State of .NET 2026

.NET 10 shipped on November 11, 2025 as a Long-Term Support release (supported through November 2028). The release included C# 14, F# 10, ASP.NET Core 10 with OpenAPI 3.1 document generation defaults, Blazor 10 with a 76% smaller JavaScript bundle, Entity Framework Core 10 with vector search support, .NET MAUI 10, and .NET Aspire 13.0 adding polyglot orchestration for Python and JavaScript applications.

In early 2026, TIOBE named C# its **2025 Language of the Year** for the second time in three years. By November 2025, C# reached 7.65%, up 2.67 points year-over-year, narrowing the gap with Java (8.54%) to 0.89 percentage points. As of January 2026, C# stands at 7.39% versus Java's 8.71%, a gap of 1.32 points.

Microsoft reported over 7 million .NET developers using the Visual Studio family monthly, with over 290,000 pull requests received since open-sourcing and more than 23,000 merged into .NET 10 alone. Other major releases included Visual Studio 2026 (November 11) with AI-integrated workflows, GitHub Copilot integration for testing and modernization, the Microsoft Agent Framework (preview) consolidating Semantic Kernel and AutoGen, and Model Context Protocol C# SDK (preview) with reported production usage in Xbox Gaming Copilot and Copilot Studio.

Security incidents included CVE-2025-55315 (CVSS 9.9, Kestrel request smuggling, one of the highest-scoring ASP.NET Core vulnerabilities) and 23 malicious NuGet packages publicly reported in 2025 (14 crypto-impersonation packages from ReversingLabs, 9 time-delayed destructive packages from Socket) targeting cryptocurrency wallets and industrial control systems. Microsoft extended Short-Term Support releases from 18 to 24 months, creating a November 10, 2026 end-of-support convergence for both .NET 8 and .NET 9. .NET 11 Preview 1 arrives in February 2026.

Actions for 2026: Plan migration to .NET 10 before the unified November 10, 2026 end-of-support for both .NET 8 and .NET 9. Patch CVE-2025-55315 Kestrel request smuggling vulnerability. Adopt Visual Studio 2026 AI features including Agent Mode and Copilot Profiler. Test Microsoft Agent Framework and MCP C# SDK for AI agent workloads. Review EF Core 10 vector search for RAG and semantic search applications.

.NET 2025 Timeline

Security Crisis and Coordinated Response

On December 10, 2025, Microsoft disclosed CVE-2025-55315, a critical HTTP Request Smuggling vulnerability in ASP.NET Core Kestrel with a CVSS score of 9.9, one of the highest-scoring vulnerabilities in ASP.NET Core history. The vulnerability allowed attackers to exploit discrepancies in how HTTP/1.1 proxies and Kestrel parsed chunked transfer encoding, enabling Kestrel to interpret a crafted request as two separate requests where the second appeared to come from an authenticated client. Affected versions spanned ASP.NET Core 8, 9, and 10 (pre-rc2), forcing immediate emergency patching across global .NET infrastructure. Microsoft released patches (8.0.21, 9.0.10, 10.0.0-rc2) enforcing stricter HTTP/1.1 parsing rules, detailed mitigation guidance, and paid the researcher a $10,000 bug bounty. The event highlighted the fragility of HTTP parsing in complex microservice architectures and spurred security hardening updates throughout late 2025.

The NuGet supply chain saw escalation from typosquatting to credible operational threats in 2025. Security researchers identified 14 malicious packages impersonating cryptocurrency tooling (e.g., Nethereum) using typosquatting, homoglyphs, and fake version bumps to exfiltrate wallet credentials and OAuth tokens. Security firm Socket disclosed nine malicious packages containing time-delayed logic bombs targeting industrial control systems: packages like Sharp7Extend would silently corrupt 80% of write operations after 30+ minutes of runtime, with one randomly killing the host process 20% of the time starting on a trigger date in 2027. These packages accumulated approximately 9,500 combined downloads before removal, demonstrating that NuGet attacks had evolved from opportunistic theft to sophisticated sabotage targeting industrial infrastructure.

