End of life / .NET Core SDK / 3.0
.NET Core SDK 3.0 end of life
.NET Core SDK 3.0 reached end of life on 3 March 2020, 2,378 days ago. 8 known CVEs reach this release, the most severe rated HIGH.
The detail
- Released
- 23 September 2019
- End of life
- 3 March 2020
- Countdown
- 2,378 days ago
- Status
- End of life
- Support phase
- eol
- Long term support
- No
- Newest build on this release
- 3.0.103
- Newest release overall
- 10.0.400
CVEs that reach 3.0
| Advisory | Severity | CVSS | Published | Fixed in |
|---|---|---|---|---|
| CVE-2026-47303 Microsoft Security Advisory CVE-2026-47303 | .NET Elevation of Privilege Vulnerability | HIGH | 8.8 | 14 July 2026 | 8.0.129 |
| CVE-2026-47300 Microsoft Security Advisory CVE-2026-47300 | .NET Elevation of Privilege Vulnerability | HIGH | 8.8 | 14 July 2026 | 8.0.129 |
| CVE-2025-26646 Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability | HIGH | 8.0 | 13 May 2025 | 9.0.106 |
| CVE-2026-50650 Microsoft Security Advisory CVE-2026-50650 | .NET Elevation of Privilege Vulnerability | HIGH | 7.8 | 14 July 2026 | 8.0.129 |
| CVE-2026-50649 Microsoft Security Advisory CVE-2026-50649 | .NET Remote Code Execution Vulnerability | HIGH | 7.8 | 14 July 2026 | 8.0.129 |
| CVE-2026-50646 Microsoft Security Advisory CVE-2026-50646 | .NET Remote Code Execution Vulnerability | HIGH | 7.8 | 14 July 2026 | 8.0.129 |
| CVE-2025-55247 Microsoft Security Advisory CVE-2025-55247: .NET Denial of Service Vulnerability | HIGH | 7.3 | 14 October 2025 | 10.0.100-rc.2.25502.107 |
| CVE-2026-62900 Microsoft Security Advisory CVE-2026-62900 | .NET Information Disclosure Vulnerability | MEDIUM | 5.9 | 11 August 2026 | 8.0.130 |
A further 13 advisories publish no version range, so whether they reach 3.0 cannot be determined from the advisory alone.
Where to move next
The newest tracked release is 10.0.400. If moving release is not an option yet, 3.0.103 is the newest build on the 3.0 line and needs no migration.
Other .NET Core SDK releases
Vendor sources last checked 6 September 2026, and checked daily. This data last changed on 6 September 2026.
You just looked this up by hand, for one version
StackDrift scans your machines, works out every version you actually run, and mails you before the next support window closes or a CVE lands on a build you have deployed. It covers the runtimes, operating systems and kernels underneath your code, not just your packages.