.NET 8 and .NET 9 Get One of Their Last Patches: What to Update Today and How to Plan the Move to .NET 10

This Tuesday, October 13, 2026, Microsoft shipped the October .NET updates: .NET 10.0.13, 9.0.21 and 8.0.32. They bring two pieces of news for C# developers: it is an unusually large security batch and, for .NET 8 and .NET 9, it is one of the last they will get. Both versions reach end of support on November 10, 2026, 28 days from now.

What the October Patch Fixes

According to the official release notes for each version, .NET 10.0.13 fixes 44 vulnerabilities (CVEs), .NET 9.0.21 fixes 40 and .NET 8.0.32 fixes 39. Three deserve special attention:

• CVE-2026-105016 (Microsoft QUIC): critical, with a CVSS score of 9.8. According to the security advisory, a crafted QUIC packet arriving over IPv6 at the HTTP/3 path can execute code without authentication or user interaction. It affects .NET 8, 9, 10 and 11 RC2 on Windows.
• CVE-2026-108398 (.NET Framework): lets an attacker bypass Windows Defender Application Control (WDAC) by planting a crafted assembly. It has a CVSS score of 8.8 and was already public before the patch, according to Zero Day Initiative and BleepingComputer. It is fixed by the October .NET Framework update delivered through Windows Update.
• CVE-2026-92707 (MessagePack-CSharp): a moderate-severity denial of service, also publicly known before the patch. If you use MessagePack, check its NuGet version too.

What Happens on November 10

Microsoft's announcement is direct: after that date there will be no servicing updates, security fixes or technical support for .NET 8 or .NET 9. Applications will keep running, but new flaws will stay open. That day, a Patch Tuesday, a final update will ship only if there is a known critical issue.

They end together because .NET 8 is LTS (three years of support) and .NET 9 is STS, whose support Microsoft extended from 18 to 24 months. The version to target is .NET 10, an LTS release supported until November 2028 according to the official policy. The same Tuesday brought .NET 11 RC2, with a go-live license for production; the final release is expected in November.

What to Do This Week

1. Take inventory. On every server and build machine run dotnet --list-runtimes and dotnet --list-sdks. Include containers and CI pipelines.
2. Apply the patch. Install 10.0.13, 9.0.21 or 8.0.32 as appropriate and rebuild your images. Framework-dependent apps pick up the latest installed patch automatically; self-contained apps must be republished.
3. Prioritize what is exposed. Services on Windows with HTTP/3 enabled come first because of the QUIC flaw.
4. Check dependencies. dotnet list package --vulnerable --include-transitive lists NuGet packages with known vulnerabilities.
5. Make the build warn you. With the MSBuild property CheckSdkVulnerabilities set to true, the build emits warning NETSDK1239 when the SDK is out of support, according to the .NET documentation.
6. Plan the move to .NET 10. On a separate branch, change TargetFramework to net10.0, update packages and run your tests. Microsoft has deprecated the .NET Upgrade Assistant and recommends its GitHub Copilot upgrade agent, which assesses the project, builds a plan and makes one commit per change. Review every change before accepting it.

How We Approach It at SimCodec

At SimCodec we build and maintain custom software for companies in Quito and across Ecuador. On .NET projects we inventory versions and dependencies, apply security patches and migrate to .NET 10 in stages, with tests and a rollback plan.

If you have applications on .NET 8 or .NET 9 and want to know how much work the migration involves, write to us or call our AI assistant Cyntia at +593 99 726 6838.