Microsoft’s October 25, 2026 advisory for CVE-2026-111497, a .NET Brotli flaw, rates it Critical with “Exploitation More Likely“. The release ships out-of-band security updates for .NET 8, 9, and 10.
The Essentials
- Microsoft rates CVE-2026-111497 Critical, with a CVSS score of 8.1. It is the only one of the four advisories in this release marked publicly disclosed.
- Microsoft’s table reads Exploited No, per MSRC. Brotli decompression is not enabled by default, so apps must opt in first.
- NVD published the upstream Google Brotli record on October 22, 2026, three days before the fix, per Microsoft’s dates.
- On October 19, six days after the first advisory, the CVE-2026-70197 log said the vulnerability had not been addressed, according to MSRC.
Microsoft rates the Brotli flaw Critical
Microsoft’s Security Update Guide scores CVE-2026-111497 at CVSS 8.1 and tags the maximum severity Critical. The vector string AV:N/AC:H/PR:N/UI:N reads as network-reachable, high complexity, no privileges, no user interaction. The advisory classifies the impact as Elevation of Privilege and the weakness as an out-of-bounds write.
For scale, Cybersecurity statistics by SQMagazine show that 61% of organizations reported cloud disruptions linked to unpatched systems or misconfigured services. That figure lumps both causes together.
The exploitability table reads Publicly disclosed Yes and Exploited No, with an assessment of Exploitation More Likely. The advisories for CVE-2026-70197, CVE-2026-102870 and CVE-2026-114148 each read Publicly disclosed No and Exploitation Less Likely. Nothing in the pages reviewed reports attacks in the wild.
Exposure depends on opt-in. The advisory’s mitigation note says Applications must manually opt in to ASP.NET Core request decompression or HttpClient response decompression. Apps can also invoke the Brotli APIs by hand. The blog adds that .NET Framework is not affected.
Microsoft rates .NET Brotli flaw CVE-2026-111497 Critical (CVSS 8.1): publicly disclosed, "Exploitation More Likely," not yet exploited. Update to 8.0.33, 9.0.22, 10.0.14 or .NET 11 RC3. The Oct 13 fix fell short on two other CVEs. Patch again. https://t.co/MD6Jv9FJNo
— SQ Magazine (@sqmagazine_news) October 26, 2026
The blog post lists impacts but no severity score, no disclosure flag and no exploitation rating. Those fields, more than the score, set this advisory apart from the other three.
Google’s library bug reached NVD three days earlier
The CVE traces back to Google’s Brotli library. MSRC lists Google as the assigning CNA (CVE Numbering Authority), and NVD’s entry for CVE-2026-111497 records Google Brotli versions 1.0.3 through 1.2.0 as affected. NVD published it on Oct 22, 2026, three days before Microsoft’s Oct 25 release.
NVD’s repair scope is wider than .NET. It tells users to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to 1.0.10, 1.1.1 or 1.2.1. NVD’s own assessment had not yet been provided when the page was read on October 26.
The blog describes only “a vulnerability in the Brotli decompression algorithm” and never names Google. A .NET patch does not clear other products that bundle an affected Brotli copy.
Patching on October 13 left two advisories open
MSRC’s revision log for CVE-2026-70197 runs from version 1.0 on Oct 13, 2026 to version 2.1 on Oct 25, 2026. That log lists five versions in 12 days. Three of the four later versions were informational changes only. The substantive one came on Oct 19: Microsoft is aware that the vulnerability for which this CVE was assigned has not been addressed.
Both earlier advisories are remote code execution flaws rated Important: CVE-2026-70197 scores 8.1 and CVE-2026-102870 scores 8.8. The blog says the October 13, 2026 release did not fully address these issues. The CVE-2026-102870 log records only an informational table update on Oct 25. That log never states the earlier fix fell short, so a team that patched on October 13 could miss the gap.
The Linux tarball flaw, CVE-2026-114148, is rated Important at 7.8, with Exploitation Less Likely. For .NET 8 and .NET 9, it also affects ASP.NET Core distributions obtained through ASP.NET Core tarballs.
What’s Next?
The fixed builds are 8.0.33, 9.0.22, 10.0.14 and .NET 11 Release Candidate 3. Self-contained applications need a rebuild and republish with the updated runtime, and containers need a rebuild and redeploy using updated .NET container images. .NET 11 RC2 users should update to RC3 to receive these fixes.
You can check the runtimes installed on a machine with dotnet –list-runtimes. That command covers only framework-dependent hosts. Self-contained applications and container deployments must be checked separately because they carry their own runtime.
