The Update BureauKB5101008: Cumulative update for .NET Framework, versions 3.5 and 4.8, on Windows 10 1809 and Windows Server 2019, July 2026. Remote code execution flaw addressed; secure requests improved
In short
The update addresses 17 Important .NET Framework vulnerabilities, including a remote code execution flaw, and addresses hangs in some synchronous web requests.
Does it affect you? Applies to: Devices running Windows 10, version 1809, or Windows Server 2019 with .NET Framework 3.5 or 4.8 installed.
What changes
Fix 1 change
.NET Libraries
-
The update addresses hangs in synchronous web requests during certain secure connections with specific server configurations.1
Addresses an issue with synchronous
HttpWebRequestconnections where requests could hang in specific secure connection scenarios with certain server configurations.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-07-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5087066, KB5082414
- Replaced by
- KB5120703
| Version | File version | Channel |
|---|---|---|
| 3.5 | 2.0.50727.9069 | General availability |
| 4.8 | 4.8.4803.0 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
.NET Security Feature Bypass Vulnerability
|
Important | 8.1 |
|
.NET Framework Remote Code Execution Vulnerability
|
Important | 7.8 |
|
.NET Remote Code Execution Vulnerability
|
Important | 7.8 |
|
.NET Framework Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
.NET Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows Active Directory Federation Services Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows Active Directory Federation Services Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows Active Directory Federation Services Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows Active Directory Federation Services Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 7.5 |
|
Active Directory Federation Server Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Framework Denial of Service Vulnerability
|
Important | 7.5 |
|
Azure Active Directory Denial of Service Vulnerability
|
Important | 7.5 |
|
Azure Active Directory Denial of Service Vulnerability
|
Important | 7.5 |
|
.NET Spoofing Vulnerability
|
Important | 6.5 |
|
Windows Active Directory Federation Services Denial of Service Vulnerability
|
Important | 5.9 |
Downloads (Microsoft Update Catalog)
x64
Windows 10 Enterprise LTSC 2019 / Windows Server 2019
91.6 MB
x86
Windows 10 Enterprise LTSC 2019
52.1 MB
Updated components
80 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| WPF | 28 |
| WCF | 14 |
| .NET networking | 6 |
| .NET data access | 2 |
Sources
Updated
Cited passages from Microsoft's official notes (1)
-
1.
Addresses an issue with synchronous HttpWebRequest connections where requests could hang in specific secure connection scenarios with certain server configurations.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake