Microsoft has shipped its November 2026 servicing updates for .NET, fixing 25 vulnerabilities across .NET 8, 9, 10 and 11. The most serious are five remote code execution flaws in Visual Studio, led by CVE-2026-114151, which developers should patch by updating their runtimes and tooling.

The updates were published on 10 November 2026 as part of the monthly Patch Tuesday cycle. They cover the .NET runtime, ASP.NET Core and associated tooling, with separate servicing updates for .NET Framework.

Five Visual Studio code execution flaws

Five of the 25 flaws allow remote code execution in Visual Studio: CVE-2026-114151, CVE-2026-114152, CVE-2026-118745, CVE-2026-114158 and CVE-2026-114159. All five affect the tooling that ships alongside .NET versions 8, 9, 10 and 11, so teams that build with Visual Studio need the update as well as the runtime fix.

Remote code execution is the most dangerous class of flaw in a developer tool, because a compromised build environment can pass malicious code into the software it produces. Microsoft lists the five flaws in its November servicing announcement alongside the runtime fixes.

What else the update fixes

The remaining flaws span privilege escalation, denial of service and information disclosure across .NET and ASP.NET Core. They include an ASP.NET Core elevation of privilege flaw, CVE-2026-114146, and a .NET elevation of privilege flaw, CVE-2026-105544, both affecting versions 8, 9, 10 and 11.

Several denial of service flaws are also fixed, including CVE-2026-109475 in .NET and CVE-2026-114147, CVE-2026-114149 and CVE-2026-114154 in ASP.NET Core. Information disclosure flaws include CVE-2026-109476 in ASP.NET Core and CVE-2026-114150, which affects .NET 11. Two further security feature bypass flaws, CVE-2026-114156 and CVE-2026-114157, affect ASP.NET Core.

Two fixes need more than a runtime update

Two of the flaws carry extra steps that a simple runtime install will not complete. CVE-2026-118747, a .NET denial of service flaw, requires a separate update to the System.Formats.Cbor NuGet package. For the .NET 9 line, the fix is in package version 9.0.24, not 9.0.23, so installing runtime 9.0.23 alone does not close it. Affected applications must update the package, then rebuild and redeploy.

CVE-2026-118741 affects ASP.NET Core Identity scaffolding and templates. Updating the runtime alone does not repair applications already generated from the vulnerable templates. Teams must update the affected scaffolding or template packages, or the SDK that supplies them, and correct, rebuild and redeploy previously generated applications.

Versions to install

The fixed releases are .NET 11.0.0, .NET 10.0.15, .NET 9.0.23 and .NET 8.0.34. Microsoft publishes installers, binaries and container images for each line, with release notes and known issues on GitHub, and separate release notes for .NET Framework servicing.

Developers running self-contained applications or container images should rebuild and redeploy them against the patched runtimes, since updating a host runtime does not change a bundled copy. The November update follows an out-of-band .NET release on 25 October that fixed a Brotli decompression flaw, CVE-2026-111497, which the US cybersecurity agency later added to its exploited-vulnerabilities list with a federal patch deadline of 10 November.

Microsoft recommends updating SDKs and runtimes to the latest servicing release and reviewing the release notes and security advisories for guidance relevant to each application.