On October 25, 2026, we released out-of-band security updates for .NET 8.0.33, .NET 9.0.22, .NET 10.0.14, and .NET 11 Release Candidate 3 (prerelease). We recommend updating affected applications and build environments as soon as possible. .NET Framework is not affected.
Release details and feedback
.NET 8.0.33 and .NET SDK 8.0.133 / 8.0.427 ( Download )
.NET 9.0.22 and .NET SDK 9.0.123 / 9.0.320 ( Download )
.NET 10.0.14 and .NET SDK 10.0.114 / 10.0.403 ( Download )
.NET 11.0.0-rc.3.26522.148 and .NET SDK 11.0.100-rc.3.26522.148 (prerelease) ( Download )
The October 13 updates did not fully address CVE-2026-70197 and CVE-2026-102870 . These out-of-band updates provide the corrected fixes; the original advisory identities and revision history are preserved. For CVE-2026-102870 , update the affected standalone Server/DevServer package references; updating only the shared runtime is not a substitute.
For CVE-2026-114148, affected Microsoft-published .NET 8/9 ASP.NET Core runtime and targeting-pack tarball installations require a clean replacement following the advisory. Source-built archives are build/engineering inputs, not directly deployed production runtimes. Update those inputs and recreate their extracted workspaces using ownership-controlled extraction; review and rebuild affected downstream outputs as needed. .NET 10/11 applicability is limited to source-built distributions.
Also announced at .NET October 2026 Out-of-Band Security Updates .
Please use the release feedback issue for release-wide issues and the linked per-CVE discussions for advisory questions.
bribrothers added Security Patch-Tuesday .NET 8.0 .NET 9.0 .NET 10.0 .NET 11.0 on Oct 25, 2026
dotnet locked and limited conversation to collaborators on Oct 25, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
