Out-of-band security updates for .NET address the Brotli decoder vulnerability and tarball ownership vulnerability.
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027.