KB5133966
Security update fixing 3 CVEs
3CVEs fixed · 0 critical
0Exploited or in CISA KEV
YesRestart required (per MSRC)
Windows release health lists no known issues from this update or the one it builds on, and none it resolves.
Security fixes
3 Microsoft CVEs · most urgent first| CVE | Vulnerability | Severity | CVSS | EPSS | Impact | Status |
|---|---|---|---|---|---|---|
| CVE-2026-102870 | ASP.NET Core Remote Code Execution VulnerabilityASP.NET Core | Important | 8.8 | 0.9% | RCENetwork | Revised 25 Oct |
| CVE-2026-70197 | .NET and Visual Studio Remote Code Execution Vulnerability.NET | Important | 8.1 | 0.8% | RCENetwork | Revised 25 Oct |
| CVE-2026-114148 | ASP.NET Core Elevation of Privilege VulnerabilityASP.NET Core | Important | — | — | EoP |
What changed
First observed 25 Oct 2026- 25 Oct 2026 · 19:05:13 UTC Applies to.NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, Microsoft Edge (Chromium-based), Microsoft.AspNetCore.Components.WebAssembly.Server → .NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, Microsoft.AspNetCore.Components.WebAssembly.DevServer, Microsoft.AspNetCore.Components.WebAssembly.Server, .NET source-build Linux tarballs (all archive types)
The most recent 100 field changes are listed. Complete recorded revisions are kept separately.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.