In response to escalating threats, Microsoft formalized the .NET Security Group in October 2025. The coalition had existed privately since 2016 with members like Red Hat, IBM, and Canonical, but Microsoft expanded and publicized it to coordinate vulnerability disclosure and patch delivery across the ecosystem. When Microsoft fixed CVE-2025-55315, Red Hat's RHEL package, Canonical's Ubuntu package, and Amazon's AWS .NET runtime could all release patches simultaneously with Microsoft, significantly reducing the attack window.

The community established new security baselines: aggressive patch cycles (48-hour deployment windows), mandatory dependency scanning using dotnet nuget verify and services like Socket or Snyk, SBOM generation for compliance, and post-quantum readiness experiments with the experimental ML-DSA and ML-KEM APIs introduced in .NET 10 adding FIPS 203 and FIPS 204 standards.

AI Integration: From Fragmentation to Framework

In October 2025, Microsoft unveiled the Microsoft Agent Framework (preview), consolidating two earlier fragmented orchestration libraries (Semantic Kernel and AutoGen) into a unified platform for single-agent orchestration and multi-agent collaboration. Before the Agent Framework, .NET developers faced confusing overlap between Semantic Kernel (Microsoft's LLM orchestration library) and AutoGen (multi-agent framework from Microsoft Research) with incompatible APIs and no clear guidance on selection criteria. The unified framework provides a single API surface supporting OpenAI, Azure OpenAI, Anthropic Claude, Ollama, and other providers with native integration into .NET Aspire for cloud-native AI deployment, ending months of community confusion about library investment decisions.

In November 2025, Microsoft released the Model Context Protocol (MCP) C# SDK in preview, adding Anthropic's standardized protocol for LLM interaction with external data sources and tools. Despite preview status, Microsoft reported production usage in Xbox Gaming Copilot and Copilot Studio, demonstrating confidence in SDK stability. The SDK provides server and client implementations, resource providers for file systems and databases, and standardized tool calling, integrating seamlessly with the Agent Framework. .NET Aspire 13.0 shipped with GitHub Models integration (preview), Azure AI Foundry integration (preview), ExternalService resources for modeling external URLs, and a Generative AI Visualizer for inspecting LLM interactions, completing the cloud-native AI stack.

The Agent Framework integration gave ML.NET renewed relevance as the "execution engine" for local models within .NET applications, carving out a niche for on-device inference where introducing Python dependencies is architecturally undesirable, production deployment in enterprise .NET applications, edge computing scenarios requiring lightweight runtimes, and cost optimization by avoiding per-token API charges for simple models. Visual Studio 2026 shipped with AI-integrated workflows including Copilot "Ask Mode" versus "Agent Mode" for multi-step autonomous refactoring, agentic debugging inspecting variable states across stack frames, Adaptive Paste adjusting code to project conventions, and GitHub Copilot App Modernization (GA) automating .NET Framework to .NET 10 upgrades (a fintech customer reportedly migrated 100+ apps "in just hours" instead of weeks. While Python maintains dominance in AI research and most papers provide Python implementations, .NET provided a complete stack for deploying AI in production environments without architectural compromises.

Performance and Platform Evolution

.NET 10's runtime incorporated architectural improvements for modern hardware: AVX10 support for Intel processors enabling 256-bit and 512-bit vector operations dynamically, ARM64 SVE (Scalable Vector Extension) for server-class ARM chips with variable-length vector operations, enhanced struct promotion allowing more stack allocations reducing memory traffic overhead, better register allocation, and garbage collection improvements delivering 8-20% reduction in pause times for server applications. C# 14 shipped with the field keyword for semi-auto-properties eliminating backing field boilerplate, extension members expanding to properties and events on types, null-conditional assignment (?.=) simplifying guard clauses, and implicit Span conversions reducing explicit type conversions. These features emphasized developer productivity without sacrificing performance or safety, manifesting as measurable gains in production workloads processing high throughput, particularly for AI inference workloads on CPUs where vector throughput correlates to token generation speed.

Native Ahead-of-Time (AOT) compilation became viable for console apps and microservices, delivering reduced startup time critical for AWS Lambda and Azure Functions cold starts, 50% smaller binary footprint compared to .NET 7 AOT, up to 6x performance gains in micro-benchmarks, and higher container density enabling lower cloud costs and carbon footprint through reduced wattage per request. .NET 10 made containerization first-class with native container publishing (dotnet publish --os linux --arch x64 /t:PublishContainer), new MSBuild property for Docker vs OCI formats, and day-one Azure support across App Service, Functions, and Container Apps with images immediately available in Microsoft Container Registry.

