Summary
- Microsoft updated the October 2026 Scan Cab to include metadata for newly released out-of-band security updates across .NET, Visual Studio, and PowerShell.
- This affects environments that installed .NET 8.0/9.0/10.0/11.0 RC3, Visual Studio 2019/2022/2026, or PowerShell 7.4/7.6, and that use Scan Cab to assess update compliance.
- IT admins who downloaded the earlier Scan Cab should reacquire the updated cab and redeploy it using their normal update assessment process.
- No action is needed if your organization does not use Scan Cab for these products, though Microsoft notes some non-Microsoft tools may also rely on it.
Primary Service: Windows
Admin Impact: Medium
User Impact: Low
Release Start: 26 Oct 2026
Release End: 26 Oct 2026
Services: PowerShell, Windows
Category: Prevent or fix issues
Tags: Admin Action
History
10/26/2026 Item Added to Message Center
Microsoft Message
IMPORTANT: This notice applies only to environments where:
- .NET 8.0, 9.0, 10.0, or 11.0 RC3 is installed.
- Visual Studio 2019, 2022, or 2026 is installed.
- PowerShell 7.4 or 7.6 is installed.
- Scan Cab is used to assess update compliance.
- The October 2026 Scan Cab was deployed before 7:00 PM PDT on October 25, 2026.
An updated version of the October 2026 Scan Cab was made available at 7:00 PM PDT on October 25, 2026. It includes new metadata for these out-of-band security updates:
- .NET 8.0 (KB5133964), .NET 9.0 (KB5133965), .NET 10.0 (KB5133966), and .NET 11.0 RC3 (Release notes)
- Visual Studio 2026, Visual Studio 2022, and Visual Studio 2019
- PowerShell 7.6 and PowerShell LTS 7.4
These updates address security vulnerabilities across .NET, Visual Studio, and PowerShell. See the Additional information section for vulnerability details.
Rollout schedule
The updated October 2026 Scan Cab was made available at 7:00 PM PDT on October 25, 2026.
Who is affected
IT administrators who downloaded the Scan Cab before 7:00 PM PDT on October 25, 2026, should reacquire and redeploy it if they use Scan Cab to assess updates for environments with the affected .NET, Visual Studio, or PowerShell versions listed above.
No action is required if Scan Cab isn’t used to assess updates for these products. Because non-Microsoft applications may also use Scan Cab, review the documentation for your organization’s software and update-deployment tools to determine whether this applies to your environment.
What will happen
Administrators can re-deploy the updated Scan Cab via their usual processes. For detailed guidance, see the Additional information section below.
Additional information
- Updated Scan Cab: Download the new Scan Cab
- CVE-2026-70197: .NET Remote Code Execution Vulnerability
- CVE-2026-102870: ASP.NET Core Remote Code Execution Vulnerability
- CVE-2026-114148: ASP.NET Core Elevation of Privilege Vulnerability
- CVE-2026-111497: Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
- .NET Security Updates: .NET 8.0 (KB5133964), .NET 9.0 (KB5133965), .NET 10.0 (KB5133966), and .NET 11.0 RC3 (Release notes)
- Visual Studio Security Updates: Visual Studio 2026, Visual Studio 2022, and Visual Studio 2019
- PowerShell Security Updates: PowerShell 7.6 and PowerShell LTS 7.4
- Announcing a smaller WSUS Scan Cab – Microsoft Tech Community: Learn more about WSUS and the Scan Cab process
- Using WUA to Scan for Updates Offline – Win32 apps: Windows Update Agent (WUA) can be used to scan computers for security updates without connecting to Windows Update
- WSUS and the Catalog Site: The Catalog Site used by WSUS to import updates and drivers