.NET 9 STS, end of life on 10 November 2026
.NET 9 end of life: 10 November 2026
Microsoft ends support for .NET 9 on 10 November 2026, together with .NET 8. After that date, new vulnerabilities in the runtime, ASP.NET Core and the SDK get no official fix for .NET 9. Microsoft has fixed 65 vulnerabilities in .NET 9 so far, 52 of them in 2026.
- 65vulnerabilities fixed so far
- 52in 2026
- 4critical
- 1exploited in the wild
Exploited in the wild
.NET 9.0.21 still carries CVE-2026-111497.
CVE-2026-111497 (score 9.8) is listed in the CISA catalogue of known exploited vulnerabilities. The US National Vulnerability Database lists the fix in .NET 9.0.22. Once .NET 9 is past end of life, flaws like this one stay open unless someone backports the fix.
What you can do
Keep .NET 9, patched
We backport the security fixes to .NET 9: the runtime, ASP.NET Core and the SDK, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to .NET 10, supported until 14 November 2028, if your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 65 vulnerabilities Microsoft fixed in .NET 9
US National Vulnerability Database, 28 October 2026, highest score first: vulnerabilities in .NET and ASP.NET Core that affect .NET 9. Fixed in: the first .NET 9 release with the fix, where NVD records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2025-55315 | 9.9 | Critical | 2025-10-14 | 9.0.10 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
| CVE-2024-43498 | 9.8 | Critical | 2024-11-12 | n/a | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2026-111497 Exploited | 9.8 | Critical | 2026-10-22 | 9.0.22 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
| CVE-2026-88092 | 9.4 | Critical | 2026-10-13 | 9.0.21 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. |
| CVE-2025-21176 | 8.8 | High | 2025-01-14 | n/a | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2026-47300 | 8.8 | High | 2026-07-14 | 9.0.18 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-47303 | 8.8 | High | 2026-07-14 | 9.0.18 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69439 | 8.8 | High | 2026-09-08 | 9.0.20 | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-71328 | 8.8 | High | 2026-09-08 | 9.0.20 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-50528 | 8.2 | High | 2026-07-14 | 9.0.18 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-47304 | 8.1 | High | 2026-07-14 | 9.0.18 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2025-26646 | 8.0 | High | 2025-05-13 | 9.0.5 | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-45490 | 7.8 | High | 2026-06-09 | 9.0.17 | Improper authorization in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-50646 | 7.8 | High | 2026-07-14 | 9.0.18 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
| CVE-2026-50649 | 7.8 | High | 2026-07-14 | 9.0.18 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-50650 | 7.8 | High | 2026-07-14 | 9.0.18 | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-58641 | 7.8 | High | 2026-08-11 | 9.0.19 | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-62871 | 7.8 | High | 2026-08-11 | 9.0.19 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-62886 | 7.8 | High | 2026-08-11 | 9.0.19 | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-62909 | 7.8 | High | 2026-08-11 | 9.0.19 | Uncaught exception in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-70354 | 7.8 | High | 2026-08-11 | 9.0.19 | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2024-43499 | 7.5 | High | 2024-11-12 | n/a | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2025-21171 | 7.5 | High | 2025-01-14 | n/a | .NET Remote Code Execution Vulnerability |
| CVE-2025-21172 | 7.5 | High | 2025-01-14 | n/a | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-26682 | 7.5 | High | 2025-04-08 | 9.0.4 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2025-30399 | 7.5 | High | 2025-06-13 | 9.0.6 | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-21218 | 7.5 | High | 2026-02-10 | 9.0.13 | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-25667 | 7.5 | High | 2026-03-19 | 9.0.11 | ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing. |
| CVE-2026-26127 | 7.5 | High | 2026-03-10 | 9.0.14 | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-26130 | 7.5 | High | 2026-03-10 | 9.0.14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-26171 | 7.5 | High | 2026-04-14 | 9.0.15 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-32178 | 7.5 | High | 2026-04-14 | 9.0.15 | Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-32203 | 7.5 | High | 2026-04-14 | 9.0.15 | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network. |
| CVE-2026-33116 | 7.5 | High | 2026-04-14 | 9.0.15 | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
| CVE-2026-42899 | 7.5 | High | 2026-05-12 | 9.0.16 | Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-45591 | 7.5 | High | 2026-06-09 | 9.0.17 | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-47302 | 7.5 | High | 2026-07-14 | 9.0.18 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50524 | 7.5 | High | 2026-07-14 | 9.0.18 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50525 | 7.5 | High | 2026-07-14 | 9.0.18 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50527 | 7.5 | High | 2026-07-14 | 9.0.18 | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50648 | 7.5 | High | 2026-07-14 | 9.0.18 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50651 | 7.5 | High | 2026-07-14 | 9.0.18 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-56170 | 7.5 | High | 2026-07-14 | 9.0.18 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-57108 | 7.5 | High | 2026-07-14 | 9.0.18 | Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-62898 | 7.5 | High | 2026-08-11 | 9.0.19 | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-62901 | 7.5 | High | 2026-08-11 | 9.0.19 | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96958 | 7.5 | High | 2026-10-13 | 9.0.21 | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96959 | 7.5 | High | 2026-10-13 | 9.0.21 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96960 | 7.5 | High | 2026-10-13 | 9.0.21 | Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2025-21173 | 7.3 | High | 2025-01-14 | n/a | .NET Elevation of Privilege Vulnerability |
| CVE-2025-55247 | 7.3 | High | 2025-10-14 | 9.0.10 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-32177 | 7.3 | High | 2026-05-12 | 9.0.16 | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-35433 | 7.3 | High | 2026-05-12 | 9.0.16 | Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2025-24070 | 7.0 | High | 2025-03-11 | 9.0.3 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-50526 | 7.0 | High | 2026-07-14 | 9.0.18 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. |
| CVE-2026-62897 | 7.0 | High | 2026-08-11 | 9.0.19 | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally. |
| CVE-2026-69806 | 7.0 | High | 2026-09-08 | 9.0.20 | Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-50659 | 6.5 | Medium | 2026-07-14 | 9.0.18 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-62902 | 6.5 | Medium | 2026-08-11 | 9.0.19 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-45491 | 6.2 | Medium | 2026-06-09 | 9.0.17 | Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally. |
| CVE-2026-62899 | 5.9 | Medium | 2026-08-11 | 9.0.19 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-62900 | 5.9 | Medium | 2026-08-11 | 9.0.19 | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-69304 | 5.9 | Medium | 2026-09-08 | 9.0.17 | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2025-55248 | 4.8 | Medium | 2025-10-14 | 9.0.10 | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
| CVE-2026-32175 | 4.3 | Medium | 2026-05-12 | 9.0.16 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files. |