What HeroDevs Joining the .NET Security Group Means for Your App

HeroDevs is a member of the .NET Security Group, the program Microsoft describes as "a group of organizations that will collaborate on delivering security fixes to the broadest set of .NET users, simultaneously with Microsoft." 

Other members include Microsoft, Red Hat, Canonical, and IBM. For an application running on Never-Ending Support (NES) for .NET, HeroDevs’ membership in the group comes down to timing: when Microsoft publishes .NET security fixes on Patch Tuesday, the fixes for .NET 6, .NET 8, and .NET 9 can ship that same day. 

That is what happened this past Patch Tuesday, October 13, 2026.

What is the .NET Security Group?

The .NET Security group is a coordinated disclosure program for organizations that distribute .NET.

Microsoft runs the .NET project and follows its own security reporting and disclosure practices. Fixes and disclosures are published most months on Patch Tuesday. What the group adds is early access for trusted distributors. Microsoft has shared vulnerability information with a small set of companies since 2016, starting with Red Hat. Members "receive source patches prior to public disclosure so that binary packages can be built, validated, and published at the same time as Microsoft." The group was private and invitation only, and grew to include Canonical, IBM, Red Hat, and Microsoft.

On October 14, 2025, Jamshed Damkewala announced that Microsoft was expanding and publicizing the program. The stated goal is to "reduce the time between public disclosure of CVEs and when updates are available for distributions other than Microsoft's." Microsoft also noted that organizations had asked for access to patches for their End-of-Life servicing businesses, which is part of why the group was opened up.

Joining is not a form and a handshake. Applicants are vetted for business authenticity and security risk, checked against trade sanctions and watch lists, sign a program agreement and an NDA, and are re-vetted every year.

Who else is in the .NET security group?

Microsoft, Red Hat, Canonical, and IBM. These are the organizations that build .NET from source and ship it to their own users. Red Hat and Canonical ship .NET in Red Hat Enterprise Linux and Ubuntu. Microsoft ships the distribution most people download. HeroDevs ships NES for .NET, a drop-in distribution of .NET 6, .NET 8, and .NET 9 for organizations that need those versions to stay secure after Microsoft's end of support.

HeroDevs announced its membership on January 5, 2026. HeroDevs is also a member of the .NET Foundation.

What does .NET security group membership change for my app?

How long a known vulnerability sits unpatched in production. Without the .NET security group, a third-party vendor learns about a .NET CVE at the same moment as everyone else: when it is publicly disclosed on Patch Tuesday. Only then does the work start. Investigating whether an end-of-life version is affected, backporting the fix, building, and testing takes days at best. For that whole window the CVE is public, the fix exists for supported versions, and the application on the end-of-life version is still exposed.

With the group, members receive information about CVEs in supported versions of .NET about a week before public disclosure each month. HeroDevs uses that week to determine whether .NET 6, .NET 8, or .NET 9 is affected, backport and build the fix, and run it through our test suite. To be precise about it: Microsoft shares information about supported versions. The work to bring those fixes to end-of-life versions is ours.

Then we wait. Coordinated disclosure only works if every member holds the embargo, so nothing ships before Microsoft publishes. The goal is that the gap between disclosure and a patched build for .NET 6, 8, or 9 is measured in hours, not weeks.

What happened on the October 2026 Patch Tuesday?

On October 13, 2026, Microsoft released .NET 10.0.13, .NET 9.0.21, and .NET 8.0.32. The same day, HeroDevs released NES for .NET 6.0.47.

6.0.47 addresses 37 CVEs, plus two GitHub security advisories and one unnumbered issue, across the runtime, ASP.NET Core, WPF, the .NET SDK, and the System.Security.Cryptography.Xml and Pkcs packages. 

A handful of the higher-impact ones:

• CVE-2026-88092: HTTP/1.1 request smuggling in Kestrel.
• CVE-2026-70183: authorization bypass in Blazor AuthorizeView, where stale authorization results could overwrite newer ones.
• CVE-2026-70035, CVE-2026-70174, CVE-2026-83520, and CVE-2026-87697: remote code execution in WPF through navigation in restricted XAML and XPS content.
• CVE-2026-96237: remote code execution in the .NET SDK, where workload downloads ignored NuGet Package Source Mapping.
• CVE-2026-96225 and CVE-2026-96231: privilege escalation on Linux and macOS through named-mutex shared memory.

.NET 6 reached end of support on November 12, 2024. Every one of those fixes landed on a runtime Microsoft stopped servicing nearly two years ago.

How does NES for .NET compare to other post-EOL .NET vendors?

By published VEX data, NES for .NET has patched nearly twice as many .NET 6 CVEs as the next most popular third-party post-EOL vendor. As of August 24, 2026, HeroDevs had documented 50 unique .NET 6 CVEs as fixed in NES for .NET, every one of them disclosed after Microsoft's end of support. That count predates the September and October releases. VEX (Vulnerability Exploitability eXchange) is a machine-readable statement of which CVEs a build fixes or is not affected by. I think it is the right way to evaluate any post-EOL vendor, including us. Ask for the VEX, and count.

What should NES for .NET customers do on Patch Tuesday?

‍

The same thing you would do on a supported version of .NET.

• Watch the NES for .NET release notes on Patch Tuesday.
• Update to the new NES build, rebuild, and run your tests.
• Redeploy on the same schedule you would use for a Microsoft Patch Tuesday release. If you run containers, pull the updated NES for .NET Containers images.

‍

.NET 8 and .NET 9 reach end of support on November 10, 2026. The first Patch Tuesday after that is December 8, 2026, and that is the first month NES for .NET 8 and NES for .NET 9 customers get fixes that Microsoft no longer ships for those versions.

Patch Tuesday fixes for .NET 6, 8, and 9

If your applications cannot move to .NET 10 yet, NES for .NET keeps them patched on the same cadence as supported .NET. Talk to our team about coverage.

Frequently asked questions

Is .NET 6 still getting security patches?

Not from Microsoft, which ended support on November 12, 2024. NES for .NET 6 ships fixes on Patch Tuesday; 6.0.47 addressed 37 CVEs on October 13, 2026.

Is the .NET Security Group an endorsement of NES for .NET?

No. It is a coordinated disclosure program for organizations that distribute .NET. Microsoft recommends upgrading to a supported version of .NET, currently .NET 10, and so do we. NES for .NET is for the applications that cannot move yet.

Does Microsoft give HeroDevs patches for end-of-life versions?

No. Members receive information about CVEs in supported versions of .NET. HeroDevs determines whether .NET 6, 8, or 9 is affected and builds the fixes for those versions.

Does HeroDevs release fixes before Patch Tuesday?

No. Fixes are published when Microsoft publishes. Shipping early would break the embargo every member agrees to.

Which versions of .NET does NES for .NET cover?

.NET 6, .NET 8, and .NET 9, including the runtime, ASP.NET Core, Entity Framework, the .NET SDK, WPF, Windows Desktop Runtime, and WinForms.

When do NES for .NET 8 and 9 customers get their first post-EOL fixes?

December 8, 2026, the first Patch Tuesday after .NET 8 and .NET 9 reach end of support on November 10, 2026.

‍