The Update BureauKB5082414: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows 10 1809 and Windows Server 2019, April 2026. Critical runtime service-disruption flaw addressed; app checks improve
In short
Addresses six .NET Framework vulnerabilities, including one critical flaw that can cause a denial of service. It also adds support for two app verification methods.
Does it affect you? Applies to: Devices running Windows 10, version 1809, or Windows Server 2019 with .NET Framework 3.5 or 4.8 installed.
What changes
Improvements 6 changes
.NET Framework
6 items
-
A security flaw that could let an attacker run code remotely is addressed.1
CVE-2026-32178: .NET Framework Remote Code Execution vulnerability.
-
A security flaw that could make a service unavailable is addressed.2
CVE-2026-32203: .NET Framework Denial of Service vulnerability.
-
A security flaw that could make a service unavailable is addressed.3
CVE-2026-32226: .NET Framework Denial of Service vulnerability.
-
A critical security flaw that could make a service unavailable is addressed.4
CVE-2026-23666: .NET Framework Denial of Service vulnerability.
-
A security flaw that could let an attacker bypass a security feature is addressed.5
CVE-2026-26171: .NET Framework Security Feature Bypass vulnerability.
-
A security flaw that could expose information is addressed.6
CVE-2026-33116: .NET Framework Information Disclosure vulnerability.
Fix 1 change
.NET Runtime
-
App installation checks now support SHA-384 and SHA-512, two methods for checking that an app has not been changed. This applies to apps distributed through ClickOnce, a Windows app deployment method.7
Adds verification logic for ClickOnce to support SHA384 and SHA512.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5066137, KB5065755
- Replaced by
- KB5087066
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9068 | General availability |
| 4.8 | 4.8.4801.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Framework Denial of Service Vulnerability
|
Critical | 7.5 |
|
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 5.9 |
|
.NET Denial of Service Vulnerability
|
Not rated | — |
|
.NET Spoofing Vulnerability
|
Not rated | — |
|
.NET and Visual Studio Denial of Service Vulnerability
|
Not rated | — |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSC 2019 / Windows Server 2019
89.3 MB
x86
Windows 10 Enterprise LTSC 2019
49.9 MB
Updated components
34 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WCF | 14 |
| Windows Forms | 2 |
Sources
Updated
Cited passages from Microsoft's official notes (7)
-
1.
This security update addresses a remote code execution vulnerability detailed in CVE-2026-32178.
support.microsoft.com -
2.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32203.
support.microsoft.com -
3.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-32226.
support.microsoft.com -
4.
This security update addresses a denial-of-service vulnerability detailed in CVE-2026-23666.
support.microsoft.com -
5.
This security update addresses a security feature bypass vulnerability detailed in CVE-2026-26171.
support.microsoft.com -
6.
This security update addresses an information disclosure vulnerability detailed in CVE-2026-33116.
support.microsoft.com -
7.
Addresses an issue to add verification logic for ClickOnce to support SHA384 and SHA512
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake