Microsoft · Security update · October 25, 2026

KB5133966: October 2026 security update

KB5133966, released October 25, 2026, fixes 4 CVEs across 6 products. One of them is being exploited (CVE-2026-111497); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV1 publicly disclosed
CVEs closed
4
None rated Critical
Exploited
1
CVE-2026-111497
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8264
99th percentile

Priority of the 4 CVEs

Patch now 1 Urgent 0 High 3 Routine 0

Applies to

Product
.NET 10.0 installed on Linux
.NET 10.0 installed on Mac OS
.NET 10.0 installed on Windows
.NET source-build Linux tarballs (all archive types)
Microsoft.AspNetCore.Components.WebAssembly.DevServer
Microsoft.AspNetCore.Components.WebAssembly.Server

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2026-111497 .NET 9.8 0.8264 KEVDisclosedExploited
High CVE-2026-102870 ASP.NET Core Remote Code Execution 8.8 0.0091 Exploitation Less Likely
High CVE-2026-70197 .NET Remote Code Execution 8.1 0.0079 Exploitation Less Likely
High CVE-2026-114148 ASP.NET Core Elevation of Privilege 7.8 0.0036 Exploitation Less Likely
Showing 1 to 4 of 4 1