.NET April 2026 security Updates - .NET 10.0.6, .NET 9.0.15, .NET 8.0.26

[rbhanda]

.NET April 2026 Update

Release Notes

• 10.0.6
• 9.0.15
• 8.0.26

Status

Artifact	10.0.6	9.0.15	8.0.26
Installers/Binaries	✅	✅	✅
Container Images (Linux)	✅	✅	✅
Container Images (Windows)	✅	✅	✅
Winget Packages
Linux Installers (Microsoft distribution)
Debian 12	✅	✅	✅
OpenSUSE 15	✅	✅	✅
Rocky 9	✅	✅	✅
Ubuntu 20.04	✅	✅	✅
Ubuntu 22.04	✅	✅	✅

Issues

Please report any issues you find either by responding to this issue or by opening a new issue in one of the following repos:

• ASP.NET Core: dotnet/aspnetcore
• Entity Framework Core: dotnet/efcore
• .NET CLI/SDK: dotnet/sdk
• .NET runtime: dotnet/runtime
• WinForms: dotnet/winforms
• WPF: dotnet/wpf
• NuGet: nuget/home
• Containers: dotnet/dotnet-docker
• Winget: microsoft/winget-pkgs

[snakefoot]

Curious why no tag for .NET Runtime:

• https://github.com/dotnet/runtime/tree/v10.0.6
• https://github.com/dotnet/aspnetcore/releases/tag/v10.0.6

But can see these nuget-packages issues:

• Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability runtime#126892
• Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability runtime#126891
• Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability runtime#126889
• Microsoft Security Advisory CVE-2026-32178 – .NET Spoofing Vulnerability runtime#126890

And can see this:

• https://github.com/dotnet/core/releases/tag/v10.0.6 and this dotnet/dotnet@v10.0.5...v10.0.6