Original announcement: Microsoft .NET · 2026-11-10. Read the official announcement.
Summary of November 2026 .NET Servicing Updates
On November 10, 2026, Microsoft released servicing updates for .NET 8, 9, 10, and 11, as well as .NET Framework. These updates include important security fixes alongside various non-security improvements. The fixes address multiple vulnerabilities across ASP.NET Core, Visual Studio, and the .NET runtime and tooling components, covering significant risks such as elevation of privilege, denial of service, information disclosure, and remote code execution vulnerabilities.
Key Security Vulnerabilities Addressed
The November 2026 update addresses numerous security advisories summarized below:
- Elevation of Privilege: Multiple vulnerabilities especially affecting ASP.NET Core and general .NET runtime across all covered versions (8 through 11).
- Denial of Service: Several issues affecting ASP.NET Core as well as core .NET components that could be exploited to disrupt service availability.
- Information Disclosure: Vulnerabilities targeting ASP.NET Core that could expose sensitive information.
- Remote Code Execution: Crucial fixes in Visual Studio components to prevent remote execution attacks.
- Security Feature Bypass: Specific to .NET 11 and ASP.NET Core impacting security enforcement.
Developers should note that some fixes require more than runtime updates. For instance:
- Package Updates: CVE-2026-118747 requires updating the System.Formats.Cbor NuGet package (version 9.0.24 or later) in addition to the runtime for .NET 9.
- Scaffolding/Template Updates: CVE-2026-118741 affecting ASP.NET Core Identity scaffolding and templates mandates updating the packages or SDK used to generate code, then rebuilding and redeploying affected applications.
What Developers Need to Do Next
To maintain security and stability, development teams should:
- Review the security advisories and release notes for the specific .NET versions they use (e.g., 8, 9, 10, or 11) to understand relevant vulnerabilities and fixes.
- Download and apply the updates using the latest SDKs, runtimes, and associated packages linked from Microsoft’s release pages.
- Update related NuGet packages where applicable, especially System.Formats.Cbor for .NET 9, and verify application dependencies.
- Rebuild and redeploy applications in cases where code is generated using ASP.NET Core Identity scaffolding or other templates affected by these vulnerabilities.
- Test applications post-update to confirm stability and that fixes are successfully applied.
Additional Resources
Developers can find detailed version-specific CVE lists and release notes at official Microsoft documentation, including:
- .NET 11
- .NET 10
- .NET 9
- .NET 8
- .NET Framework release notes
It is crucial to frequently monitor such official releases to address security risks timely.
Checklist for Developers
- Confirm your application’s .NET version(s).
- Review November 2026 security advisories relevant to your version.
- Update .NET runtime(s) and SDK(s) to the latest November 2026 versions.
- Update critical NuGet packages, notably System.Formats.Cbor if applicable.
- Update ASP.NET Core scaffolding/templates if used; rebuild and redeploy applications.
- Test applications to verify proper functioning post-update.
