KB5104033: .NET 9.0.18 July 2026 Security Update — 17 CVEs Fixed Across Windows, Linux, and macOS

When Microsoft releases its monthly Patch Tuesday, most attention goes to the main Windows cumulative updates. Behind those headline releases, however, a parallel set of .NET runtime updates ships simultaneously — and July 2026 brought three of them at once.

There are three new updates this month: 2026-07 .NET 8.0.29 Security Update for x64 Client (KB5104032), 2026-07 .NET Framework Security Update (KB5100998), and 2026-07 .NET 9.0.18 Security Update for x64 Client (KB5104033).

KB5104033 is the .NET 9.0 update in that trio. Released July 14, 2026, it advances .NET 9.0 to version 9.0.18 and fixes 17 security vulnerabilities across the runtime. Unlike its companion KB5104032 — which covers .NET 8.0 on Windows only — KB5104033 is genuinely cross-platform, applying to Windows, Linux, and macOS installations of .NET 9.0.

This guide explains exactly what KB5104033 is, how it differs from the other July 2026 .NET updates, what the 17 CVEs it patches mean in practice, and how to install or verify it on every platform.

What Is KB5104033?

KB5104033 is a .NET 9.0 Update released on July 14, 2026, delivering security fixes and maintenance improvements for the .NET 9.0 runtime. This servicing update applies to Windows client and server operating systems that have .NET 9.0 installed.

Its full name in Windows Update is: “2026-07 .NET 9.0.18 Security Update for x64 Client (KB5104033)”. An ARM64 variant is also available: “2026-07 .NET 9.0.18 Security Update for ARM64 Client (KB5104033).”

The update follows Microsoft’s standard servicing model where newer versions automatically replace previous 9.0 releases upon installation. Specifically: .NET 9.0 servicing updates are upgrades. The latest servicing update for 9.0 will remove the previous 9.0 update upon successful installation. For example, when .NET 9.0.18 is installed, .NET 9.0.17 version will be removed from the computer if it is present.

KB5104033 is only offered to systems that already have .NET 9.0 installed. If .NET 9.0 is not on your PC or server, this update will not appear in Windows Update and does not need to be installed.

Three .NET Updates in One Patch Tuesday — How They Differ

July 2026 shipped three .NET-related updates on the same day. Understanding what each covers prevents confusion about which updates apply to your systems.

Update	.NET Component	CVEs Fixed	Platforms
KB5100998	.NET Framework 3.5 and 4.8.1	9	Windows only
KB5104032	.NET 8.0.29 (LTS)	16	Windows
KB5104033	.NET 9.0.18 (STS)	17	Windows, Linux, macOS

KB5100998 covers the classic .NET Framework — the Windows-bundled runtime that has been part of Windows since the early 2000s. Every Windows system has this. It is not a separately installed component.

KB5104032 covers .NET 8.0 — a Long-Term Support (LTS) release of the modern cross-platform .NET runtime, separately installed on systems that run .NET 8.0 applications.

KB5104033 covers .NET 9.0 — a Standard-Term Support (STS) release of the modern .NET runtime, separately installed on systems that run .NET 9.0 applications.

A system can have all three components simultaneously — .NET Framework built into Windows, plus .NET 8.0 and .NET 9.0 side-by-side as separately installed runtimes. In that scenario, all three July 2026 updates would be offered through Windows Update.

The Cross-Platform Distinction — Windows, Linux, and macOS

KB5104033 is a Security Update for .NET 9.0 across Linux, Mac OS, and Windows installs, which makes it relevant to cross-platform application servers and build agents rather than just Windows desktops.

This is the key difference between KB5104033 and most Windows Update entries. The KB number appears in Windows Update for Windows systems, but the same underlying .NET 9.0.18 package fixes identical vulnerabilities on Linux distributions and macOS installations of .NET 9.0.

For organizations running .NET 9.0 workloads across mixed infrastructure — Windows application servers alongside Linux containers, build agents, or macOS developer machines — KB5104033 represents security patches that need to be applied across all platforms, not just the Windows nodes.

