MC1294316
Prevent or fix issuesMajor changeAdmin impact
An updated version of the April 2026 Scan Cab is available
Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Microsoft asks admins to prevent or fix an issue. Read what it asks below and check the linked documentation; whether your tenant is affected is not known here.
What the notice says
Microsoft’s text, with source markup removedIMPORTANT:This notice is only relevant for environments where: Visual Studio 2026 with .NET version 10.0.6 is used Scan Cab is used to check for update compliance The April 2026 Scan Cab was deployed before 10:30 AM PT on April 28, 2026 An updated version of the April 2026 Scan Cab was made available at 10:30 AM PT on April 28, 2026. This Scan Cab includes new metadata corresponding to updates for Visual Studio 2026. The Microsoft update for Visual Studio 2026 released on April 28, 2026, includes additional protections to address CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability. See the Additional information section of this message for details. How this affects your organization: IT administrators who downloaded the Scan Cab before 10:30 AM PT on April 28, 2026, should re-acquire and re-deploy it if the Scan Cab is used to assess updates for environments where Visual Studio 2026 is used. No action is required for environments where Scan Cab is not employed, or Visual Studio 2026 is not used. However, please note that there might be non-Microsoft applications that utilize Scan Cab. Review the documentation for any software and update deployment tools used in your organization to determine whether this applies to your environment. What you need to do to prepare: Administrators can download and deploy the updated Scan Cab using their usual processes. For more information, see the Additional information section below. Additional information: Updated Scan Cab: Download the new Scan Cab here CVE-2026-40372: ASP.NET Core Elevation of Privilege Vulnerability .NET 10.0.7 Out-of-Band Security Update: .NET Blog Visual Studio 2026 release notes Announcing a smaller WSUS Scan Cab - Microsoft Tech Community: Learn more about WSUS and the Scan Cab process Using WUA to Scan for Updates Offline - Win32 apps | Microsoft Docs: Windows Update Agent (WUA) can be used to scan computers for security updates without connecting to Windows Update WSUS and the Catalog Site | Microsoft Docs: The Catalog Site used by WSUS to import updates and drivers
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372
- https://go.microsoft.com/fwlink/?LinkID=74689
- https://devblogs.microsoft.com/dotnet/dotnet-10-0-7-oob-security-update/
- https://learn.microsoft.com/visualstudio/releases/2026/release-notes
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/announcing-a-smaller-wsus-scan-cab/ba-p/2928256?msclkid=256145ccd0c011ec9266b53af8d0aca1
- https://learn.microsoft.com/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline?tabs=vbscript
- https://learn.microsoft.com/windows-server/administration/windows-server-update-services/manage/wsus-and-the-catalog-site
What changed
Between archive captures, newest firstThe archive supplies one version of this notice.
Linked documentation
Microsoft pages the notice links toRelated public evidence
No related evidence found in this installation's recent collection. This does not establish that no announcement exists.
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.
- 1 linked page has not been read yet.