Teams characterized the migration from .NET 8 (LTS) to .NET 10 (LTS) as "smooth but strict": approximately 90% of projects required only a target framework bump, while teams faced challenges with removed APIs (System.Linq.Async replaced by core libraries, BinaryFormatter excised), stricter globalization in SQLite, and OpenAPI transformer pattern deprecation (ASPDEPR002). Real-world adoption validated the platform: the s&box development team (Garry's Mod successor) migrated to .NET 10 and C# 14 citing measurable performance improvements and runtime stability for performance-critical gaming, a fintech company shared at .NET Conf migrating 100+ apps from .NET Framework 4.8 to .NET 10 in months using GitHub Copilot and AppCAT, and Unity Technologies shared plans to move from Mono 2018 to .NET 8 LTS by end of 2025 citing major performance and tooling gains.

Cloud-Native Maturation

ASP.NET Core 10 shipped with OpenAPI 3.1 document generation enabled by default for all Web API projects with built-in validation and schema customization, native Server-Sent Events (SSE) support through IAsyncEnumerable eliminating third-party libraries, and built-in WebAuthn/FIDO2 support for passwordless authentication with passkeys. Blazor 10 delivered a 76% smaller JavaScript bundle (183KB to 43KB) through aggressive dead code elimination and WebAssembly optimization, circuit state persistence across reconnections improving mobile experience with Blazor.pause() API and [PersistentState] attribute, and HybridWebView enhancements for richer MAUI integration with shared code. These improvements dramatically reduced initial page load times, especially on mobile networks, while improving resilience for unstable connections. Hot Reload became enabled by default for WebAssembly Debug builds matching the Blazor Server developer experience.

Entity Framework Core 10 added native vector similarity search support in SQL Server and PostgreSQL with native vector type and VECTOR_DISTANCE() function enabling semantic search, recommendation engines, and RAG (Retrieval-Augmented Generation) patterns without external vector databases, JSON columns as default storage for complex object hierarchies reducing manual flattening (breaking existing schemas expecting nvarchar(max)), and direct LeftJoin and RightJoin query operators improving SQL translation for complex queries. .NET Aspire 13.0 shipped with polyglot orchestration supporting Python and JavaScript applications alongside .NET services, Aspire CLI graduating to general availability for production-ready deployment automation with aspire new, aspire add, aspire run, and aspire config commands, and the team's first transparent six-month public roadmap showing planned Azure integrations and breaking change timelines.

The platform matured through ecosystem stability improvements: third-party libraries like IronPDF and IronXL confirmed immediate .NET 10 support, logging frameworks (Serilog, NLog) announced RC1 compatibility, while older reporting libraries and vendors like ComponentOne and Telerik created enterprise migration bottlenecks requiring months for certification. The community established migration best practices: audit dependencies using dotnet list package --vulnerable and --outdated, test in isolated branches, enable .NET upgrade assistant and Roslyn analyzers, deploy incrementally to non-production environments first, track with Application Insights or OpenTelemetry for regressions, and maintain .NET 8 builds during transition periods for rollback capability. Microsoft extended Short-Term Support releases from 18 to 24 months, creating a November 10, 2026 end-of-support convergence for both .NET 8 and .NET 9.

.NET 2026 Watchlist

1. .NET 11 Preview Cycle Begins

When: February 2026 (expected)
Context: .NET 11 previews typically begin 3-4 months after the LTS release. As a Standard Term Support (STS) release, it will receive 2 years of support (extended from 18 months thanks to September 2025 policy change). Expected themes include Agentic UI (AG-UI initiative where UI components are agent-aware), Distributed Reliability (baking resilience patterns deeper into HttpClient and networking stack), Green Computing (optimizing for energy efficiency), and performance refinement. First Preview around February with early bits of C# 15, monthly previews throughout 2026, and clearer picture of feature set by Build 2026.
Action: Track preview releases for experimental features. Test .NET 10 LTS in production while evaluating .NET 11 preview features for future planning. Preview cycle informed by .NET 10 production feedback.

