.NET 10.0.13 released with fixes for 44 CVEs
.NET 10.0.13 was released on 2026-10-13. It ships .NET Runtime 10.0.13, ASP.NET Core Runtime 10.0.13, SDK 10.0.402, 10.0.113. The official release metadata lists 44 CVEs addressed in this release. .NET 10.0 is an LTS release currently in the "active" support phase, with support ending on 2028-11-14.
What was released From the source
According to Microsoft's official .NET release metadata, .NET 10.0.13 was published on 2026-10-13. The components and versions in this release are:
- Release: .NET 10.0.13
- Release date: 2026-10-13
- .NET Runtime: 10.0.13
- ASP.NET Core Runtime: 10.0.13
- SDK versions: 10.0.402, 10.0.113
- C# language version: 14.0
- Visual Studio versions: 18.10.4, 18.11.0
- Release type: LTS
- Support phase: Active support
- End of support: 2028-11-14
- Security release: Yes (44 CVEs listed)
At a glance · .NET release
About 25 months of support left
Security fixes listed for this release From the source
The release metadata marks this as a security release and lists the following CVE identifiers. Severity, affected components and mitigations for each CVE are described in the official release notes and the CVE records.
- CVE-2026-66822
- CVE-2026-58280
- CVE-2026-69651
- CVE-2026-96958
- CVE-2026-96960
- CVE-2026-96959
- CVE-2026-84008
- CVE-2026-70174
- CVE-2026-87697
- CVE-2026-70035
- CVE-2026-83520
- CVE-2026-96229
- CVE-2026-96232
- CVE-2026-96234
- CVE-2026-70007
- CVE-2026-96224
- CVE-2026-96235
- CVE-2026-85363
- CVE-2026-96233
- CVE-2026-70175
- CVE-2026-70196
- CVE-2026-70179
- CVE-2026-70181
- CVE-2026-70161
- CVE-2026-70165
- CVE-2026-70190
- CVE-2026-96238
- CVE-2026-96237
- CVE-2026-70159
- CVE-2026-70186
- CVE-2026-105016
- CVE-2026-85790
- CVE-2026-70162
- CVE-2026-70183
- CVE-2026-88092
- CVE-2026-70188
- CVE-2026-96957
- CVE-2026-96230
- CVE-2026-92707
- CVE-2026-96231
- …and 4 more listed in the release notes
Why it matters Analysis
Applications that run on an earlier .NET 10.0 patch remain exposed to the issues fixed in this release until they are updated. Framework-dependent apps are fixed by updating the runtime on the host or in the container image; self-contained and single-file apps embed the runtime and must be rebuilt and redeployed.
Who should care Analysis
- Teams running .NET 10.0 applications in production or testing
- Owners of container images built on .NET 10.0 base images
- Teams that publish self-contained or single-file applications
- Developers and CI pipelines that pin an SDK version in global.json
How to update Analysis
- Check installed versions with
dotnet --list-runtimesanddotnet --list-sdks. - Install the updated runtime or SDK 10.0.402 from the official download page or your operating system's package manager.
- If global.json pins an SDK version, update it to 10.0.402 or configure an appropriate rollForward policy.
- Rebuild container images so they pick up the updated base image, and rebuild self-contained apps.
- Read the release notes for known issues and run your test suite before rolling out to production.
Sources and further reading
- .NET 10.0.13 release notes (original source)
- .NET 10.0 release metadata (JSON) (official)
- Download .NET 10.0 (official)
- .NET support policy (documentation)
Original: “.NET 10.0.13 released with 44 security fixes”, .NET release metadata, published 13 Oct 2026, retrieved 16 Oct 2026. This article was generated from the official source using our structured templates and passed automated quality checks. Spotted a mistake? See our corrections policy.