KB5128924

.NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2

Support article Update Catalog CVEs in Security CVE list for a ticket

.NET Framework servicing update

Microsoft Support

Framework servicing is separate from the Windows OS update. Microsoft's article provides applicability and security fixes; test the framework versions installed on your servers.

Applies to

Windows 10, version 21H2 Windows 10, version 22H2

Related packages

KB5127683 KB5127689

Security improvements · 19 CVEs named by Microsoft

CVE-2026-58280 CVE-2026-69439 CVE-2026-69651 CVE-2026-70007 CVE-2026-70035 CVE-2026-70174 CVE-2026-83520 CVE-2026-84008 CVE-2026-85363 CVE-2026-87697 CVE-2026-96222 CVE-2026-96224 CVE-2026-96233 CVE-2026-96958 CVE-2026-96959 CVE-2026-96960 CVE-2026-97788 CVE-2026-97801 CVE-2026-108398

Source: Microsoft Support · 13 Oct 2026

Companion updates for this Windows version

Same patch cycle

Windows and .NET Framework are serviced separately. These packages target the same Windows version; choose the framework packages that apply to your installation.

KB5126657Windows OS

Windows 10, version 21H2 · monthly security update

13 Oct 2026

Companion updates do not replace this KB or establish an installation prerequisite.

19CVEs fixed · 1 critical

0Exploited or in CISA KEV

Security fixes

19 Microsoft CVEs · most urgent first

CVE	Vulnerability	Severity	CVSS	EPSS	Impact	Status
CVE-2026-108398	.NET Framework Security Feature Bypass Vulnerability.NET Framework	Important	8.8	0.5%	SFBLocal	Disclosed
CVE-2026-96222	Active Directory Federation Services (AD FS) Spoofing VulnerabilityActive Directory Federation Services (AD FS)	Critical	7.4	0.6%	SpoofingNetwork	Revised 16 Oct
CVE-2026-69439	.NET and Visual Studio Elevation of Privilege Vulnerability.NET and Visual Studio	Important	8.8	0.8%	EoPNetwork	Revised 25 Sep
CVE-2026-70007	.NET Framework Remote Code Execution Vulnerability.NET Framework	Important	8.8	0.6%	RCENetwork	Revised 15 Oct
CVE-2026-70035	.NET Framework Remote Code Execution Vulnerability.NET Framework	Important	8.8	1.3%	RCENetwork
CVE-2026-70174	.NET Remote Code Execution Vulnerability.NET	Important	8.8	0.8%	RCENetwork	Revised 15 Oct
CVE-2026-83520	.NET Remote Code Execution Vulnerability.NET	Important	8.8	1.3%	RCENetwork
CVE-2026-85363	.NET Framework Elevation of Privilege Vulnerability.NET Framework	Important	8.8	0.7%	EoPNetwork	Revised 15 Oct
CVE-2026-87697	.NET Remote Code Execution Vulnerability.NET	Important	8.8	0.8%	RCENetwork	Revised 15 Oct
CVE-2026-96224	.NET Remote Code Execution Vulnerability.NET	Important	8.8	0.7%	RCENetwork	Revised 15 Oct

Showing the 10 most urgent of 19All 19 CVEs

What changed

First observed 19 Oct 2026

20 Oct 2026 CVEs named by MicrosoftCVE-2026-58280, CVE-2026-62886, CVE-2026-69439, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-87697, CVE-2026-96222, CVE-2026-96224, CVE-2026-96233, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960, CVE-2026-97788, CVE-2026-97801, CVE-2026-108398 → CVE-2026-58280, CVE-2026-69439, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-87697, CVE-2026-96222, CVE-2026-96224, CVE-2026-96233, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960, CVE-2026-97788, CVE-2026-97801, CVE-2026-108398

The most recent 100 field changes are listed. Complete recorded revisions are kept separately.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.