2. Unified .NET 8 and .NET 9 End-of-Life

When: November 10, 2026
Context: Microsoft's support timeline change means both .NET 8 LTS and .NET 9 STS reach end-of-support on the same day, creating a unified migration target. Organizations must migrate to .NET 10 by this date to maintain support. .NET 10 supported until November 2028. Organizations running .NET 8 LTS have two choices: (1) Jump to .NET 10 LTS during 2026 for three years of support, or (2) Bridge with .NET 11 (STS) then move to .NET 12 LTS in 2027. Microsoft's extended 24-month STS policy makes option 2 more viable than before.
Action: Begin migration planning immediately. Use GitHub Copilot App Modernization tools to assess upgrade blockers. Plan for Q3-Q4 2026 for testing and deployment to .NET 10.

3. Visual Studio 2026 Maturation and AI Feature Expansion

When: Throughout 2026
Context: Visual Studio 2026 shipped as the "First Intelligent Developer Environment" with deep AI integration. Expect monthly releases to add Agent Mode capabilities, expanded Copilot features, improved AI-assisted debugging, and extension ecosystem migration from VS 2022. Visual Studio Code will continue receiving C# Dev Kit updates, with Microsoft plans to phase out .NET 6/7 SDK support starting January 2026 marking the end of those versions in the development toolchain. Expected: AI agent integration patterns stabilizing, MCP server availability for development tasks, monthly updates bringing new AI model support, continued performance improvements, and extension marketplace modernization.
Action: Adopt Visual Studio 2026 for new projects. Explore Agent Mode for complex refactoring tasks. Provide feedback to shape AI-native development workflows.

4. Model Context Protocol (MCP) Ecosystem Growth

When: H1 2026
Context: MCP C# SDK reached preview in November 2025 and is already in production for Xbox Gaming Copilot and Copilot Studio. Expect GA release and rapid ecosystem expansion with community-built MCP servers for databases, APIs, and custom tools. The Agent Framework, MCP C# SDK, and GitHub Copilot integrations announced at .NET Conf 2025 will mature throughout 2026 with Agent Framework GA releasing as production-ready (Microsoft.Agents.AI), tighter IDE integration with more autonomous refactoring, expanded agent capabilities with better tool discovery and state management, production deployment patterns with established best practices, and growing MCP server ecosystem library of reusable tool integrations.
Action: Build MCP servers for internal tools and data sources. Integrate MCP into AI agent architectures. Track MCP registry for reusable community servers.

5. Microsoft Agent Framework Production Adoption

When: Q1-Q2 2026 (GA expected)
Context: The Agent Framework preview unified Semantic Kernel and AutoGen, providing production-ready primitives for autonomous AI agents. GA release will signal readiness for enterprise adoption with orchestration patterns and state management.
Action: Prototype agentic workflows with preview builds. Plan migration from Semantic Kernel or AutoGen to unified Agent Framework. Design multi-agent systems for complex automation scenarios.

6. Post-Quantum Cryptography Migration Planning

When: 2026-2027
Context: .NET 10 introduced experimental support for ML-DSA (Digital Signature) and ML-KEM (Key Encapsulation) based on CRYSTALS-Kyber. As quantum computing advances, organizations must prepare for quantum-resistant cryptography.
Action: Begin experimenting with post-quantum algorithms in non-production environments. Identify systems requiring long-term cryptographic security. Plan phased migration to quantum-resistant algorithms as they mature and standardize.

7. .NET MAUI Quality Improvements and Community Skepticism

When: Throughout 2026
Context: .NET MAUI faced persistent quality debates in 2025, with some developers abandoning the platform following the viral "Why I Don't Use .NET MAUI Anymore" article. 2026 is critical for proving sustained quality improvements, competitive performance with Flutter/React Native, and enterprise adoption beyond pilot projects. Potential developments: MAUI on Linux via community efforts (Uno Platform aiding), expanded Skia or web backends, and if matured, truly cross-platform across Win/macOS/Linux. Unity's move to .NET Core in 2026 could provide positive spillover effect for MAUI adoption in game tooling.
Action: Review .NET MAUI 10 for cross-platform projects with caution. Track service releases (SR2, SR3) for stability improvements. Consider Uno Platform or Avalonia as alternatives if MAUI quality concerns persist.

