The File Explorer preview pane can show your downloaded PDFs again. Microsoft turned it off for internet files a year ago to stop a credential-leak trick, and the October 2026 update brings it back with a safer design.
- Fix arrives in the October 13, 2026 update, KB5127648.
- Downloaded PDFs preview again without extra steps.
- Downloaded HTML files show a warning and a Preview anyway button.
- Rollout is gradual, so you may not see it right away.
If you only want the short version: install the latest Windows 11 update, then click a PDF in File Explorer with the preview pane on (Alt + P).
Why the File Explorer preview pane stopped working on downloads
Starting with security updates on October 14, 2025, Windows blocked previews for files carrying the Mark of the Web. That is the hidden tag Windows adds to files from browsers, email attachments, and cloud storage.
According to BetaNews, Microsoft said the block closes a flaw where an attacker could capture NTLM credentials when you preview a file with HTML tags pointing at an outside path. In plain terms, just looking at a file could leak a password hash.
The fix worked, but it also broke a daily habit. Anyone who skims invoices, résumés, or manuals in the preview pane suddenly saw a blank box.
What changed in the October 2026 update
Here is how the timeline played out, based on reports from Windows Latest and BetaNews.
| When | What happened |
|---|---|
| Before October 14, 2025 | Preview worked on all files, including downloads |
| October 14, 2025 onward | Preview pane blocked for files with the Mark of the Web |
| April 2026 | “Preview anyway” button appears in Release Preview builds |
| September 22, 2026 | Optional update KB5124010 starts restoring PDF previews |
| October 13, 2026 | KB5127648 rolls the change into the regular update |
The takeaway: this is no longer a test feature. If you install the monthly update, you get it.
PDFs now preview normally. HTML files are treated more carefully, since those are the ones that can carry the risky external links. For them, Explorer shows a security warning with a button to preview anyway.
How to use “Preview anyway” without getting burned
Treat the button like a seatbelt you only unbuckle for a reason. Use it when you know where the file came from, such as your own export or a colleague you trust.
Skip it for HTML files from unknown senders. A one-click preview is quick, but the whole point of the warning is that the file might reach out to another server.
If a file still won’t preview
First, turn on the preview pane from View > Show > Preview pane. Then check that Windows has finished installing the update under Settings > Windows Update.
If the file is one you trust and Explorer still blocks it, right-click it, open Properties, and tick Unblock at the bottom of the General tab. That removes the Mark of the Web for that single file.
Who gets the fix, and when
The update covers Windows 11 24H2, 25H2, and 26H2. Features roll out gradually, so two PCs on the same build can behave differently for a few days.
Also note that Home and Pro editions of 24H2 stopped getting security fixes on October 13. We covered that in our guide to the KB5127648 security fix, and our Windows 11 26H2 guide explains the small upgrade that keeps you supported.
Microsoft has not said whether admins can control the button through Group Policy. If you manage work PCs, test before you assume.
Why the warning matters for everyday security
NTLM leaks sound abstract, but the risk is simple. A booby-trapped HTML file can ask Windows to fetch something from an attacker’s server, and Windows may hand over a hashed login while doing it.
Attackers can then try to crack that hash offline or reuse it on the same network. That is why a harmless-looking preview was worth blocking, and why Microsoft kept a pause step for HTML instead of removing the guard altogether.
A few habits keep you safe whatever Microsoft ships next:
- Open files from unknown senders in a browser or a sandbox, not the preview pane.
- Keep Windows Update on, since the security side of this change arrived through patches.
- Unblock a file only after you know where it came from.
These cost nothing and cover the exact trick this change was built to stop.
Frequently Asked Questions
Why can’t I preview a PDF I just downloaded?
Windows marks internet downloads with the Mark of the Web and, since late 2025, blocked previews for them. Install the October 2026 update and PDFs should preview again.
Is it safe to click Preview anyway?
It is fine for files you trust. Avoid it for HTML files from strangers, because those can contain links that trigger the credential leak Microsoft was blocking.
How do I turn the preview pane on?
Open File Explorer, press Alt + P, or go to View > Show > Preview pane.
Does the update fix previews on Windows 10?
No. The reports we found cover Windows 11 only, and the Windows 10 behavior was not part of them.
Will Preview anyway be on every PC right away?
Not necessarily. Microsoft is rolling features out in stages, so it can take days to appear.
Our take
This is a sensible compromise: PDFs, which most people open all day, work again, while the risky file type keeps a speed bump. Install the October update, leave the default alone, and only click Preview anyway when you know the sender.
Leave a Reply