For administrators and developers, the practical priority is availability: identify the affected products in your environment, apply the matching fixes, and verify the resulting versions. This is not a patch to defer simply because Microsoft assesses exploitation as less likely.
What the vulnerability does
Microsoft’s advisory states: “ASP.NET Core Denial of Service Vulnerability: Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.”
The weakness is classified as CWE-833, a deadlock condition. In general technical terms, a deadlock occurs when work cannot progress because operations are waiting on one another. Here, Microsoft identifies the security consequence as denial of service.
The supplied CVSS vector makes the risk more specific: the attack is network-based, has low attack complexity, requires no privileges and needs no user interaction. Its assessed impact is high for availability, with no confidentiality or integrity impact represented in the vector. That distinction matters: this advisory concerns keeping applications responsive, rather than an assessed ability to steal or alter their data.
Severity and exploitation assessment
Microsoft’s advisory records the following:
- Severity: Important
- CVSS base score: 7.5
- CVSS temporal score: 6.5
- CWE: CWE-833
- Publicly disclosed: No
- Exploited: No
- Exploitation assessment: Exploitation Less Likely
- Customer action required: Yes
The full CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
These status fields describe Microsoft’s advisory assessment. “Exploitation Less Likely” is not a guarantee of safety, and the lower temporal score does not remove the need to install the fixes.
Affected products and fixed builds
Microsoft identifies the following product-specific update targets. Keep each KB paired with its corresponding ASP.NET Core branch; the fixed build numbers are not interchangeable.
| Affected product | Update and fixed build |
|---|---|
| ASP.NET Core 10.0 | KB5130036 → 10.0.13 |
| ASP.NET Core 8.0 | KB5130034 → 8.0.32 |
| ASP.NET Core 9.0 | KB5130035 → 9.0.21 |
| Microsoft Visual Studio 2022 version 17.14 | Fixed build 17.14.42 |
| Microsoft Visual Studio 2026 version 18.10 | Fixed build 18.10.4 |
The official remediation instructions are:
- For ASP.NET Core 10.0, install KB5130036 to reach fixed build 10.0.13.
- For ASP.NET Core 8.0, install KB5130034 to reach fixed build 8.0.32.
- For ASP.NET Core 9.0, install KB5130035 to reach fixed build 9.0.21.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.42 or later.
- For Microsoft Visual Studio 2026 version 18.10, update to fixed build 18.10.4 or later.
How to turn the advisory into a patch plan
The useful operational distinction is that Microsoft lists both application-framework products and development tools. A patch checklist covering only one category would not cover the full affected-product set.
Based on those product mappings and the network availability impact, a practical rollout should:
- Inventory each listed product separately. Match installed products to the exact branches above rather than treating all ASP.NET Core or Visual Studio installations as a single update target.
- Prioritize affected network-facing services. This is a risk-based recommendation derived from the network attack vector and high availability impact, not an additional Microsoft exploitation claim.
- Apply the corresponding remediation. Include affected developer installations as well as environments running affected ASP.NET Core products.
- Verify the resulting build and application health. Record the installed version against the relevant target, then confirm that affected applications remain responsive after maintenance.
Successful remediation should be demonstrated by the product-specific fixed versions, not merely by an update job reporting completion. Likewise, completing a Visual Studio update is not evidence that every affected ASP.NET Core installation elsewhere has been addressed.
Bottom line: CVE-2026-70186 is an availability vulnerability with an unauthenticated network attack path and explicit customer action required. Microsoft’s fixes provide clear branch-by-branch targets; the administrative task is to ensure none of the affected runtime or development-tool installations falls between patching teams.