Inventory your Linux, Mac, and Windows hosts running .NET 9.0 runtimes or SDKs and stage KB5104033 for deployment.

On Linux and macOS, .NET 9.0.18 is applied through the relevant package manager rather than Windows Update — but the security content is identical to what KB5104033 delivers on Windows.

What KB5104033 Fixes — 17 CVEs

KB5104033 patches 17 CVEs with a maximum CVSS score of 8.8.

CVSS 8.8 falls in the High severity range on the 0-10 scale. High severity vulnerabilities are serious but typically require some form of authentication, user interaction, or specific conditions to exploit — unlike Critical (9.0+) vulnerabilities that can often be triggered remotely with no user involvement.

No exploitation is confirmed for the CVEs in this update and the EPSS exploitation probability is currently 1.1%. There are no named zero-days in KB5104033 — unlike KB5104032 which shared some zero-day CVEs with other July 2026 updates.

Microsoft has not yet published the per-update CVE detail for this specific update, so the specific fixes remain provisional from the MSRC release document. The full CVE list is available on the Microsoft Security Response Center (MSRC) website. The July 2026 .NET blog post confirms the CVEs fixed across the July servicing release: Welcome to our combined .NET servicing updates for July 2026. This update contains security and non-security fixes. This month you will find that these CVEs have been fixed.

The security vulnerabilities addressed span the .NET 9.0 runtime components — areas that process external input, handle network communication, parse data structures, and manage cryptographic operations are the typical surface areas for .NET runtime CVEs. The 1.1% EPSS probability means current threat intelligence does not indicate active exploitation, though this can change as CVEs age.

.NET 9.0 Lifecycle — Standard-Term Support Context

Unlike KB5104032 covering .NET 8.0 — which is a Long-Term Support release with three years of support — .NET 9.0 is a Standard-Term Support release.

Under Microsoft’s .NET support policy, STS releases receive 18 months of support from their general availability date. .NET 9.0 reached general availability in November 2024.

This page on .NET Core and .NET 9 Support Policy provides the most up-to-date details on .NET Core Support Lifecycle Policy.

Organizations running .NET 9.0 should verify the current support status on Microsoft’s .NET release schedule page — support timelines can be adjusted, and understanding whether .NET 9.0 is still within its supported window directly affects patching decisions and migration planning.

What this means for organizations:

If .NET 9.0 is approaching or has passed its STS support end date, the practical path is migrating to .NET 10.0 — the next LTS release — rather than continuing to run on an unsupported runtime version. KB5104033 represents the July 2026 security patching for .NET 9.0, but IT teams should have a migration timeline to a supported runtime version on their roadmap.

For organizations that cannot immediately migrate from .NET 9.0, installing KB5104033 ensures the most current security fixes are applied for as long as the runtime remains in use.

Checking If .NET 9.0 Is Installed

Before worrying about KB5104033, verify whether .NET 9.0 is present on your system.

Windows — Command Prompt or PowerShell:

dotnet --list-runtimes

Look for any entry beginning with “Microsoft.NETCore.App 9.0” in the output. If present, .NET 9.0 is installed and KB5104033 applies.

dotnet --version

This shows the currently active SDK version. A version beginning with 9.x indicates .NET 9.0 is present.

Windows — Settings:

Go to Settings, Apps, Installed apps. Search for “.NET” in the search box. Any installed .NET 9.x runtime appears in the list.

Linux:

bash

dotnet --list-runtimes | grep "9.0"

macOS:

bash

dotnet --list-runtimes | grep "9.0"

Windows Update History:

If KB5104033 appears in your Windows Update History with a Successfully installed status, .NET 9.0 was on your system and the update applied correctly.

How to Install KB5104033

Method 1 — Windows Update (Recommended)

This update is available on Microsoft Update for Windows client operating systems and available on WSUS and MU Catalog for Windows Server operating systems. This update will be offered if you have .NET 9.0 installed on a supported version of Windows.

