CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ASP.NET Core Blazor WebAssembly debugger code execution (CVSS 3.1 8.8, user interaction): the 2026-10-13 release did not fully address it; standalone Server and DevServer packages 10.0.14 and 11.0.0-rc.3 carry the fix

cve · CVE-2026-102870 single-source

Coverage
1
first 2026-10-26 → last 2026-10-26
Latest activity
2026-10-26
Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
8
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-102870, newest first. Check the date before acting on an older one.

  • Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime.
    2026-10-26CVE-2026-111497 +3

Defender insights

What each entry about CVE-2026-102870 tells a defender to do, newest first.

2026-10-26NOTABLEMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw

Exposure · detection

Story timeline

  1. 2026-10-26CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)
    trending-vulnerabilitiesMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw

Hunting pivots

Affected products
Microsoft .NETMicrosoft ASP.NET CoreMicrosoft Visual Studio
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionExploitation for Client Execution
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Entries about ASP.NET Core Blazor WebAssembly debugger code execution (CVSS 3.1 8.8, user interaction): the 2026-10-13 release did not fully address it; standalone Server and DevServer packages 10.0.14 and 11.0.0-rc.3 carry the fix (1)

2026-10-26 · view entry permalink →

NOTABLECVE-2026-111497 +3NATOA2

CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 (.NET Blog, 2026-10-25). The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected (.NET Blog, 2026-10-25). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege (.NET Blog, 2026-10-25); Microsoft scores it CVSS 3.1 8.1 with high attack complexity, marks it publicly disclosed and not exploited, and rates it Exploitation More Likely (MSRC, 2026-10-25). The CVE is the one Node.js fixed on 2026-10-21 (Node.js project, 2026-10-21). Microsoft says an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default (dotnet/announcements #494, 2026-10-25).

The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 (.NET Blog, 2026-10-25). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) (dotnet/runtime #136445, 2026-10-25); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely, and had said on 2026-10-19 that the vulnerability had not been addressed (MSRC, 2026-10-25). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute (dotnet/announcements #492, 2026-10-25). CVE-2026-114148 is incorrect file ownership in Linux ASP.NET Core runtime and targeting-pack tarballs of .NET 8 and 9 and in source-built tarballs, a local privilege escalation (CVSS 3.1 7.8) (dotnet/announcements #495, 2026-10-25). No source reports exploitation of any of the four.

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3.

because the October 13, 2026 release did not fully address these issues

.NET Blog (Microsoft) 2026-10-25

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations.

Microsoft (dotnet/announcements, CVE-2026-111497 advisory) 2026-10-25

Builds on: Node2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli…

vulnerability26 Oct 03:36Zsingle-sourceOpen finding →
Sources: .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory) · Microsoft (dotnet/runtime, CVE-2026-70197 advisory) · Microsoft (dotnet/announcements, CVE-2026-102870 advisory) · Microsoft (dotnet/announcements, CVE-2026-114148 advisory) · Microsoft Security Response Center (CVE-2026-111497) · Microsoft Security Response Center (CVE-2026-70197) · Node.js project

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com4 (50%)
  • msrc.microsoft.com2 (25%)
  • devblogs.microsoft.com1 (12%)
  • nodejs.org1 (12%)

External references

NVD · cve.org · CISA KEV

All cited sources (8)