Security Updates for.NET Versions 8, 9, and 10 Address
Article Content
- •Critical CVE-2026-111497 affects .NET versions 8, 9, and 10.
- •Updates released on November 3, 2026, to mitigate active exploitation.
- •CISA confirmed active exploitation of the vulnerability on October 27, 2026.
On November 3, 2026, Microsoft released out-of-band security updates for.NET versions 8.0.33, 9.0.22, and 10.0.14 to address CVE-2026-111497, a vulnerability in the Brotli library that allows for out-of-bounds writes. This vulnerability has a CVSS score of 9.2 and is in the wild, as confirmed by CISA on October 27, 2026. Additionally, the updates also fix CVE-2026-114148, which concerns Linux.NET tarball ownership. Affected systems include all applications utilizing the Brotli decoder in.NET and ASP.NET Core. Users are urged to apply these updates immediately to mitigate potential denial of service, information disclosure, or elevation of privilege risks. The updates are available for download from the official.NET releases page.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (6)
Following this threat?
Track Microsoft and CVE-2026-111497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which .NET versions are affected?
Is CVE-2026-111497 actively exploited?
What should I do to protect my systems?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…