Microsoft ships .NET 11 RC2 alongside one of its largest security batches ever
One October 13 release day delivered a production-ready preview of .NET 11 and about 40 CVE fixes per channel.
Microsoft ran a single coordinated release day, and it pulled in nearly the whole .NET ecosystem. On October 13, the company shipped .NET 11 Release Candidate 2 on top of three servicing patches: .NET 10.0.13, .NET 9.0.21, and .NET 8.0.32. That's a preview track and three stable channels, all hitting the same afternoon.
The clustering is deliberate. Microsoft paired a big security fix with a go-live-ready preview, and the timing quietly shoves companies toward the door. .NET 11 RC2 is the second and almost certainly the final candidate before .NET 11 goes stable, which the company expects in November 2026. Earlier previews were development-only, but this one carries a go-live support license. Microsoft's blog says teams can "confidently use this release for your production applications."
The preview isn't thin on features either. Runtime async V2 is in, with what Microsoft describes as cleaner stack traces and lower overhead, and projects targeting net11.0 no longer need to opt in with a flag. C# 15 stabilizes unions, there are new libraries for Zstandard compression and IEEE 754 decimal floating-point types, and ASP.NET Core's QuickGrid virtualization APIs are finally non-experimental. F# got a notably rich update with runtime async support and reraise inside computation expressions. Post-quantum crypto is creeping in too, with experimental ML-KEM and HPKE APIs that quietly signal Microsoft moving quantum-resistant cryptography toward production readiness.
That go-live license is more than marketing. It lets architects test .NET 11 in real workloads with actual support, which is rare for a preview. The parts shortages that have rattled the semiconductor industry have also thrown Microsoft's own roadmap for a loop, though. Earlier this year, memory and storage crunches forced companies like Valve to rethink pricing and shipping entirely, and Microsoft has quietly reshuffled some .NET timelines for similar reasons. That's a background risk, and it won't show up in a release note. Still, if you're already planning to upgrade, testing this now with a live license is the pragmatic move.
There's also the version-number puzzle to sort out. RC2 is a pre-release of an upcoming major version, while the .13, .21, and .32 suffixes are patch updates on already-released stable channels. Different animals. And the timing cuts both ways: .NET 8 (the one LTS track) runs out of support in November 2026, and .NET 9 closes out at the end of 2026. Three of the four channels are being patched here while two of them race toward end-of-life within weeks to months. It's a fairly blunt illustration of the cost of .NET's release cadence.
Announcing .NET 11 Release Candidate 2 - .NET Blog
.NET 11 Release Candidate 2 is available with improvements across libraries, runtime, SDK, MSBuild, NuGet, F#, ASP.NET Core, .NET MAUI, and Windows Forms.
A security batch most shops should notice
On the patch side, the numbers are what matter. Each channel fixed an unusually large pile of CVEs, and this is a stark jump from the month before. The October fixes brought roughly 44 new CVEs for .NET 10, 42 for .NET 9, and 40 for .NET 8. The prior month fixed only about 5 to 6 per channel. That's a leap, not a step.
Remote code execution dominates the list. These RCEs span core .NET, the SDK, and ASP.NET Core, which means several can be triggered remotely over the network in ordinary hosting setups. One flaw, the Microsoft QUIC RCE (CVE-2026-105016), shows up on all three channels and hits the transport used for high-performance HTTP/3-style connections.
There's also Elevation of Privilege flaws in ASP.NET Core and the SDK, a pile of Denial of Service issues (mostly ASP.NET Core), Security Feature Bypass bugs, and a couple of Information Disclosure findings. One Spoofing flaw is limited to .NET 8.
Microsoft doesn't always publish full technical detail before a patch ships. Some earlier entries in recent months were still marked TBD. The severity labels above come straight from the official MSRC CVE list. Head here for the itemized, per-CVE write-ups if you need the specifics.
What developers should actually do
Patch now. Any app on .NET 8, 9, or 10 should move to 8.0.32, 9.0.21, or 10.0.13 respectively. Given the size of this batch, and especially the RCEs plus the QUIC flaw, delaying is basically buying exposure.
Match your SDKs. These runtimes pair with 8.0.426, 9.0.319, and 10.0.402. Keep Visual Studio current as well, so that means 17.10, 17.12, or 18.11+ depending on the channel. And if you're on containers, pin to the new patch tags instead of floating latest, since fresh Docker and MCR images just shipped.
Then look at the calendar. .NET 8 and .NET 9 are both exiting support within months, so budget your engineering effort toward .NET 10. Still sitting on .NET 8? Treat migration as urgent, or at least make sure you're on 8.0.32 today. You can check your installed version with dotnet --version.
Release .NET 11.0 RC 2 · dotnet/core
Release
Release .NET 10.0.13 · dotnet/core
Release Notes Install Instructions Repos Aspnetcore dotnet dotnet EF Core Runtime SDK SDK Templating Templating Winforms WindowsDesktop WPF What's Changed https://devblogs.microsoft.com/dotnet/do...
Release .NET 9.0.21 · dotnet/core
Release Notes Install Instructions Repos Aspnetcore EF Core Runtime SDK SDK Templating Winforms WindowsDesktop WPF What's Changed https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework...
Release .NET 8.0.32 · dotnet/core
Release Notes Install Instructions Repos Aspnetcore EF Core Installer Installer Runtime SDK SDK Templating Templating Winforms WindowsDesktop WPF What's Changed https://devblogs.microsoft.com/dot...
