What happened
On October 25, 2026, Microsoft released out-of-band security updates for .NET 8, .NET 9, .NET 10 and .NET 11 Release Candidate 3. Fixed runtime versions are .NET 8.0.33, .NET 9.0.22 and .NET 10.0.14. CVE-2026-111497 is a Brotli decoder buffer overflow that can expose or corrupt process memory when affected applications process crafted compressed data. Microsoft said request decompression and automatic response decompression are not enabled by default.
The out-of-band release also fixes CVE-2026-114148 and re-releases fixes for CVE-2026-70197 and CVE-2026-102870 because the October 13 release did not fully address them. Framework-dependent applications need the updated runtime and a restart; self-contained applications and containers must be rebuilt and redeployed. On October 26, 2026, Azure said updated built-in .NET runtimes were rolling out to App Service for Windows and the rollout was not complete. On October 26, 2026, Azure said .NET updates for Azure Functions on Linux and Windows-dependent plans were still in progress. Attribution posture: no threat actor is attributed, and Microsoft did not report active exploitation in the cited guidance. The cited source did not publish the specific operational detail described as Exploitation evidence.
Why this matters now
The out-of-band release changes the normal monthly patch assumption. Two earlier fixes were incomplete, and the primary Brotli issue can affect multiple application paths. Teams that closed the October maintenance cycle need to reopen it, identify deployment mode and verify artefact-level remediation rather than relying on operating-system or host-runtime status.
Cloud hosting reduces some patching work but does not remove ownership. Azure said managed rollout was still in progress, and application teams remain responsible for self-contained deployments, containers, dependencies and restart or redeployment requirements. The leadership decision is therefore how to prioritise exposure while provider rollout, application rebuilding and regression testing proceed at different speeds.
The decision for security leaders
Reopen closure for the October .NET patch cycle. Asset owners must classify each workload as framework-dependent, self-contained, containerised, source-built or provider-managed because each mode has a different remediation path and different evidence.
Prioritise applications that accept or retrieve untrusted Brotli-compressed content, especially internet-facing services and shared platforms. Default-disabled decompression reduces exposure for some workloads but is not a substitute for checking actual application configuration and code paths.
Require artefact-level proof. A patched host does not change a runtime embedded inside a self-contained binary or container image. Closure should reference rebuilt artefact versions, deployment identifiers and runtime verification from the running workload.
Evidence of closure
- Runtime inventory shows fixed versions on framework-dependent hosts.
- Build attestation lists every rebuilt self-contained deployment.
- Azure workload evidence confirms the updated managed runtime.
- Regression testing validates the re-released security fixes.
The Security.io assessment
The cited sources did not report active exploitation of CVE-2026-111497. That supports risk-based sequencing rather than indiscriminate emergency shutdown, but the out-of-band cadence and incomplete earlier fixes justify expedited verification for exposed services.
The most common closure error will be equating host runtime patching with application remediation. Organisations with mature software inventories should still expect blind spots in containers, developer-built binaries, functions and vendor applications carrying their own runtime.
Azure’s rollout reduces customer action for some managed configurations, but incomplete rollout means security teams need temporary visibility into which workloads have received the fixed runtime. Provider-managed should be treated as a deployment mode requiring evidence, not as an automatic closure state.
Questions for the morning meeting
- NET workloads are framework-dependent, self-contained, containerised or provider-managed?
- Which internet-facing applications process Brotli-compressed data through affected APIs?
- Can deployment evidence prove that rebuilt artefacts contain the fixed runtime rather than only a patched host?