8. Blazor AOT and Performance Optimization

When: Throughout 2026
Context: Blazor 10 delivered 76% smaller JavaScript bundles and improved AOT support. Expect continued optimization in 2026 with better trimming, faster startup times, and enhanced interop performance, making Blazor increasingly competitive with JavaScript frameworks.
Action: Migrate Blazor WebAssembly apps to .NET 10 for bundle size improvements. Enable AOT compilation for production workloads. Profile startup performance and leverage new optimization features as they ship.

9. Entity Framework Core 10 Vector Search in Production

When: Q1-Q2 2026
Context: EF Core 10 introduced production-ready vector search with native vector type and VECTOR_DISTANCE() for AI workloads. Combined with SQL Server 2025's native JSON type, this enables sophisticated AI application data architectures. EF Core 11 expected with expanded vector database integrations (Pinecone, Weaviate, etc.), improved semantic search patterns, RAG (Retrieval-Augmented Generation) application frameworks, better LINQ support for vector distance queries, and integration with AI agent memory stores.
Action: Add vector search for semantic search, recommendation engines, and RAG (Retrieval-Augmented Generation) systems. Upgrade to SQL Server 2025 to leverage native JSON and vector capabilities. Profile vector search performance against dedicated vector databases.

10. .NET Aspire Polyglot Orchestration Maturation

When: Throughout 2026
Context: Aspire 13.0 GA introduced polyglot orchestration for Python and JavaScript applications, positioning .NET as the orchestration layer for heterogeneous microservice architectures. Expect enhanced integrations and broader language support, deeper integration with non-.NET workloads, expanded Azure and AWS integrations, continued CLI improvements, enhanced dashboard AI visualization capabilities, and standardized patterns for agent cluster orchestration. The public roadmap promises continued evolution with community input shaping priorities.
Action: Use Aspire for multi-language microservice orchestration. Leverage Aspire dashboard for unified observability across .NET, Python, and JavaScript services. Contribute to Aspire community integrations for more runtimes and tools.

11. Azure Functions v5 and Serverless Evolution

When: 2026
Context: Azure Functions v5 planned for 2026 will run on .NET 10 by default, bringing LTS stability to serverless workloads. Expect improved cold start performance, enhanced local development experience, and deeper Aspire integration.
Action: Plan migration from Azure Functions v4 (.NET 6/8) to v5 (.NET 10). Test isolated worker model for better performance and flexibility. Review Aspire for local serverless development and testing.

12. C# and Java Market Share Crossover

When: 2026
Context: C# rose 2.67 percentage points year-over-year by November 2025, with Java at 8.54% and C# at 7.65% (gap of 0.89 percentage points). By January 2026, C# had risen to 7.39% (+2.94 YoY), with Java at 8.71% (gap of 1.32 points). TIOBE CEO noted C# has removed every reason not to choose it over Java, with equal shares in all terrains except finance. 2026 could see the historic crossover as the gap continues to narrow.
Action: Position .NET for enterprise adoption in traditionally Java-dominated spaces. Highlight cross-platform capabilities, open-source ecosystem, and AI-native development. Track TIOBE Index quarterly for historic crossover milestone.

13. .NET Security Group Expansion and Coordinated Patching

When: Throughout 2026
Context: The .NET Security Group formalized in October 2025 with Red Hat, IBM, and Canonical enables coordinated vulnerability response. Expect membership expansion (potentially AWS, Alibaba) and more frequent security rollups if needed. Security best practices from 2025 incidents include aggressive patch cycles (48-hour deployment windows), dependency scanning, SBOM generation, NuGet more verification features (mandatory 2FA, package signing enforcement), and SBOM generation features in build system for regulatory compliance.
Action: Maintain aggressive patch cycles with 48-hour deployment windows. Leverage .NET Security Group coordination for simultaneous patches across distributions. Generate SBOMs for compliance and supply chain visibility.

14. GitHub Copilot Testing for .NET Maturation

When: Q2-Q3 2026 (GA expected)
Context: GitHub Copilot Testing for .NET reached preview in November 2025, enabling AI-generated unit tests with edge case coverage. GA release will integrate seamlessly into Visual Studio 2026 and VS Code workflows.
Action: Adopt Copilot Testing for new features to improve test coverage. Review and refine AI-generated tests for accuracy. Measure impact on code quality and bug detection rates.

