NET and .NET Framework November 2026 servicing updates

Microsoft released its November 10, 2026 servicing updates across active .NET platforms, delivering security patches and reliability fixes for .NET 11, .NET 10, .NET 9, and .NET 8. According to .NET Blog's report, the coordinated release provides refreshed binaries, container images, and security advisories alongside dedicated servicing resources for legacy .NET Framework installations. The update addresses multiple critical elevation of privilege, denial of service, and remote code execution vulnerabilities across both developer tools and production runtimes.

This report details the version increments, the complete catalog of addressed Common Vulnerabilities and Exposures, and the mandatory package upgrades that require recompilation. It is aimed at enterprise systems administrators, software engineers, and DevOps teams responsible for maintaining secure .NET deployments across Linux servers, Windows environments, and containerized workloads. Readers will find exact version numbers, tooling prerequisites, and operational steps necessary to remediate every disclosed vulnerability without disrupting active infrastructure.

01Servicing releases across four major runtime versions

The November 10, 2026 release brings target version upgrades across four distinct generations of the .NET ecosystem. Version 11 reaches release 11.0.0 alongside SDK build 11.0.100, while version 10 advances to release 10.0.15. Concurrently, version 9 moves forward to release 9.0.23, and the long-term support branch of version 8 updates to release 8.0.34.

Each version increment packages a combination of security corrections and non-security runtime stability enhancements. Microsoft published refreshed release notes, standalone installers, and binary packages simultaneously for all four lines. Development teams maintaining production web services or internal tools must align their base runtime installations with these exact numerical milestone releases.

The coordination across four active versions ensures consistent maintenance for both standard term support and long-term support branches. System engineers managing mixed application fleets must catalog their target framework monikers to apply the appropriate patch level. Upgrading the underlying host runtime provides the baseline foundation for securing downstream enterprise workloads.

02Security advisories and Visual Studio remote execution flaws

The servicing release addresses twenty-five individual CVE records spanning ASP.NET Core, the base runtime, and developer tooling. Visual Studio remote code execution vulnerabilities CVE-2026-114151, CVE-2026-114152, CVE-2026-118745, CVE-2026-114158, and CVE-2026-114159 affect versions 8, 9, 10, and 11. These flaws allow attackers to execute arbitrary commands if a developer opens compromised project files or malicious development assets.

ASP.NET Core received patches for multiple elevation of privilege vulnerabilities, including CVE-2026-114146, CVE-2026-70175, and CVE-2026-118741 affecting versions 8, 9, and 10, alongside CVE-2026-109481 for version 11. Core runtime elevation vulnerabilities include CVE-2026-105544 across all four versions and CVE-2026-114155 for versions 10 and 11. These flaws allow unauthenticated or unauthorized actors to escalate system permissions within application contexts.

Denial of service and bypass flaws also account for a heavy share of the advisories. ASP.NET Core denial of service issues include CVE-2026-114147, CVE-2026-114149, CVE-2026-109478, CVE-2026-114154, CVE-2026-118748, and CVE-2026-118749, while the runtime faced CVE-2026-109475, CVE-2026-118747, and CVE-2026-120796. Security bypasses were logged under CVE-2026-114156, CVE-2026-118746, and CVE-2026-114157, with information disclosures under CVE-2026-114150 and CVE-2026-109476.

03Package mitigations for Cbor and Identity scaffolding

Remediating CVE-2026-118747 requires targeted package management beyond updating host environments. This denial of service vulnerability stems from the System.Formats.Cbor NuGet package across versions 8, 9, 10, and 11. For projects operating on the version 9 package line, the official fix resides in version 9.0.24 rather than the general runtime patch level of 9.0.23.

Installing runtime 9.0.23 alone fails to resolve the CBOR denial of service exposure on application servers. Engineering teams must explicitly bump the System.Formats.Cbor package dependency in project configuration files. After updating package references, developers must clean, recompile, and redeploy compiled assemblies to production clusters.

A similar requirement governs CVE-2026-118741, an ASP.NET Core elevation of privilege flaw affecting versions 8, 9, and 10. The vulnerability resides inside Identity scaffolding code and project templates generated during initial setup. Updating the underlying runtime leaves previously generated identity code vulnerable, requiring teams to upgrade the scaffolding packages or SDK, correct generated files, and redeploy their applications.

04Platform binaries, container images, and repository changelogs

Microsoft published updated distribution channels alongside raw installers, ensuring immediate availability across diverse environments. Official container registries received rebuilt images for versions 11.0, 10.0, 9.0, and 8.0, allowing automated continuous integration pipelines to pull patched base layers. Package feeds for major Linux distributions were synchronized simultaneously with binary installers.

Component changelogs highlight specific subsystem revisions across the patched versions. ASP.NET Core, the core Common Language Runtime, and Windows Forms published changelogs detailing version 11.0.0 enhancements. Entity Framework Core documented updates for both 11.0.0 and 10.0.15, while Roslyn compiler improvements accompanied the version 11 milestone.

Engineering teams can review documented known issues published for versions 11.0, 10.0, 9.0, and 8.0 before rollout. Documented regressions or environment conflicts help administrators anticipate platform behavioral changes. Reviewing changelogs across runtime and SDK boundaries provides visibility into low-level fixes that accompany security patches.

05Runtime installations, rebuild requirements, and deployment steps

Deploying the November servicing updates requires a multi-stage approach across development and server fleets. Systems operators must first install updated SDKs and runtime binaries, targeting 11.0.0, 10.0.15, 9.0.23, or 8.0.34 depending on active application tracks. Server environments hosting legacy applications on .NET Framework must consult dedicated .NET Framework servicing release notes for separate platform guidance.

Developers must update their local SDKs to build 11.0.100 or matching minor releases to patch Visual Studio code execution risks. Development workstations running IDE instances must be upgraded promptly to neutralize vulnerabilities CVE-2026-114151, CVE-2026-114152, CVE-2026-118745, CVE-2026-114158, and CVE-2026-114159. Keeping developer workstations patched prevents compromised project templates from executing untrusted code during development.

The final deployment milestone demands recompilation and verification across downstream microservices. Teams must verify that internal dependencies do not lock vulnerable System.Formats.Cbor packages or unpatched Identity scaffolding code. Once recompiled binaries pass automated testing, rolling deployments across container clusters and host servers complete the monthly remediation cycle.