CVE-2026-111497 Broccoli2Shell: Microsoft Emergency .NET Brotli Patch Analysis

In October 2026, Microsoft issued emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 to address CVE-2026-111497, a critical out-of-bounds write vulnerability in the Brotli decompression library dubbed Broccoli2Shell (also tracked as HTTP2Shell and Node2Shell). The flaw allows unauthenticated remote attackers to trigger crashes, memory leaks, or achieve remote code execution by sending maliciously crafted Brotli-compressed streams to any application using ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs. Proof-of-concept exploit code was publicly available on GitHub at time of disclosure, significantly lowering the bar for exploitation across enterprise cloud-hosted and on-premises .NET workloads.

The public availability of PoC exploit code for a critical RCE vulnerability in a foundational compression library used across millions of .NET applications signals a narrow remediation window for security teams. Organizations with internet-facing APIs, microservices, or cloud-native applications built on .NET are at elevated risk, and the attack surface is amplified by the broad adoption of HTTP/2 and Brotli compression in modern cloud environments.

With PoC exploits already published on GitHub and no default safeguards blocking Brotli-compressed requests at the network layer, organizations running unpatched .NET workloads face an immediate and concrete risk of remote code execution. Cloud-native environments with high volumes of HTTP/2 traffic and microservices architectures are especially exposed, and attackers can weaponize this vulnerability before most patch cycles complete.

An attacker targets internet-facing .NET applications that have opted into Brotli decompression (ASP.NET Core request decompression, HttpClient response decompression, or System.IO.Compression Brotli APIs), sending a maliciously crafted Brotli-compressed stream to exploit CVE-2026-111497 and achieve remote code execution or memory corruption on the vulnerable host. From that initial foothold, the attacker leverages the RCE capability to escalate privileges on unpatched .NET installations running non-default configurations, then moves laterally across cloud workloads and internal services, establishes command-and-control channels, exfiltrates sensitive data, and ultimately disrupts or destroys targeted services.

Kill Chain Progression

This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.

The attacker sends a specially crafted Brotli-compressed HTTP request to an internet-exposed ASP.NET Core application or HTTP client that has opted into Brotli decompression. The out-of-bounds write in the Brotli decoder (CVE-2026-111497) triggers a memory corruption condition, enabling remote code execution on the vulnerable .NET host. Public PoC exploits published on GitHub lower the barrier to exploitation significantly.

Included CVEs with severity scores, affected products, exploit status, and reference links.

CVE-2025-21172 CVSS 7.5 A critical out-of-bounds write vulnerability in the Brotli decoder used by .NET and Visual Studio allows a remote unauthenticated attacker to trigger memory corruption, crashes, or achieve remote code execution by sending a maliciously crafted Brotli-compressed data stream to affected applications. Affected Products: Microsoft .NET 8 – < 8.0.12 Microsoft .NET 9 – < 9.0.1 Microsoft Visual Studio 2022 – < 17.12.4 Exploit Status: proof of concept References:

A critical out-of-bounds write vulnerability in the Brotli decoder used by .NET and Visual Studio allows a remote unauthenticated attacker to trigger memory corruption, crashes, or achieve remote code execution by sending a maliciously crafted Brotli-compressed data stream to affected applications.

Microsoft .NET 8 – < 8.0.12

Microsoft .NET 9 – < 9.0.1

Microsoft Visual Studio 2022 – < 17.12.4

MITRE ATT&CK® Techniques

Exploit Public-Facing Application

Exploitation for Client Execution

Exploitation for Defense Evasion

Exploitation for Privilege Escalation

Endpoint Denial of Service: Application or System Exploitation

Command and Scripting Interpreter

Ingress Tool Transfer

Obtain Capabilities: Vulnerabilities

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

NIST SP 800-53 Rev 5 – Flaw Remediation

CVE-2026-111497 requires immediate out-of-band patching across all affected .NET versions. Organizations that fail to apply emergency updates in a timely manner are in direct violation of flaw remediation controls, which mandate that vulnerabilities be identified, reported, and corrected within organizationally defined timeframes, especially when PoC exploit code is publicly available.

