.NET 10.0.13 servicing release lists 44 CVEs, 13 of them remote code execution

Victoria Shinder14 October 2026, 09:202 min read

Microsoft has published the October 2026 servicing updates for .NET and .NET Framework. The .NET Blog post dated 12 October gives the new versions as 10.0.13, 9.0.21 and 8.0.32, refreshed "as of October 13, 2026" with security and non-security fixes, and links a separate CVE list per supported version. The matching tags in the dotnet/core and dotnet/aspnetcore repositories were published on 13 October.

How large the security part is. The release notes for .NET 10.0.13 list 44 CVE entries. Grouped by the titles Microsoft gives them: 13 remote code execution entries (nine titled ".NET and Visual Studio", two in ASP.NET Core, one in Microsoft QUIC and one in the .NET SDK), 14 denial of service (six in ASP.NET Core, six ".NET and Visual Studio", two in .NET itself), five information disclosure, seven elevation of privilege (three of them in the SDK, two in ASP.NET Core) and five security feature bypass (three ASP.NET Core, two SDK). The post itself does not rank them; the per-CVE details sit in Microsoft's update guide.

What changed in ASP.NET Core. The v10.0.13 release of dotnet/aspnetcore shows the concrete fixes behind the version number. Among them: the output cache middleware no longer caches truncated or aborted responses; a fix closes a JsonIgnore validation bypass for write-only conditions; HTTP/2 handling is hardened to refuse newline characters in trailers and in the dynamic HPACK table; connection- and stream-level abort locking for HTTP/3 is corrected; and a deadlock in the certificate manager process is fixed. The Java SignalR client gets a fix for a hang when reading an HTTP response body fails, and MessagePack moves to 2.5.303.

Which SDK to install. For .NET 10 the matching SDKs are 10.0.402 and 10.0.113; installing the SDK brings the updated runtime with it, so the separate runtime packages are only needed on machines without an SDK. Container images and Linux packages are linked from the same post. .NET Framework also receives security and non-security updates this month, documented in its own release notes.

What Microsoft asks. The post closes with a single instruction: update to the latest service release today. With 44 CVE entries on the 10.0 line alone, the October patch is the one to schedule rather than skip.

Sources: .NET Blog, ".NET and .NET Framework October 2026 servicing releases updates" — https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-october-2026-servicing-updates/ · .NET 10.0.13 release notes — https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md · ASP.NET Core v10.0.13 — https://github.com/dotnet/aspnetcore/releases/tag/v10.0.13