Microsoft released .NET 10.0.12, 9.0.20 and 8.0.31, addressing eight CVEs across the supported runtimes; one also affects .NET Framework 4.6.2–4.8.1. Updated installers, Linux packages and container images are available.
What changed
September’s servicing release contains both security and non-security fixes.
Why it matters
Applications embedded in containers do not automatically inherit a patched host runtime.
Practical takeaway
Rebuild and redeploy every .NET image from the latest digest, then record the runtime version and base-image digest in the deployment SBOM.
Published
8 September 2026
