“When vulnerabilities like CVE-2026-111497 are left unpatched, an attacker exploiting this chain can start with memory corruption inside a vulnerable .NET process, escalate privileges against the service account running it, and inherit whatever reach that account has.” — Seemant Sehgal, Founder & CEO at BreachLock
Immediate risk: CVE-2026-111497 and CVE-2026-114148
On Sunday, Microsoft released emergency, out-of-band .NET updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3 and urged organizations to patch “as soon as possible.” The updates address two vulnerabilities named in Microsoft’s advisory: CVE-2026-111497 and CVE-2026-114148.
The first, CVE-2026-111497, is a flaw in .NET’s use of the Brotli decompression algorithm. According to the advisory, the flaw can allow an unauthenticated actor to read or corrupt process memory, creating the potential for data disclosure, denial-of-service, or privilege elevation. The second, CVE-2026-114148, concerns unsafe ownership metadata in .NET tarballs and could allow an actor to change files and obtain elevated privileges.
Microsoft’s notice also makes clear that organizations that patched correctly on October 13 are still not exempt from needing this emergency update.
Missing fixes from the October 13 advisory: CVE-2026-70197 and CVE-2026-102870
Experts cited in the advisory say two fixes disclosed on October 13 did not make it into that release. Denis Calderone, Principal / CTO at Suzu Labs, explains that CVE-2026-70197 — an unauthenticated out-of-bounds write in the socket layer tied to SocketAsyncEventArgs memory corruption — was disclosed on October 13 but “never made it into that release.” Calderone also says the Blazor WebAssembly debugger fix, CVE-2026-102870, “shipped with a packaging error that kept the corrected component from reaching machines.”
Calderone framed the operational consequence plainly: teams relying on a patch report dated October 13 “have been carrying a false green light for almost two weeks,” and a simple version check would not have detected the omission because deployments “on paper” looked current.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperational impact on self-contained applications and containers
Calderone underscores a concrete operational gap: self-contained applications and containers bundle the .NET runtime inside the artifact. He notes that “installing the October 25 update on the host changes nothing for them.” That means organizations must not only update runtimes on hosts but also rebuild and redeploy every self-contained application and container that embeds a vulnerable runtime.
Calderone’s remediation checklist in the advisory is direct: update the runtimes, rebuild and redeploy every self-contained application and container, and update the Blazor NuGet packages directly instead of relying on the shared runtime. For environments that cannot rebuild immediately, he offers a configuration workaround for the Brotli exposure: Brotli decompression is off by default, so disable it where it was enabled — remove ‘br’ from request decompression and drop Brotli from HttpClient automatic decompression — as a temporary bridge until rebuilds land.
Context: a month of disclosures and PHP2Shell
The emergency .NET patches arrive amid a broader month of notable vulnerability disclosures. The advisory references recent critical PHP vulnerabilities labeled PHP2Shell and reports that PHP2Shell is being exploited in the wild. John Strand, Owner of Black Hills Information Security, commented on the cadence: “This story almost feels like Microsoft saw the PHP vulnerabilities, looked around, said, ‘Hold my beer,’ and handed us these .NET vulnerabilities.” Strand added that these .NET issues appear to affect a large section of websites that the PHP vulnerabilities missed.
How technologists and security teams, affected enterprises and procurement leaders, and developers should respond
- Technologists and security teams: apply Microsoft’s emergency updates for .NET 8–11 RC3 immediately, confirm that the runtime versions actually running in production match the patched code (not just ticketed versions), and, for anything that cannot be rebuilt this week, implement the Brotli configuration workaround described above.
- Affected enterprises and procurement leaders: inventory which applications are self-contained versus framework-dependent and where they run; Calderone warns that many organizations lack that list and that gap turns a one-day emergency patch into a multi-week project. Seemant Sehgal’s caution that service accounts “typically grant those accounts more reach than they need” underscores the need to review account privileges as part of remediation.
- Developers and operations owners of containers and self-contained apps: rebuild and redeploy artifacts that bundle the .NET runtime and update Blazor NuGet packages directly rather than relying solely on a shared runtime update.
The practical lesson from the advisory is stark: when vendor release notes are incomplete or packaging errors prevent fixes from reaching machines, verification must go beyond a version number on paper. As Denis Calderone puts it, “When the vendor’s release notes are the source of truth and the source of truth was wrong, verification has to mean more than a version number.”
https://www.securitymagazine.com/articles/102699-microsoft-releases-emergency-net-patches
