ID: None assigned
- CVSS Score: N/A
- CWE: N/A (functional defect, not a weakness classification)
## Affected Systems
- Products: Windows 11 (security update KB5127648)
- Versions: Windows 11 version 24H2 and later (24H2, 25H2, 26H2)
- Configurations: Devices where Smart App Control was previously turned off. After installing KB5127648, the toggle may be grayed out and cannot be re-enabled. Devices where Smart App Control is already on are not affected, per Microsoft.
## Vulnerability Description
After installing KB5127648, some devices cannot turn Smart App Control back on in the Windows Security app. The option appears grayed out. Smart App Control uses Microsoft's app intelligence services and code integrity features, alongside Microsoft Defender and SmartScreen, to block potentially harmful apps and binaries.
The article does not describe the root cause. Microsoft has not released a fix at the time of reporting.
## Exploitation
- Status: Not exploited (this is a reliability bug, not an attack)
- Complexity: N/A
- Attack Vector: N/A
## Impact
- Confidentiality: None directly
- Integrity: None directly. Indirectly, a device stays without Smart App Control protection, which reduces defense against malicious binaries.
- Availability: None. The impact is a loss of a configuration option.
## Remediation
### Patches
- No fix available yet. Microsoft says a fix is in progress. Monitor the KB5127648 advisory for updates.
### Workarounds
- **Registry method (per Microsoft):** Run the following from an elevated Command Prompt, then restart the device:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
Test on a non-production device first. These are feature-flag overrides, so reverting them after Microsoft ships a fix is advisable.
- **Group Policy method (enterprise-managed devices):** Install the two Feature Preview MSI packages for KB5074105 (builds 261015_19222 and 261015_19221), which are linked from the Microsoft advisory. Then set both policies to **Enabled** under Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2. Restart the affected devices. These policies also enable logging for troubleshooting.
## Detection
- Check the Smart App Control state in Windows Security > App & browser control > Smart App Control settings. A grayed-out toggle that shows Off indicates an affected device.
- Inventory endpoints that have Smart App Control turned off. These are the devices at risk of being unable to re-enable it after the update.
- Review the Feature Preview policy logs on devices where the Group Policy workaround is applied, since the policies enable logging for troubleshooting.
- The article lists no indicators of compromise, because this is not an attack.
## References
- Microsoft KB5127648 advisory: hxxps://support[.]microsoft[.]com/en-us/servicing/os/windows-11/2026/10/kb5127648-windows-11-24h2-25h2-26h2-security-update
- Feature Preview MSI packages (KB5074105), hosted on download[.]microsoft[.]com (linked from the Microsoft advisory; retrieve from there rather than from this summary)
- BleepingComputer article: hxxps://www[.]bleepingcomputer[.]com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/
- Related BleepingComputer coverage: Remote Desktop failures with Administrator protection (hxxps://www[.]bleepingcomputer[.]com/news/security/microsoft-recent-windows-updates-may-trigger-remote-desktop-failures/)