PCI DSS 4.0 – All System Components Protected from Known Vulnerabilities

Control ID: Requirement 6.3.3

PCI DSS 4.0 requires that all software components, including third-party libraries such as the Brotli decoder bundled within .NET, are protected against known vulnerabilities. Applications that bundle their own Brotli library and process payment-related HTTP traffic over ASP.NET Core or HttpClient are directly exposed, and failure to patch constitutes a critical non-compliance finding under Requirement 6.

DORA (EU) 2022/2554 – ICT Risk Management and Vulnerability Handling

Control ID: Article 9 – ICT Security

DORA mandates that financial entities maintain robust ICT risk management frameworks capable of identifying and remediating critical vulnerabilities across all software dependencies. The presence of publicly disclosed PoC exploits for a remote code execution flaw in a widely deployed runtime like .NET elevates the urgency of response. Delays in patching or lack of compensating controls (e.g., blocking Brotli-compressed requests at the perimeter) would represent a material ICT risk management failure under DORA Article 9.

NIS2 Directive (EU) 2022/2555 – Vulnerability Handling and Patch Management

Control ID: Article 21 – Cybersecurity Risk Management Measures

NIS2 requires operators of essential and important entities to implement vulnerability handling policies and ensure timely application of security updates. CVE-2026-111497 affects HTTP server infrastructure across web-facing .NET applications. Failure to implement Microsoft's emergency patches or apply interim mitigations (proxy-level blocking of Brotli-compressed requests) would constitute a breach of mandatory technical risk management obligations under NIS2 Article 21.

CISA ZTMM 2.0 – Application-Level Vulnerability and Dependency Management

Control ID: Application Workloads – Pillar 4, Optimize Stage

CISA's Zero Trust Maturity Model emphasizes continuous validation of application workload integrity, including third-party library dependencies. The Broccoli2Shell vulnerability highlights the risk of bundled libraries (e.g., applications shipping their own Brotli binary) bypassing system-level patching. Organizations at Optimize maturity are expected to maintain software bill of materials (SBOM) visibility and enforce automated remediation workflows to address such risks without reliance on OS-level updates alone.

NYDFS 23 NYCRR 500 – Vulnerability Management and Privilege Escalation Prevention

Control ID: Section 500.7 – Access Privileges and Section 500.16 – Vulnerability Management

NYDFS-regulated financial institutions must maintain formal vulnerability management programs and ensure that critical flaws enabling privilege escalation and remote code execution are remediated promptly. CVE-2026-111497's ability to allow unprivileged attackers to escalate privileges on unpatched .NET systems with non-default configurations directly triggers obligations under Section 500.7 (access privilege controls) and Section 500.16 (penetration testing and vulnerability management), particularly given the availability of public PoC exploit code.

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Critical CVE-2026-111497 Brotli RCE flaw directly threatens .NET-dependent IT infrastructure; unpatched ASP.NET Core deployments face remote code execution and privilege escalation via maliciously crafted compressed streams.

Financial platforms leveraging .NET HTTP clients for encrypted data transit face RCE and exfiltration risk; PCI 4.0 and NIST.800-53.SC-7 compliance gaps emerge if Brotli decompression remains unpatched.

Healthcare .NET applications processing compressed data streams risk patient data exfiltration and privilege escalation, threatening HIPAA.164.312(e)(1) and HIPAA.164.308(a)(1) compliance through vulnerable Brotli decoder exploitation.

Software engineering teams bundling Brotli libraries independently of system updates remain exposed post-patch; PoC exploits published on GitHub accelerate lateral movement and initial compromise risk across development pipelines.

