Security Updates for Microsoft .Net Framework (August 2023): Critical Patches for Zero-Day Vulnerabilities

Microsoft’s August 2023 security updates for the .NET Framework patch three zero-day flaws, including one letting attackers remotely execute code in ASP.NET Core.

If your servers run .NET 4.8 or later, you’re likely already seeing exploit attempts—malicious actors are scanning for unpatched systems right now. The stakes? Full system takeovers, stolen data, or ransomware deployed without a trace.

These updates aren’t just for enterprise IT teams; developers using ASP.NET Core or legacy .NET apps need to act fast. Microsoft’s fixes cover everything from Windows 7 (yes, really) to the latest Windows 11, but some versions require manual steps.

Below, I’ll break down which versions are affected, how to verify your current .NET installation, and the exact steps to apply patches—whether you’re managing a single dev machine or a global server fleet.

Zero-day vulnerabilities patched in August 2023: risks and exploit details

Microsoft’s August 2023 security bulletin addressed three actively exploited zero-day vulnerabilities in the .NET Framework, targeting versions 4.8, 4.7.2, and ASP.NET Core. These flaws allow attackers to execute arbitrary code, escalate privileges, or bypass security controls.

The most critical—CVE-2023-36025—enables remote code execution (RCE) via maliciously crafted HTTP requests. The risk is compounded by their use in supply-chain attacks targeting enterprise environments.

These vulnerabilities were discovered in the wild, with threat actors leveraging them to compromise Windows Server and IIS-hosted applications. Microsoft rated all three as Critical, emphasizing the urgency for patching. The exploits primarily target deserialization flaws in ASP.NET Core and memory corruption bugs in the .NET runtime.

Failure to apply these updates exposes systems to data theft, ransomware deployment, and lateral movement within networks.

CVE-2023-36025 stands out due to its remote exploitation capability, allowing attackers to bypass authentication and execute code without user interaction. This flaw resides in the ASP.NET Core WebSocket protocol handler, where improper input validation enables attackers to craft malformed WebSocket frames. Microsoft confirmed that this vulnerability was used in targeted attacks against high-value organizations, including financial and government sectors.

The second critical flaw, CVE-2023-36026, exploits a deserialization vulnerability in ASP.NET Core’s JSON deserializer. Attackers send specially crafted JSON payloads to trigger arbitrary object deserialization, leading to remote code execution.

This affects applications using System.Text.Json for serialization, a common practice in modern microservices and API-based architectures. The exploit chain often involves man-in-the-middle attacks to deliver malicious payloads.

CVE-2023-36027, while rated High, poses significant risks due to its impact on memory safety. This vulnerability stems from a buffer overflow in the .NET runtime’s JIT compiler, allowing attackers to corrupt memory and execute arbitrary code. Unlike the other two, this flaw requires local access but can be combined with other exploits to achieve privilege escalation. It primarily affects Windows Server 2019 and Windows 10/11 with .NET Framework 4.8 installed.

Microsoft’s August 2023 updates include cumulative patches for all three vulnerabilities, but organizations must ensure they apply the correct supplemental updates for offline systems. For example, .NET Framework 4.8 requires the KB5028185 update, while ASP.NET Core 5.0 needs KB5028186.

These updates are available via Windows Update, Microsoft Update Catalog, and WSUS. Testing in a staging environment is critical to avoid application compatibility issues.

In real-world scenarios, these vulnerabilities have been observed in supply-chain attacks where compromised third-party libraries or updates deliver malicious payloads. For instance, attackers exploited CVE-2023-36025 to compromise CI/CD pipelines by injecting malicious WebSocket handlers into legitimate build processes.

Organizations relying on open-source dependencies or third-party plugins are at higher risk. Monitoring for unusual HTTP traffic patterns and unexpected deserialization events can help detect early signs of exploitation.

To mitigate risks immediately, organizations should prioritize patching public-facing servers and API gateways first. Disabling WebSocket support in ASP.NET Core applications until patches are applied is a temporary workaround, though it may disrupt functionality.

For CVE-2023-36026, restricting JSON input sources to trusted origins can reduce exposure. However, these measures are not substitutes for applying the official updates, which address the root causes of these vulnerabilities.

How to apply .NET Framework security updates: step-by-step guide

Applying the August 2023 .NET Framework security updates is essential to protect against zero-day exploits targeting ASP.NET Core and legacy versions. Microsoft provides updates via Windows Update, but offline systems or specific supplemental updates require manual intervention.

Below, I’ll walk you through the process, including registry tweaks for offline environments and verification steps to ensure patches are applied correctly.

Before starting, confirm your system meets the minimum requirements: Windows Server 2012 R2+, Windows 10/11, and .NET Framework 3.5/4.x installed. For Windows Server, supplemental updates may be required for offline installations. Always back up critical data and test updates in a staging environment first to avoid disruptions.

After applying updates, test your applications to ensure compatibility. Some legacy apps may require recompilation or configuration tweaks due to security changes in ASP.NET Core or WCF services. Monitor logs for errors using Event Viewer > Windows Logs > Application.

For Windows Server 2012 R2, prioritize supplemental updates from Microsoft’s Update Catalog as they often include critical fixes not covered by standard Windows Update. Always document your update process for audit compliance and rollback planning.