CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Microsoft PowerShell

product · product:microsoft-powershell single-source

Coverage
1
first 2026-10-26 → last 2026-11-13
Latest activity
2026-11-13
Microsoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
11
7 hosts

Action items (1)

Do-now tasks recorded on the entries about Microsoft PowerShell, newest first. Check the date before acting on an older one.

  • Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime; install the November 2026 Windows cumulative update of each branch (KB5131096, KB5131085, KB5131090, KB5131080, KB5131087, KB5132061 or KB5132059) on every Windows endpoint and server, because Microsoft's record now lists Windows as affected and CISA lists the flaw as exploited.
    2026-10-26CVE-2026-111497 +3

Defender insights

What each entry about Microsoft PowerShell tells a defender to do, newest first.

2026-10-26NOTABLEexploitedMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw

Exposure · detection

Story timeline

  1. 2026-10-26CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)
    trending-vulnerabilitiesMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw

Hunting pivots

CVEs (exploited first)
CVE-2026-111497CVE-2026-102870CVE-2026-114148CVE-2026-70197
Releases covered
Microsoft PowerShell
Tags
actively-exploitedcisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionExploitation for Client Execution
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Entries about Microsoft PowerShell (1)

2026-10-26 · view entry permalink →

NOTABLECVE-2026-111497 +3exploitedupdatedNATOA2

CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 (.NET Blog, 2026-10-25). .NET Framework is not affected (.NET Blog, 2026-10-25). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege (.NET Blog, 2026-10-25); Microsoft scores it CVSS 3.1 8.1, marked it publicly disclosed and not exploited on 2026-10-25, and rates it Exploitation More Likely (MSRC, 2026-10-25). Node.js fixed the same CVE on 2026-10-21 (Node.js project, 2026-10-21). Microsoft says an application is exposed only if it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default (dotnet/announcements #494, 2026-10-25).

The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 (.NET Blog, 2026-10-25). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) (dotnet/runtime #136445, 2026-10-25); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely (MSRC, 2026-10-25). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute (dotnet/announcements #492, 2026-10-25). CVE-2026-114148 is a local privilege escalation through incorrect file ownership in Linux tarballs (CVSS 3.1 7.8), affecting ASP.NET Core tarballs of .NET 8 and 9 and source-built tarballs of .NET 8 to 11 (dotnet/announcements #495, 2026-10-25). No source reports an attack on .NET, but CISA lists CVE-2026-111497 as exploited since 2026-10-27 (CISA, 2026-10-27).

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3.

because the October 13, 2026 release did not fully address these issues

.NET Blog (Microsoft) 2026-10-25

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations.

Microsoft (dotnet/announcements, CVE-2026-111497 advisory) 2026-10-25

based on evidence of active exploitation

CISA (alert, KEV additions) 2026-10-27

Updated the Security Updates table to include affected Windows versions and the applicable November 2026 security updates.

Microsoft Security Response Center (record revision 7) 2026-11-12
Updaterun 2026-10-28T0256Z-intelsummarytagscvessourcesevidencesourcing_notebody

CISA added CVE-2026-111497, the Brotli decoder flaw this release fixes for .NET, to its Known Exploited Vulnerabilities catalog on 2026-10-27 "based on evidence of active exploitation", without describing the evidence (CISA, 2026-10-27). ELLIO's sensors recorded exploit traffic against Node.js 24.22.0 on 2026-10-26 (ELLIO, 2026-10-26); no source reports an attack on .NET, and Microsoft's own record marked the flaw not exploited on 2026-10-25 (MSRC, 2026-10-25).

Correctionrun 2026-11-01T1312Z-auditbodycvessources

For CVE-2026-114148, the incorrect file ownership in Linux tarballs, Microsoft's advisory names the fixed packages as the ASP.NET Core 8 and 9 runtime and targeting-pack tarballs 8.0.33 and 9.0.22 and, for source-built Linux distributions, SDK releases 8.0.133, 9.0.123, 10.0.114, 10.0.403 and 11.0.100-rc.3; it lists no 10.0.14 or 11.0.0-rc.3 fix for this flaw (dotnet/announcements #495, 2026-10-25). JFrog reproduced a .NET runtime crash through Brotli decompression, the process-crash signal the Detection line names (JFrog, 2026-10-25).

Updaterun 2026-11-13T0256Z-intelsummarycvesactionssourcesevidencesourcing_notebodyaffected_products

Microsoft's record for CVE-2026-111497, revised on 2026-11-12, now lists Windows as affected: the revision note says it updated the Security Updates table to include affected Windows versions and the applicable November 2026 security updates (Microsoft Security Response Center, 2026-11-12). The fixes are the November 2026 cumulative updates, KB5131096 for Windows 10 21H2 and 22H2, KB5131085 for Windows 10 1809 and Server 2019, KB5131090 for Server 2022, KB5131080, or the earlier KB5131077, for Server 2025, KB5131087 for Windows 11 23H2, KB5132061, or the earlier KB5132043, for Windows 11 24H2, 25H2 and 26H2 and KB5132059 for Windows 11 26H1, and the record still marks the flaw not exploited although CISA lists it (Microsoft Security Response Center, 2026-11-12). The record names no Windows component, and it also lists PowerShell 7.4 to 7.6 and Visual Studio 2017 to 2026 as affected (Microsoft Security Response Center, 2026-11-12).

Builds on: Node2Shell Brotli flaw is now on CISA KEV, with exploit traffic seen against Node.js 24.22.0…

vulnerability26 Oct 03:36Zsingle-sourceOpen finding →
Sources: .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory) · Microsoft (dotnet/runtime, CVE-2026-70197 advisory) · Microsoft (dotnet/announcements, CVE-2026-102870 advisory) · Microsoft (dotnet/announcements, CVE-2026-114148 advisory) · Microsoft Security Response Center (CVE-2026-111497) · Microsoft Security Response Center (CVE-2026-70197) · Node.js project · CISA (alert, KEV additions) · ELLIO Threat Research Lab · JFrog Security Research · Microsoft Security Response Center (record revision 7)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com4 (36%)
  • msrc.microsoft.com2 (18%)
  • cisa.gov1 (9%)
  • devblogs.microsoft.com1 (9%)
  • ellio.tech1 (9%)
  • nodejs.org1 (9%)
  • research.jfrog.com1 (9%)
All cited sources (11)