15. Unity .NET Core Migration Spillover Effects

When: Throughout 2026
Context: Unity's move to .NET Core in 2026 brings millions of game developers to modern .NET and C#. This could provide positive spillover effects for MAUI adoption in game tooling and broader .NET ecosystem growth.
Action: Track Unity's .NET Core adoption for patterns and best practices. Explore .NET MAUI for game development tools if Unity migration succeeds. Engage with game development community to promote .NET capabilities.

16. Continued Performance Innovation: AVX-512, ARM SVE, GC Improvements

When: Throughout 2026 (.NET 11 previews)
Context: .NET 10 set a high bar with AVX10 support and struct promotion optimizations. 2026 will bring continued performance innovation with AVX-512 leveraging, ARM Scalable Vector Extensions, better GC for large heaps (region-based GC research), startup time reduction through profile-guided AOT, and memory safety/diagnostics with analyzers or sandboxing options to catch unsafe patterns. There's community interest in enabling Rust-like borrow-checking concepts in managed code; while full memory safety is tricky in .NET, 2026 might bring improved tools to detect memory issues or race conditions.
Action: Profile applications on .NET 10 to establish baselines. Test .NET 11 previews for performance regressions or improvements. Leverage hardware features (AVX10, ARM SVE) in performance-critical code paths. Track GC improvements for large-heap scenarios.

17. C# 15 Language Evolution

When: Throughout 2026 (.NET 11 previews)
Context: Building on C# 14's extension members and field keyword, expect continued refinement. Potential features (speculative): more pattern matching improvements, collection expression enhancements, more compiler optimizations, potential explorations of memory safety features inspired by Rust, slices/spans becoming even more first-class, and further reduction of ceremony and boilerplate. The C# team has consistently followed a pattern of evolutionary rather than revolutionary changes, focusing on "sharper syntax for common scenarios."
Action: Track C# language design meetings and proposals. Provide feedback on preview features through GitHub discussions. Prepare codebases for new language capabilities.

18. RISC-V Support and Emerging Architectures

When: 2026
Context: Contributions from Samsung in 2025 have been preparing .NET for RISC-V architecture. 2026 might see an official .NET runtime for RISC-V 64-bit (perhaps in preview form), aligning with growing industry interest in RISC-V and ensuring .NET runs on emerging devices.
Action: Track RISC-V runtime previews for embedded and IoT scenarios. Review power consumption and performance characteristics. Plan for deployment on RISC-V hardware as ecosystem matures.

19. WASI Maturity and WebAssembly Evolution

When: 2026
Context: The experimental WASI (WebAssembly System Interface) support that began in .NET 8 is likely to reach maturity. By end of 2026, expect .NET running in WASI environments more smoothly, enabling lightweight serverless functions, plugin systems via WebAssembly outside the browser, and polyglot interop without native dependencies.
Action: Experiment with WASI for serverless and plugin architectures. Review security and isolation benefits. Plan migration of appropriate workloads to WASI environments.

20. CoreCLR Everywhere: Unified Runtime Strategy

When: 2026
Context: The Mono runtime (still used for iOS/Android in .NET 10) might be fully supplanted by CoreCLR in 2026. The .NET team hinted that the CoreCLR on mobile experiment (optional in .NET 10) could become the default in .NET 11, unifying runtimes and bringing better performance to MAUI apps.
Action: Test mobile applications with CoreCLR runtime option in .NET 10. Measure performance improvements and stability. Prepare for CoreCLR as default in .NET 11.

21. .NET Framework Final Migration Push

When: 2026-2027
Context: Microsoft has extended support for .NET Framework 4.8 indefinitely as part of Windows. Yet, speculation exists that 2026-2027 might see a final push to move even the last .NET Framework apps to Core with more sophisticated upgrade assistants, potential "emulation layer" to host old WebForms on .NET 10+, and AI tools easing migration cost. With .NET Core now fully superseding Framework in capabilities and AI tools easing migration, 2026 could mark an acceleration in legacy migrations.
Action: Assess remaining .NET Framework applications for migration viability. Leverage GitHub Copilot App Modernization tools. Plan phased migration strategies with business stakeholder buy-in.