The Update BureauKB5082411: Cumulative update for .NET Framework, version 4.8, on Windows 10 1607 and Windows Server 2016, April 2026. Critical runtime denial-of-service flaw addressed; ClickOnce checks updated
In short
ClickOnce checks now support SHA384 and SHA512. The update addresses six security flaws, including critical CVE-2026-23666, which can make a service unavailable.
Does it affect you? Applies to: Devices running Windows 10, version 1607, or Windows Server 2016, with .NET Framework 4.8 installed.
Review notes Additional details from the official release notes (1) Read note
- What changes The update also addresses CVE-2026-32178 (remote code execution), CVE-2026-32203 and CVE-2026-32226 (denial of service), CVE-2026-26171 (security feature bypass), and CVE-2026-33116 (information disclosure).
The official sources are linked at the end of the page.
What changes
Fix 1 change
.NET Runtime
-
ClickOnce checks now work with SHA384 and SHA512.1
Adds verification logic for ClickOnce to support SHA384 and SHA512.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5066136, KB5065749
- Replaced by
- KB5087065
| Version | File version | Channel |
|---|---|---|
| 4.8 | 4.8.4801.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Framework Denial of Service Vulnerability
|
Critical | 7.5 |
|
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 5.9 |
|
.NET Denial of Service Vulnerability
|
Not rated | — |
|
.NET Spoofing Vulnerability
|
Not rated | — |
|
.NET and Visual Studio Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSB 2016 / Windows Server 2016
58.0 MB
x86
Windows 10 Enterprise LTSB 2016
33.5 MB
Updated components
32 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WCF | 12 |
| Windows Forms | 2 |
Sources
Updated
Cited passages from Microsoft's official notes (1)
-
1.
Addresses an issue to add verification logic for ClickOnce to support SHA384 and SHA512
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake