Network Management

Applying Microsoft ASP.NET Core and .NET Desktop Runtime Security Patches on the Windows Servers running SolarWinds Platform

This article provides information about best practices for applying ASP.NET Core and .NET Desktop Runtime security patches to mitigate security vulnerabilities in environments running SolarWinds Platform.

First published date

10/2/2025 5:00 PM

Last published date

10/27/2026 4:31 PM

Overview

The SolarWinds Platform relies on Microsoft ASP.NET Core and .NET Desktop Runtime. Microsoft regularly releases security patches to address vulnerabilities in Microsoft ASP.NET Core and .NET Desktop Runtime. These updates are considered third-party maintenance and are not supported directly by SolarWinds. However, SolarWinds recommends updating to the latest version of Microsoft ASP.NET Core and .NET Desktop Runtime to maintain a secure and stable environment.

This article provides guidance on:

Verifying the current Microsoft ASP.NET Core and .NET Desktop Runtime
Registry setting for .NET Automatic Updates on the Server Operating Systems
Locating and downloading the latest patch from Microsoft per CVE
Safely applying updates with minimal impact to SolarWinds operations

While no specific error messages are tied to unpatched Microsoft ASP.NET Core and .NET Desktop Runtime, failure to apply updates may expose your environment to known risks as outlined in Microsoft Security Bulletins.

Product section

Orion Platform

Cause

Vulnerabilities in Microsoft ASP.NET Core and .NET Desktop Runtime that require patching, as identified and remediated by Microsoft security updates. These are not caused by SolarWinds software but by external factors in the Microsoft ASP.NET Core and .NET Desktop Runtime ecosystem.

Resolution

Important! When patching ASP.NET Core or .NET Desktop Runtime, SolarWinds recommends upgrading both components, even if the vulnerability appears to affect only one. Running different versions of ASP.NET Core and .NET Desktop Runtime on the same server can cause SolarWinds Platform services to fail.

To apply Microsoft ASP.NET Core and .NET Desktop Runtime updates:

Verify the current Microsoft ASP.NET Core and .NET Desktop Runtime version:

Follow the guidance at:  Check installed .NET versions on Windows, Linux, and macOS - .NET | Microsoft Learn

Opting in for automatic updates:

Refer to the list at: .NET Automatic Updates for Server Operating Systems - .NET Blog

Microsoft Security Update link:

CVE-2025-24070 - CVE-2025-24070 - Security Update Guide - Microsoft - ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

CVE-2025-30399 - CVE-2025-30399 - Security Update Guide - Microsoft - .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-55315 - CVE-2025-55315 - Security Update Guide - Microsoft - ASP.NET Security Feature Bypass Vulnerability
CVE-2025-55247 - CVE-2025-55247 - Security Update Guide - Microsoft - .NET Elevation of Privilege Vulnerability
CVE-2025-55248 - CVE-2025-55248 - Security Update Guide - Microsoft - .NET, . NET Framework and Visual Studio Information Disclosure Vulnerabilities
CVE-2026-21218 - CVE-2026-21218 - Security Update Guide - Microsoft - .NET Spoofing Vulnerability
CVE-2026-35433 - CVE-2026-35433 - Security Update Guide - Microsoft - .NET Elevation of Privilege Vulnerability
CVE-2026-42899 - CVE-2026-42899 - Security Update Guide - Microsoft - ASP.NET Core Denial of Service Vulnerability
CVE-2026-32175 - CVE-2026-32175 - Security Update Guide - Microsoft - .NET Core Tampering Vulnerability
CVE-2026-32177 - CVE-2026-32177 - Security Update Guide - Microsoft - .NET Elevation of Privilege Vulnerability
CVE-2026-111497 - .NET 8.0 Update - October 25, 2026 | Microsoft Support

Before proceeding with the update, follow these best practices to ensure minimal downtime and data protection:

Important Notice:

Take a full backup of the database server(s), including the SolarWinds databases.

Take a snapshot or backup of all SolarWinds server(s) for quick rollback if needed.

Recommended patch procedure

Schedule a maintenance window. Notify stakeholders and follow your organization’s change-control process. Include every Windows server hosting a SolarWinds Platform component, such as the Platform server, additional polling engines/scalability engines, and web or application servers.
Record the current state. On each applicable server, record the SolarWinds Platform version and installed ASP.NET Core and .NET Desktop Runtime versions. You can list installed runtimes from an elevated Command Prompt or PowerShell window with:
dotnet --list-runtimes

Prepare recovery safeguards. Take VM snapshots or server backups for the affected servers and a full SolarWinds Platform database backup. Confirm the backups completed and are available before proceeding.
Handle High Availability (HA), if configured. Temporarily disable or place HA in maintenance according to the applicable SolarWinds procedure for the environment. Do not proceed until the planned maintenance state is confirmed.
Stop SolarWinds services on the affected Platform component servers, following the documented service-management procedure for the deployment.
Install the matching .NET 8.0.33 runtimes. Obtain the official Windows x64 installers or update through the applicable Microsoft Update/WSUS process. Install both Microsoft ASP.NET Core Runtime 8.0.33 and Microsoft .NET Desktop Runtime 8.0.33 on every server in scope. Do not leave the two runtimes at different versions.
Reboot if required by the installer or your change procedure. If a restart is required, complete it before starting SolarWinds services.
Restart SolarWinds services on the affected servers using the documented procedure. Re-enable HA or return it to its normal operating state after the nodes are ready.
Validate the environment. Confirm that both runtimes report version 8.0.33 on each server with dotnet --list-runtimes; verify SolarWinds services are running, the web console is accessible, database connectivity is healthy, and polling is operating normally. Review relevant logs and rerun the vulnerability scan to confirm the finding is cleared.

Important: Update ASP.NET Core Runtime and .NET Desktop Runtime together, and keep their versions aligned across the SolarWinds Platform servers. Do not use this security update as a reason to change to a different .NET major version; check the system requirements for the installed SolarWinds Platform release before making major-version changes.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.