May 2026 .NET and .NET Framework Servicing Updates: Key Questions Answered

The May 2026 servicing updates for .NET and .NET Framework are here, bringing important security fixes and non-security improvements. Below, we answer the most pressing questions about the latest release to help you understand what changed, which vulnerabilities are addressed, and how to update your systems efficiently.

What are the main highlights of the May 2026 servicing updates for .NET and .NET Framework?

The May 2026 updates focus on security and reliability. Key highlights include fixes for four CVEs affecting multiple versions of .NET and .NET Framework. The release provides updated binaries and container images for .NET 10.0, 9.0, and 8.0 (versions 10.0.8, 9.0.16, and 8.0.27 respectively), as well as security and non-security patches for .NET Framework 3.5, 4.6.2, 4.7, 4.7.2, 4.8, and 4.8.1. Administrators are encouraged to update to the latest builds to protect their applications and infrastructure.

Which security vulnerabilities have been fixed in this release?

Four distinct security issues have been resolved:

• CVE-2026-32177 – An Elevation of Privilege vulnerability affecting .NET 10.0, 9.0, 8.0, as well as multiple .NET Framework versions (3.5, 4.6.2, 4.7, 4.7.2, 4.8, 4.8.1).
• CVE-2026-35433 – Another Elevation of Privilege issue that impacts only .NET 10.0, 9.0, and 8.0.
• CVE-2026-32175 – A Tampering vulnerability applying to the same .NET versions (10.0, 9.0, 8.0).
• CVE-2026-42899 – A Denial of Service vulnerability also affecting .NET 10.0, 9.0, and 8.0.

These fixes are included in the May 12, 2026 rollout.

What specific version numbers and assets are available for .NET 10, 9, and 8?

For each supported .NET line, the release tag is as follows:

• .NET 10.0.8 – includes ASP.NET Core 10.0.8, Entity Framework Core 10.0.8, and Runtime 10.0.8.
• .NET 9.0.16 – Runtime 9.0.16.
• .NET 8.0.27 – Runtime 8.0.27.

Installers, binaries, and container images are accessible through the official download page. Linux packages are available for each version via the respective package feeds. Detailed release notes and known issues documents are published for each version, and the changelogs for ASP.NET Core and Entity Framework Core are also posted separately.

What are the known issues for each .NET version in this update?

Known issues have been documented for .NET 10.0, 9.0, and 8.0. While the official list is hosted on the known issues pages linked from the release notes, common themes include potential compatibility problems with certain third-party libraries and rare edge cases in runtime performance. It is strongly recommended to review the known issues for your specific version before deploying the update in production environments. If you encounter any new issues, consider reporting them through the feedback mechanism.

What is included in the .NET Framework May 2026 updates?

This cycle includes both security and non-security updates for .NET Framework. The security fixes address the Elevation of Privilege vulnerability (CVE-2026-32177) that also affects .NET Framework 3.5, 4.6.2, 4.7, 4.7.2, 4.8, and 4.8.1. Non-security improvements cover reliability and performance enhancements across the framework. For a complete list of changes, browse the dedicated .NET Framework release notes on the Microsoft documentation site.

How can I provide feedback or report issues with this release?

Feedback is welcome through the official Release feedback issue tracker. Visit the feedback issue linked from the original announcement to share your experience, report any problems, or suggest improvements. Your input helps the team refine future servicing updates. If you encounter a security vulnerability, follow the responsible disclosure guidelines published on the Microsoft Security Response Center page.

What should I do after reading this update?

Take action now: update your .NET and .NET Framework installations to the latest service releases. Start by reviewing the version numbers and known issues for your supported version. Download the appropriate installers, binaries, or container images, and apply the update in your staging environment before rolling out to production. For recurring updates, subscribe to the .NET Blog or RSS feed to stay informed. As always, test thoroughly to ensure compatibility with your applications.