Microsoft released .NET 11 Preview 7, moving NativeAOT to default in the CLI for major startup performance improvements and adding C# 15 features like union patterns and labeled loop control. Simultaneously, security servicing updates for .NET 8, 9, and 10 address ten CVEs, including two critical remote code execution vulnerabilities that demand immediate patching. Developers should prioritize migration from .NET 8 and 9, both of which reach end-of-support on November 10, 2026, just three months away. The preview concludes a dense release window with significant library additions, including IEEE 754 decimal types and ZIP password encryption, ahead of .NET 11's STS target date.

Microsoft Ships .NET 11 Preview 7, NativeAOT Goes Default, and August Security Patches Hit Three Versions

C# 15 preview lands with union types, three servicing releases patch ten CVEs including two critical RCEs.

Microsoft released a massive update batch on August 11, bringing .NET 11 Preview 7 to developers alongside security servicing releases for .NET 8, 9, and 10. If you're running production workloads, the security patches should move to the top of your queue immediately. .NET 11 Preview 7, however, is drawing attention for some bold defaults.

.NET 11 Preview 7 is now available!

Find out about the new features in .NET 11 Preview 7 across libraries, runtime, SDK, C#, ASP.NET Core, .NET MAUI, Entity Framework Core, F#, and Windows Forms.

.NET 11 Preview 7 is now available! - .NET Blog

SDK Defaults Shift, C# 15 Preview Arrives

The headline shift in the SDK is NativeAOT moving to the dotnet CLI by default. Startup performance jumps are substantial. Microsoft cites a 5.5× speedup for CLI tools, with dotnet tool list dropping from 378ms to just 68ms. MSBuild server is also enabled by default now, meaning the warm worker process persists between CLI invocations.

That's a significant change for how developers interact with the toolchain. If you're hitting regressions in custom scripts, you can opt out with DOTNET_CLI_ENABLEAOT=false.

On the language front, C# 15 preview arrives in this build. The big additions include union patterns that match both the union instance and its contained value, labeled break and continue statements for exiting outer loops, and exhaustiveness checking for closed type parameters in switch expressions.

Libraries get a heavy dose of new APIs. The most notable additions include IEEE 754 decimal floating-point types (Decimal32, Decimal64, Decimal128), generic Complex<T> support, and ZIP password encryption via AES-128/192/256. HTTP gets streaming compression wrappers for GZip, Brotli, and Zstandard.

Blazor Server gains auto-pause for circuits when browser tabs go inactive, a new CacheView component for SSR subtrees, and five new analyzers to catch common mistakes like redundant StateHasChanged calls.

August Security Patching Hits Ten CVEs

All three servicing releases address the identical set of ten vulnerabilities published today. The breakdown includes two critical remote code execution flaws, three high-severity elevation of privilege issues, and five medium-severity vulnerabilities covering information disclosure, security bypass, and denial of service.

The critical CVEs are CVE-2026-70354 and CVE-2026-62897. Both are listed as .NET Core and .NET RCE vulnerabilities respectively. Microsoft's MSRC database has the full details, but the lack of public exploit information means you should patch without waiting for vendor guidance.

Keep in mind that .NET 9 reaches end-of-support on November 10, 2026. That's roughly three months away. Teams on .NET 8 have the same deadline. This August update is a vital patch, but it should also be the nudge to plan migrations. The .NET 10 LTS line remains active until November 2028, and .NET 11 Preview 7 targets a Standard Term Support release on November 10, 2026.

Servicing Versions and Visual Studio Requirements

The servicing releases are straightforward. .NET 10.0.11, .NET 9.0.19, and .NET 8.0.30 all drop on August 11. They address the same ten CVEs.

For development, Visual Studio versions matter. .NET 11 Preview 7 recommends VS 2026 Insiders to handle the C# 15 features. .NET 10 and .NET 9 require VS 17.12 or later. .NET 8 needs VS 17.10 or later and supports C# 12.

What to Do Next

1. Patch immediately. The two critical RCE vulnerabilities apply to .NET 8, 9, and 10. Don't delay.
2. Test the NativeAOT CLI. The performance gains are hard to ignore, but run your full build pipeline locally before rolling out to production.
3. Plan the .NET 9 exit. With support ending in November, start evaluating .NET 10 LTS or .NET 11 STS now.
4. Check your analyzers. The new Blazor analyzers and C# 15 union patterns will catch issues you might have missed in previous versions.