Microsoft shipped its August 2026 servicing updates for .NET and .NET Framework on August 11, 2026 .NET Blog, bundling 10 security fixes across the 8.0, 9.0, and 10.0 release lines.
The refresh touches ASP.NET Core, Entity Framework Core, and the shared .NET runtime. The patched builds are ASP.NET Core 10.0.11, 9.0.19, and 8.0.30; Entity Framework Core 10.0.11, 9.0.19, and 8.0.30; and the runtime 10.0.11, 9.0.19, and 8.0.30 .NET Blog.
The 10 CVEs fixed this month span several severity classes. The .NET 10.0.11 notes list remote code execution flaws tracked as CVE-2026-70354 and CVE-2026-62897, elevation-of-privilege flaws CVE-2026-62886, CVE-2026-62871, and CVE-2026-62909, information-disclosure flaws CVE-2026-62898, CVE-2026-62900, and CVE-2026-62902, a security-feature bypass CVE-2026-62899, and a denial-of-service flaw CVE-2026-62901 .NET 10.0.11 release notes.
The matching .NET 9.0.19 build shipped inside SDK 9.0.317 and 9.0.120 on August 11, 2026 .NET 9.0.19 release notes, and it carries the same CVE set as the 10.0 line.
.NET Framework received its own separate August 2026 security and non-security updates through the usual Windows Update and catalog channels .NET Blog. For broader Microsoft context, see our related report on Microsoft’s AI benchmark gap zBrandco.
On the Windows toolchain side, Microsoft recommends Visual Studio 18.9 or later to host the .NET 10 SDK, while .NET 9.0 requires at least Visual Studio 17.12 .NET 10.0.11 release notes.
The practical call for teams is to patch as standard, especially on internet-facing ASP.NET Core services, because the fixed set includes remote code execution and elevation-of-privilege paths. The .NET 10.0.11 SDKs that bundle the runtime are 10.0.400, 10.0.303, and 10.0.111 .NET 10.0.11 release notes.
