CVE-2026-62886-- .NET Framework Elevation of Privilege vulnerability

Question

CVE-2026-62886-- .NET Framework Elevation of Privilege vulnerability

SSRao 1

Hi MS, I wanted to bring to your attention that KB5126144 installed successfully but System.web.dll file version under v2.0.50727 path remains unpatched (CVE-2026-62886)
R7 scanner continues to flag the server because the file version at this specific path has not advanced ->
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.web.dll

at first I though it is isolated case but found that all the servers with .Net3.5 are impacted
is this known issue? how to fix it?

0 comments

2 answers

Your answer

Answer 1

Daphne Huynh (WICLOUD CORPORATION) 1,570 Microsoft External Staff Moderator

Welcome to Microsoft Q&A!

Thank you for taking the time to provide detailed information about your environment and the results you've observed.

Based on the information currently available, this does not appear to be a documented known issue with KB5126144. Microsoft indicates that the September 2026 update addresses CVE-2026-62886 and does not list any known issues related to this release.

One detail that may help with troubleshooting is that KB5126144 serves as the umbrella update for Windows Server 2019. Depending on the .NET Framework versions installed on the server, Windows will apply one of the following component updates:

KB5126043 for .NET Framework 3.5 and 4.7.2
KB5126048 for .NET Framework 3.5 and 4.8

Because of this, checking only for KB5126144 or relying on a single DLL version may not be enough to confirm that the security update has been fully applied.

To help verify the installation, I would recommend you check the following:

Ensure the server has been restarted after the update installation.
Confirm that KB5126043 or KB5126048 is installed successfully:

dism /online /get-packages /format:table | findstr "5126043 5126048"

Verify the file version of System.Web.dll in both Framework locations:

(Get-Item "$env:windir\Microsoft.NET\Framework\v2.0.50727\System.Web.dll").VersionInfo.FileVersion

(Get-Item "$env:windir\Microsoft.NET\Framework64\v2.0.50727\System.Web.dll").VersionInfo.FileVersion

Compare the reported file versions with the file information published in the applicable KB article.
If the expected package or file version is missing, try reinstalling the applicable update from the Microsoft Update Catalog and then restart the server.

As a best practice, I would recommend not manually replacing or copying System.Web.dll from another server. This file is serviced through Windows and the .NET Framework servicing stack, and manual replacement can lead to inconsistencies in the component store.

If the applicable update is installed successfully and the DLL version matches Microsoft's published file information, but Rapid7 continues to report CVE-2026-62886, it may be worth opening a case with Rapid7 and providing the installed package information and file version details for review of the detection logic.

On the other hand, if the installed file version does not match the version expected in the Microsoft update package, I recommend you opening a Microsoft support case so the servicing state of the affected servers can be investigated further.

References: September 8, 2026-KB5126144 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 2019 | Microsoft Support

September 2026 cumulative update - .NET Framework | Microsoft Learn

Microsoft Update Catalog

If you find it useful, please click Accept Answer.

Thank you for choosing Microsoft Q&A.

SSRao 1 Reputation point

2026-09-23T03:29:53.6466667+00:00

thanks for update.
as below, the security update is active but both 32-bit & 64-bit paths are left with old version

PS C:\WINDOWS\system32> (Get-Item "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.web.dll").VersionInfo.FileVersion

2.0.50727.9070 (WinRelRS5.050727-9000)

PS C:\WINDOWS\system32> (Get-Item "C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.web.dll").VersionInfo.FileVersion

2.0.50727.9070 (WinRelRS5.050727-9000)

PS C:\WINDOWS\system32> dism /online /get-packages /format:table | findstr "5126043 5126048"

PS C:\WINDOWS\system32> Get-HotFix -Id KB5126043, KB5126048

Source Description HotFixID InstalledBy InstalledOn

SGSIASFS01 Update KB5126043 NT AUTHORITY\SYSTEM 9/20/2026 12:00:00 AM
Daphne Huynh (WICLOUD CORPORATION) 1,570 Reputation points Microsoft External Staff Moderator

2026-09-23T03:41:12.3866667+00:00
Thank you for providing the additional details and for taking the time to verify the update status.

Based on the information you've shared, KB5126043 is installed successfully, and both the 32-bit and 64-bit copies of System.Web.dll report the following version: 2.0.50727.9070

For Windows Server 2019 systems running .NET Framework 3.5 and 4.7.2, KB5126043 is the applicable September 2026 security update. This update addresses CVE-2026-62886 and currently does not list any known issues related to the release.

From the information available, 2.0.50727.9070 appears to be the expected serviced version for this update branch. As a result, seeing the file remain at this version does not necessarily indicate that the server is still vulnerable. The fact that both the Framework and Framework64 locations report the same version is also consistent with the update being applied successfully to both 32-bit and 64-bit components.