Microsoft releases emergency .NET patches for critical Brotli flaw Verified

CVE-2025-21172 Detail - NVD Verified

Microsoft Security Advisory CVE-2025-21172 - .NET and Visual Studio Remote Code Execution Vulnerability Verified

.NET January 2025 Updates - Microsoft DevBlogs Verified

Critical HTTP2Shell Brotli vulnerability triggers emergency patches - BleepingComputer Verified

Google Brotli Library - GitHub Advisory Verified

CISA Known Exploited Vulnerabilities Catalog Verified

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and Controls CNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant here because the attack chain depends on unrestricted inbound reachability to vulnerable .NET workloads, uncontrolled east-west trust between cloud services, and open outbound egress paths for command-and-control and data exfiltration. By enforcing workload-level segmentation, identity-aware routing, and controlled egress, CNSF would likely reduce the attacker's ability to pivot freely and exfiltrate data even after initial exploitation.

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Restricting inbound reachability to only explicitly authorized source paths and ports would likely reduce the attack surface available to unauthenticated internet-originating exploit traffic targeting the vulnerable .NET endpoint.

Control: Zero Trust Segmentation

Mitigation: Workload-level Zero Trust segmentation would likely constrain what a compromised unprivileged process can communicate with, reducing the practical value of harvested credentials by limiting where those credentials could be used to move .

Control: East-West Traffic Security

Mitigation: Enforcing east-west microsegmentation between workloads would likely reduce the attacker's ability to freely pivot from the initially compromised .NET host to adjacent microservices or internal APIs, limiting lateral reachability across application tiers.

Control: Multicloud Visibility & Control

Mitigation: Centralized multicloud visibility into outbound traffic patterns from .NET workloads would likely surface anomalous communication flows to unexpected external destinations, reducing the attacker's ability to maintain covert command-and-control channels without detection.

Control: Egress Security & Policy Enforcement

Mitigation: FQDN-based egress policy enforcement would likely constrain outbound data transmission to only approved external destinations, reducing the attacker's ability to exfiltrate sensitive data to unauthorized external infrastructure.

If earlier CNSF controls meaningfully limited lateral movement and egress paths, the attacker's blast radius at the Impact stage would likely be constrained to a smaller set of workloads rather than extending across interconnected cloud services and application tiers.

Affected Business Functions

Web Application Services (ASP.NET Core HTTP request decompression)

API Gateway and Microservices Communication

Software Development and Build Pipelines (Visual Studio, .NET SDK)

Cloud-Hosted Application Delivery and Content Distribution

Estimated downtime: 3 days

No confirmed data exfiltration reported at time of publication. However, successful exploitation of this out-of-bounds write vulnerability could expose application memory contents including session tokens, cryptographic keys, PII processed in-memory by web applications, and internal service credentials. Applications using ASP.NET Core request decompression or HttpClient response decompression with Brotli enabled are at highest risk of memory leakage leading to sensitive data disclosure.

Key Takeaways & Steps

• Apply Microsoft's emergency OOB patches for .NET 8, 9, 10, and 11 RC3 immediately; audit all application deployments for bundled Brotli libraries that are not addressed by OS-level updates, and use the CNSF Cloud Firewall (ACF) or inline proxy to block incoming Brotli-compressed requests at the network edge for any workloads that cannot be patched immediately.

• Deploy Inline IPS (Suricata) with updated signatures for CVE-2026-111497 exploit traffic patterns to detect and block maliciously crafted Brotli-compressed streams before they reach vulnerable .NET application endpoints, reducing the Initial Compromise attack surface.

• Enforce Zero Trust Segmentation with identity-based microsegmentation policies to restrict workload-to-workload trust and prevent lateral movement from any compromised .NET service; apply least-privilege access controls so that a single compromised workload cannot reach adjacent cloud services or retrieve cloud metadata credentials.

• Activate Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls on all cloud workloads running .NET applications to prevent established C2 communications and unauthorized data exfiltration to attacker-controlled destinations following a successful exploit.

• Enable Multicloud Visibility & Control to baseline normal traffic patterns for .NET application workloads and generate alerts on anomalous HTTP/2 Brotli traffic volumes, unexpected outbound connections, or suspicious privilege escalation events, ensuring rapid detection and response if exploitation occurs before patching is complete.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.