v10 .NET (10.0.0 through 10.0.6) - CVE-2026-40372 is 9.1 out of 10

I have the 10.0.101 SDK, but the Hosting was 10.0.6 (for IIS Apps).... after installing the .NET KB5091596 patch (10.0.7), it patched both with SDK going to 10.0.107 based on "Installed on" date (??)

https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/runtime-aspnetcore-10.0.7-windows-hosting-bundle-installer

I've done some basic testing.

I am not 100% sure (due to the environment), but it *may* ask for compile after reboot so just keep an eye out. Otherwise:

• Compile 
• Jobs Processing 
• qer-app-portal 
• qbm-app-landingpage  (There were some warnings in the session log, but I *think* these are just no-config warnings)
• qer-app-manager 
• qer-app-operationssupport 

Upgraded Hosting from 10.0.6 to 10.0.7 and everything working fine.
Thanks for the headsup Ben 

Hey juancarlos camargo ,

Your SDK/Desktop Runtime also upgraded? The .101 becomes .107 (or jump to .203) for SDK and Desktop Runtime has same versioning as the Hosting.

Hi,

My current setup:

* DotNet Hosting: 10.0.7

* WindowsDesktopRuntime: 10.0.7

* DotNet SDK: 10.0.203

All running.

Cool - just that you only listed "hosting" so wanted to double check