Regarding the DISM output, a blank result from the findstr command does not necessarily indicate that the update is missing. Package identities returned by DISM do not always expose the public KB number in a format that can be matched directly by findstr. In this case, the Get-HotFix output provides confirmation that KB5126043 has been installed.

If you'd like to perform some additional validation, you can check the package servicing state by running:

Get-WindowsPackage -Online |

Where-Object PackageState -eq "Installed" |

Where-Object PackageName -match "KB5126043|NetFx"

You may also verify the health of the component store and the integrity of the affected files:

DISM /Online /Cleanup-Image /ScanHealth

sfc /verifyfile=C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll

sfc /verifyfile=C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.Web.dll

If KB5126043 is installed, the server has been restarted, and both copies of System.Web.dll continue to report version 2.0.50727.9070, I would not recommend reinstalling the update or manually replacing the DLL. Since these files are serviced by Windows and the .NET Framework servicing stack, manual replacement can introduce component store inconsistencies.

At this point, it may be worthwhile to engage Rapid7 for additional clarification. When opening a case, I would suggest providing:

Installed update: KB5126043

Operating system: Windows Server 2019

32-bit System.Web.dll version: 2.0.50727.9070

64-bit System.Web.dll version: 2.0.50727.9070

Rapid7 vulnerability/check ID

Scan date

Scanner engine and content version

These information above should help Rapid7 determine whether the detection logic is incorrectly interpreting the fixed-version boundary or whether the signature is evaluating an additional .NET component beyond System.Web.dll.

Based on the evidence shared so far, I have not found any Microsoft documentation indicating that KB5126043 failed to update these files or that a later System.Web.dll version is required for this Windows Server 2019 configuration. That is why I currently lean toward a vulnerability detection issue rather than an update installation issue.

Answer 2

SSRao 1

Thanks for insights but I curious only servers with .Net3.5 Framework were flagged. this means the old dormant files of v2.0 are still sitting inside that path because MS didn't purge them. Will MS fix this metadate file in next update

Daphne Huynh (WICLOUD CORPORATION) 1,570 Reputation points Microsoft External Staff Moderator

2026-09-24T03:00:25.96+00:00
Thank you for the additional details and for sharing your observations

The files located under:

C:\Windows\Microsoft.NET\Framework\v2.0.50727

C:\Windows\Microsoft.NET\Framework64\v2.0.50727

Should not automatically be considered dormant or abandoned files. .NET Framework 3.5 includes the .NET Framework 2.0 and 3.0 components, and the v2.0.50727 directories remain part of the supported servicing architecture. Because of that, the presence of System.Web.dll in those locations is expected when .NET Framework 3.5 is enabled.

This also confirms that KB5126043 is the applicable September 2026 cumulative update for Windows Server 2019 systems running .NET Framework 3.5 and 4.7.2, and that this update addresses CVE-2026-62886. At this time, Microsoft does not list any known issues associated with the update.

Regarding your question about a future fix, I have not found any Microsoft documentation indicating that the v2.0.50727 files will be removed, re-versioned, or otherwise modified in an upcoming update. Therefore, I cannot confirm that Microsoft plans to purge these files or update their metadata in a future release.

The key question now is whether version 2.0.50727.9070 is the expected serviced version for this update branch, or whether the Rapid7 detection logic is expecting a different version. The fact that KB5126043 is installed confirms that the applicable Microsoft security update has been applied, but it does not by itself explain how Rapid7 determines vulnerability status for this DLL.

To help determine which side of the validation is causing the discrepancy, I would recommend:

Reviewing the file information package associated with KB5126043 and confirming whether System.Web.dll is listed as an updated payload and, if so, what version Microsoft documents for Windows Server 2019.

Contacting Rapid7 and requesting the exact vulnerability check ID, fixed-version threshold, and supporting evidence used by the detection.

If Rapid7 expects a version newer than 2.0.50727.9070, asking them to provide the Microsoft source used to establish that version requirement.

If Microsoft's published file information shows a newer version than what is installed on the server, opening a Microsoft support case for further investigation.

If Microsoft's file information matches the installed version, or if System.Web.dll is not listed as a changed payload, providing that evidence to Rapid7 for review of the detection logic.

At this point, the available Microsoft documentation supports that KB5126043 addresses CVE-2026-62886, but it does not indicate that these .NET Framework 3.5 components are obsolete or scheduled for removal. Based on the information available so far, I would recommend validating the DLL version against Microsoft's published file manifest and confirming Rapid7's version requirements before concluding that the files were unintentionally left behind.

References: September 2026 cumulative update - .NET Framework | Microsoft Learn

September 8, 2026-KB5126043 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019 | Microsoft Support