.NET and .NET Framework November 2026 servicing updates - .NET Blog

The November 10, 2026 servicing updates for .NET 10, .NET 9, and .NET 8 include security and non-security fixes. This post brings together the security advisories, release notes, and download links for this month’s updates, along with resources for .NET Framework servicing.
The following table covers vulnerabilities affecting .NET 8, 9, 10, and 11, including associated tooling. Follow each advisory for the full list of affected products and remediation guidance.
CVE-2026-118747 requires a separate System.Formats.Cbor NuGet package update. For the .NET 9 package line, the fix is in version 9.0.24, not 9.0.23. Installing runtime 9.0.23 alone does not fix this vulnerability; update the package, then rebuild and redeploy affected applications.
CVE-2026-118741 affects ASP.NET Core Identity scaffolding and templates. Update the affected scaffolding/template packages or the SDK that supplies the templates, and correct, rebuild, and redeploy previously generated applications. Updating the runtime alone does not repair generated code.
For version-specific CVE lists, see .NET 11, .NET 10, .NET 9, and .NET 8.
For .NET Framework servicing information and update details, see the .NET Framework release notes.
Use the download links above to update your .NET SDK and runtimes. Review the release notes and security advisories for guidance relevant to your applications.
I am a Program Manager on .NET team. I specializes in .NET release processes. University of Florida Alumnus.
Tara is a Software Engineer on the .NET team. She works on releasing .NET Framework updates.
Be the first to start the discussion.
Enter the destination URL
Or link to existing content