Microsoft released KB5087051, a cumulative update for .NET Framework 3.5 and 4.8.1 on Windows 11 Version 25H2, on May 12, 2026. The update targets both x64 and ARM64 systems and resolves four CVE-tracked security vulnerabilities in .NET Framework components alongside stability and performance fixes.
The update addresses remote code execution flaws in the Common Language Runtime, an ASP.NET Core authentication bypass, and a serialization denial-of-service issue — vulnerabilities that could allow attackers to run code, bypass authentication, or exhaust resources in affected .NET applications.
Key takeaways
- KB5087051 patches four CVEs: CVE-2026-0234, CVE-2026-0235, CVE-2026-0236, and CVE-2026-0237.
- It applies to Windows 11 Version 25H2 (Build 26100 or later) on x64 and ARM64 with .NET Framework 3.5 and/or 4.8.1.
- The update is classified as Important and requires a system restart.
- It also improves WCF service stability and Entity Framework 6.x query performance for large datasets.
- Some legacy .NET 2.0 apps may hit compatibility issues from stricter security validation; test before broad deployment.
Affected
What KB5087051 changes
KB5087051 is a cumulative security and reliability update for Microsoft .NET Framework 3.5 and 4.8.1. It targets Windows 11 Version 25H2 systems on both x64 and ARM64 and, per Microsoft's documentation, was released on May 12, 2026.
The update touches multiple .NET Framework components, including the Common Language Runtime (CLR), ASP.NET Core runtime and libraries, Windows Communication Foundation (WCF), Entity Framework 6.x, and serialization and cryptography libraries.
- CVE-2026-0234 and CVE-2026-0235: remote code execution flaws in the CLR tied to insufficient input validation in managed code execution paths.
- CVE-2026-0236: an ASP.NET Core authentication bypass affecting cookie-based authentication and custom middleware.
- CVE-2026-0237: a denial-of-service flaw in serialization components using BinaryFormatter or DataContractSerializer.
- Released May 12, 2026 for Windows 11 Version 25H2 (x64 and ARM64).
- Package size: approximately 48 MB (x64), 42 MB (ARM64).
Vulnerabilities and root cause
According to Microsoft's documentation, the flaws stem from insufficient input validation in .NET Framework runtime components, improper memory management in WCF services, and inadequate security checks in ASP.NET Core request processing.
The RCE fixes strengthen input validation for managed code execution and improve memory boundary checks; the ASP.NET Core fix hardens cookie validation and session management; the WCF fix improves buffer management in SOAP message parsing; and the serialization fix adds resource-consumption limits and validation of object graphs during deserialization.
Severity note
The CVE identifiers and component impact in this article reflect Microsoft's update documentation. Independent CVSS or EPSS scores were not available in the source material and are omitted rather than estimated.
Affected systems
The update applies to the following configurations:
- Windows 11 Version 25H2, x64, with .NET Framework 3.5 and/or 4.8.1.
- Windows 11 Version 25H2, ARM64, with .NET Framework 3.5 and/or 4.8.1.
- Prerequisite: Build 26100 or later, plus at least 500 MB free disk space.
Deployment and verification
The update is classified as Important and is delivered automatically through Windows Update unless excluded via Group Policy or update settings. Enterprises can also deploy through WSUS, Microsoft Configuration Manager (SCCM), Intune, or offline via the Microsoft Update Catalog. A restart is required.
After installation, administrators can confirm the update is present with PowerShell:
Get-HotFix -Id KB5087051Test before broad rollout
Microsoft recommends testing mission-critical .NET apps, custom WCF services, ASP.NET Core apps with custom authentication, and Entity Framework workloads before production deployment.
Known issues
- Some legacy .NET Framework 2.0 apps may break under stricter security validation; enabling NetFx40_LegacySecurityPolicy is offered as a temporary measure.
- WCF services with complex bindings may see 2–5 seconds of additional startup time; runtime performance is unaffected.
- Entity Framework apps may see different SQL query plans due to optimizer changes; monitor for regressions.
- Installation error 0x80070643 can occur if the Windows Installer service is not running or files are pending; restarting the service and retrying is advised.
Timeline
Impact & actions
KB5087051 closes four CVE-tracked vulnerabilities in .NET Framework components on Windows 11 25H2 while introducing minor compatibility and performance behavior changes.
Security: Addresses remote code execution (CVE-2026-0234, CVE-2026-0235), an ASP.NET Core authentication bypass (CVE-2026-0236), and a serialization denial-of-service flaw (CVE-2026-0237).
Recommended actions · High urgency
- 1Test the update against mission-critical, WCF, ASP.NET Core, and Entity Framework applications.
- 2Deploy KB5087051 through your standard update channel and restart affected systems.
- 3Verify installation with Get-HotFix -Id KB5087051.
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235, CVE-2026-0236, CVE-2026-0237
- Affected versions
- .NET Framework 3.5, .NET Framework 4.8.1
Mitigations
- Install KB5087051 and restart affected systems.
Response
Customer guidance
Microsoft advises installing the update through standard channels and testing critical .NET, WCF, ASP.NET Core, and Entity Framework applications before production deployment. Removing the update may leave systems exposed to the addressed vulnerabilities.
FAQ
What does KB5087051 resolve?
It patches four .NET Framework vulnerabilities on Windows 11 25H2: remote code execution (CVE-2026-0234, CVE-2026-0235), an ASP.NET Core authentication bypass (CVE-2026-0236), and a serialization denial-of-service flaw (CVE-2026-0237). It also improves WCF stability and Entity Framework 6.x performance.
Which systems need KB5087051?
Windows 11 Version 25H2 systems on x64 and ARM64 with Microsoft .NET Framework 3.5 and/or 4.8.1 installed.
Is a restart required?
Yes. The update is classified as Important and requires a system restart to complete installation.
How do I confirm KB5087051 is installed?
Run Get-HotFix -Id KB5087051 in PowerShell; it returns patch details if the update is present.
The bottom line
KB5087051 is an Important .NET Framework 3.5 and 4.8.1 cumulative update for Windows 11 Version 25H2 that patches four CVEs and improves WCF and Entity Framework behavior.
What happens next
What to do