Go to Settings, Windows Update, Check for updates. If .NET 9.0 is installed, KB5104033 appears alongside other July 2026 updates. Click Download and install.

Method 2 — Microsoft Update Catalog (Windows Manual)

Go to catalog.update.microsoft.com. Search for KB5104033. Download the x64 or ARM64 package matching your architecture. Run the downloaded file.

If you encounter error 0x80244022 when connecting to Windows Update or the catalog, our complete error fix guide covers every resolution path.

Method 3 — Package Manager (Linux)

On Ubuntu or Debian-based distributions:

bash

sudo apt-get update
sudo apt-get upgrade dotnet-runtime-9.0

On Red Hat, Fedora, or CentOS-based distributions:

bash

sudo dnf update dotnet-runtime-9.0

Method 4 — Package Manager (macOS)

bash

brew upgrade dotnet@9

Or download directly from the .NET download page at dotnet.microsoft.com.

Method 5 — Enterprise Deployment (WSUS/Intune)

For WSUS environments, synchronize July 2026 content and approve KB5104033 for your .NET 9.0 product targeting. For Intune, the update is available in the standard update ring for Windows devices with .NET 9.0 installed. For cross-platform environments, coordinate patching across Windows WSUS, Linux package repositories, and macOS deployment tools simultaneously.

Restart Requirement

You may need to restart the computer after you apply this update if any affected files are being used. We recommend that you exit all .NET based applications before you apply this update.

The restart requirement is conditional. If no .NET 9.0 application is running when KB5104033 installs, the runtime files can be replaced immediately — no restart needed. If .NET-based applications are running, Windows cannot replace the runtime files in use. The update installs pending files and schedules the replacement for the next restart.

Best practice for servers:

Before patching Windows Server instances running .NET 9.0 applications — web servers, API servers, background service hosts — schedule a maintenance window, gracefully stop .NET services, install KB5104033, then restart. This minimizes downtime and avoids unplanned restarts triggered by pending file replacement.

Verifying KB5104033 Installed Successfully

Windows — dotnet command:

dotnet --list-runtimes

After successful KB5104033 installation, entries beginning with “Microsoft.NETCore.App 9.0” should show version 9.0.18.

Windows — PowerShell:

powershell

Get-AppxPackage *dotnet* | Select Name, Version

Or check Windows Update History for KB5104033 with a Successfully installed status dated July 14, 2026.

Linux:

bash

dotnet --list-runtimes | grep "9.0"

Version 9.0.18 appearing in the output confirms successful installation.

KB5104033 in the July 2026 Update Stack

On July 14, 2026, a Windows system with both .NET Framework and .NET 9.0 installed — and running Windows 11 25H2 or 24H2 — would have received all of these updates simultaneously:

KB5101650 — Main Windows 11 cumulative update. 570 vulnerabilities. Point-in-Time Restore. Bluetooth improvements.

KB5100998 — .NET Framework 3.5 and 4.8.1 security update. 9 CVEs.

KB5104032 — .NET 8.0.29 security update. 16 CVEs. Windows only.

KB5104033 — .NET 9.0.18 security update. 17 CVEs. Cross-platform.

KB890830 — Windows Malicious Software Removal Tool v5.143. Monthly MSRT update.

For Windows Server 2022 systems running .NET 9.0, the same KB5104033 applies alongside KB5099540. For Windows 10 22H2 ESU systems, KB5104033 applies alongside KB5099539. The runtime update is independent of the OS update — it applies to any supported Windows version where .NET 9.0 is installed.

No Known Issues

The absence of reported issues in community forums and support channels suggests a stable release. As a security-focused servicing update, it follows Microsoft’s established deployment patterns and is generally considered part of routine maintenance for .NET 9.0 environments.

KB5104033 launched with no documented known issues. The update is well-received in community discussions and patch management tooling does not flag any widespread failure reports. This is consistent with typical .NET runtime servicing updates — they carry lower complexity than OS-level cumulative updates and rarely introduce regressions.

Frequently Asked Questions