Back to Security Advisories

.NET 10.0 Security Update — AlmaLinux 8 (ALSA-2026:86192)

ALSA-2026:86192 updates .NET 10.0 on AlmaLinux 8, fixing CVE-2026-102870, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651 and the CVE-2026-701xx / CVE-2026-962xx series — aggregate CVSS 8.8 (code-execution class, CWE-94) across the runtime. Update the dotnet packages: dnf update dotnet* and restart .NET applications.

Critical 8.8 CVSS
AlmaLinux 8

Affected Versions

10.0

What this means under a SharedLicense license

A 8.8-CVSS batch in the .NET runtime touches the parsing and execution layers every ASP.NET application runs on — unpatched servers leave their .NET workloads exposed to the full set at once.

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything.  

SDK version: 10.0.113  
Runtime version: 10.0.13  

Security Fix(es):  

  * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870)
  * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822)
  * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651)
  * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175)
  * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183)
  * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186)
  * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188)
  * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196)
  * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092)
  * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707)
  * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225)
  * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230)
  * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231)
  * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233)
  * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236)
  * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237)
  * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238)
  * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957)


Bug Fix(es) and Enhancement(s):  

  * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:AlmaLinux-277805)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Frequently Asked Questions

What is ALSA-2026:86192?
It is AlmaLinux's .NET 10.0 security erratum for AlmaLinux 8, fixing CVE-2026-102870, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651 and the CVE-2026-701xx/962xx series — aggregate CVSS 8.8, code-execution class (CWE-94).
Who is affected?
AlmaLinux 8 servers with the .NET 10.0 packages installed — ASP.NET Core applications and .NET services built against the 10.0 runtime.
How do I apply the fix?
Run dnf update dotnet* and restart your .NET applications so they run the patched runtime; verify the package versions match the erratum.
Is this the same .NET wave as the Ubuntu notice?
Yes — same upstream .NET security release delivered by Ubuntu as USN-8958-1 and by AlmaLinux as this erratum. Apply per platform installed.

References

Security Advisories

Related Advisories

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System