KB5127693: Cumulative update for .NET Framework, versions 3.5 and 4.8.1, on Windows Server 2022, October 2026. Spoofing flaw fixed alongside a security bypass

The update fixes 21 flaws: 1 Critical, 18 Important, and 2 Unrated. They include spoofing flaw CVE-2026-96222 and publicly disclosed CVE-2026-108398, a security feature bypass.

Does it affect you? Applies to: Windows Server 2022 devices with .NET Framework 3.5 or 4.8.1 installed.

Review notes Additional details from the official release notes (1) Read note

What changes Microsoft’s security data also records Important vulnerabilities CVE-2026-102869 and CVE-2026-62886 for this update.

The official sources are linked at the end of the page.

What changes

Fixes 19 changes

.NET Framework

19 items

Fixes a flaw that could make a service stop responding.¹
CVE-2026-58280 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could let a user gain more access.²
CVE-2026-69439 is a .NET Framework Elevation of Privilege vulnerability.
Fixes a flaw that could make a service stop responding.³
CVE-2026-69651 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could let an attacker run code.⁴
CVE-2026-70007 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could let an attacker run code.⁵
CVE-2026-70035 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could let an attacker run code.⁶
CVE-2026-70174 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could let an attacker run code.⁷
CVE-2026-83520 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could make a service stop responding.⁸
CVE-2026-84008 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could let a user gain more access.⁹
CVE-2026-85363 is a .NET Framework Elevation of Privilege vulnerability.
Fixes a flaw that could let an attacker run code.¹⁰
CVE-2026-87697 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could let a fake identity appear genuine.¹¹
CVE-2026-96222 is a .NET Framework Spoofing vulnerability.
Fixes a flaw that could let an attacker run code.¹²
CVE-2026-96224 is a .NET Framework Remote Code Execution vulnerability.
Fixes a flaw that could make a service stop responding.¹³
CVE-2026-96233 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could make a service stop responding.¹⁴
CVE-2026-96958 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could make a service stop responding.¹⁵
CVE-2026-96959 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could make a service stop responding.¹⁶
CVE-2026-96960 is a .NET Framework Denial of Service vulnerability.
Fixes a flaw that could expose information.¹⁷
CVE-2026-97788 is a .NET Framework Information Disclosure vulnerability.
Fixes a flaw that could let someone change data.¹⁸
CVE-2026-97801 is a .NET Framework Tampering vulnerability.
Fixes a flaw that could bypass a security check.¹⁹
CVE-2026-108398 is a .NET Framework Security Feature Bypass vulnerability.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-10-13
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5126422, KB5120714

Version	File version	Channel
3.5	2.0.50727.9188	General availability
4.8.1	4.8.9363.0	General availability

Security

21 vulnerabilities fixed

1 critical 18 important 2 not rated

Vulnerability	Severity	CVSS
CVE-2026-96222 Active Directory Federation Services (AD FS) Spoofing Vulnerability	Critical	7.4
CVE-2026-102869 .NET and Visual Studio Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability	Important	8.8
CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability	Important	8.8
CVE-2026-70035 .NET Framework Remote Code Execution Vulnerability	Important	8.8
CVE-2026-70174 .NET Remote Code Execution Vulnerability	Important	8.8
CVE-2026-83520 .NET Remote Code Execution Vulnerability	Important	8.8
CVE-2026-85363 .NET Framework Elevation of Privilege Vulnerability	Important	8.8
CVE-2026-96224 .NET Remote Code Execution Vulnerability	Important	8.8
CVE-2026-62886 .NET Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-58280 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-69651 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-84008 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-96233 ASP.NET Core Denial of Service Vulnerability	Important	7.5
CVE-2026-96958 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-96959 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-96960 .NET Denial of Service Vulnerability	Important	7.5
CVE-2026-97788 Active Directory Federation Services (AD FS) Information Disclosure Vulnerability	Important	7.5
CVE-2026-97801 .NET Framework Tampering Vulnerability	Important	7.5
CVE-2026-69439 .NET and Visual Studio Elevation of Privilege Vulnerability	Not rated	—
CVE-2026-87697 .NET Remote Code Execution Vulnerability	Not rated	—

Downloads (Microsoft Update Catalog)

x64 Windows Server 2022

92.1 MB

windows10.0-kb5127693-x64-ndp481.msu Main update · KB5127693 SHA-1: 4e849676…d88637

Updated components

877 files changed since the previous update for the same versions.

Top changed components	Files
ASP.NET	54
WPF	54
WCF	44
.NET networking	28
.NET data access	22
.NET runtime (CLR)	22
Windows Forms	8

Sources

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (19)

1. CVE-2026-58280 - .NET Framework Denial of Service vulnerability support.microsoft.com
2. CVE-2026-69439 - .NET Framework Elevation of Privilege vulnerability support.microsoft.com
3. CVE-2026-69651 - .NET Framework Denial of Service vulnerability support.microsoft.com
4. CVE-2026-70007 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
5. CVE-2026-70035 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
6. CVE-2026-70174 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
7. CVE-2026-83520 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
8. CVE-2026-84008 - .NET Framework Denial of Service vulnerability support.microsoft.com
9. CVE-2026-85363 - .NET Framework Elevation of Privilege vulnerability support.microsoft.com
10. CVE-2026-87697 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
11. CVE-2026-96222 - .NET Framework Spoofing vulnerability support.microsoft.com
12. CVE-2026-96224 - .NET Framework Remote Code Execution vulnerability support.microsoft.com
13. CVE-2026-96233 - .NET Framework Denial of Service vulnerability support.microsoft.com
14. CVE-2026-96958 - .NET Framework Denial of Service vulnerability support.microsoft.com
15. CVE-2026-96959 - .NET Framework Denial of Service vulnerability support.microsoft.com
16. CVE-2026-96960 - .NET Framework Denial of Service vulnerability support.microsoft.com
17. CVE-2026-97788 - .NET Framework Information Disclosure vulnerability support.microsoft.com
18. CVE-2026-97801 - .NET Framework Tampering vulnerability support.microsoft.com
19. CVE-2026-108398 - .NET Framework Security Feature Bypass vulnerability support.microsoft.com

Checked automatically: 7 of 8 checks passed, 19 quoted passages · compared with Microsoft's page on Nov 14, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake