Skip to content
.NET Vulnerability CVE-2026-111497 Requires Immediate Action

.NET Vulnerability CVE-2026-111497 Requires Immediate Action

First seen 26 Oct 2026, 03:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 04:43 UTC
  • •CVE-2026-111497 is a critical vulnerability in .NET affecting versions 8 to 11.
  • •Attackers can exploit this flaw to elevate privileges if Brotli decompression is used.
  • •Immediate updates are recommended to mitigate the risk from this vulnerability.

On October 25, 2026, Microsoft released out-of-band security updates for.NET addressing CVE-2026-111497, a vulnerability in the Brotli decompression algorithm that allows unauthorized attackers to elevate privileges over a network. The flaw affects.NET versions 8, 9, 10, and 11, particularly in applications that process Brotli-compressed data through ASP.NET Core or HttpClient. Notably, Brotli decompression is not enabled by default, meaning applications must opt-in to be affected. The updates also include fixes for CVE-2026-114148 and re-releases for CVE-2026-70197 and CVE-2026-102870. Users are urged to update their applications and build environments immediately to mitigate risks. The vulnerability was publicly disclosed on October 22, 2026, with a CVSS score of 9.2, indicating its nature.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-13
CVE-2026-102870 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
CVE-2026-70197 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-111497 publicly disclosed
A critical out-of-bounds write vulnerability in .NET was disclosed, allowing privilege escalation.
Api.Msrc.Microsoft
2026-10-25
Out-of-band updates released
Microsoft released updates for .NET 8, 9, 10, and 11 to address CVE-2026-111497 and other vulnerabilities.
Devblogs.Microsoft

More articles in this cluster (3)

Following this threat?

Track CVE-2026-102870 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

Which .NET versions are affected?
The vulnerability affects .NET versions 8, 9, 10, and 11.
What is the severity of CVE-2026-111497?
CVE-2026-111497 has a CVSS score of 9.2, indicating it is critical.
How should we respond to this vulnerability?
Update your applications and build environments immediately to the latest .NET versions.