Microsoft has released emergency security updates for .NET outside its normal monthly patching schedule and is telling affected customers to update as soon as possible.
The main issue, CVE-2026-111497, affects the way some .NET applications handle Brotli-compressed data. In certain situations, specially crafted data could cause an application to crash, expose information or allow an attacker to gain greater privileges.
For most business users, this is not something you need to fix yourself. The important question is whether any of the applications, web services or servers your business relies on use an affected version of .NET.
Does this affect every Windows computer?
No. This is not a general Windows vulnerability that automatically affects every PC simply because Windows is installed.
The issue affects applications using affected versions of modern .NET and an affected Brotli decoder. Microsoft says .NET Framework is not affected.
That distinction matters because many users will never knowingly interact with .NET at all. It often sits underneath business software, web applications and server-based systems rather than being something employees open directly.
What is .NET and why should a business care?
.NET is a Microsoft development platform used to build and run many different types of software.
A business may depend on .NET without staff being aware of it. It can be used behind:
- line-of-business applications
- customer or staff web portals
- server-based applications
- bespoke internal software
- APIs and web services
- applications supplied by third-party software vendors
So the practical issue for most organisations is not “do our users have .NET?”, but rather “do any of the systems we depend on use an affected .NET runtime?”
Not sure whether your business applications are affected?
KES can review your managed servers and business applications, check installed .NET runtimes and work with software suppliers where an application needs to be updated or redeployed.
What is the security problem?
The vulnerability is tracked as CVE-2026-111497 and involves the Brotli decompression library used by .NET and ASP.NET Core.
Microsoft says maliciously crafted compressed data could allow an unauthenticated attacker to read or corrupt application memory. Depending on the circumstances, that could result in:
- an application or service crashing
- information being exposed
- an attacker gaining elevated privileges
Not every .NET application is automatically exposed. Microsoft says applications are affected when they use an affected Brotli decoder to process attacker-controlled data.
Which .NET versions have been fixed?
Microsoft released the out-of-band updates on 25 October 2026.
The fixed runtime versions include:
- .NET 8.0.33
- .NET 9.0.22
- .NET 10.0.14
- .NET 11 Release Candidate 3
Microsoft recommends updating affected installations as soon as possible.
What if we already installed the October security updates?
This is one of the more important parts of Microsoft's announcement.
Microsoft says customers using affected products should apply the new out-of-band update even if they already installed the 13 October 2026 security update.
The emergency release also includes corrected fixes for earlier October issues where the original update did not fully address the vulnerability.
So an organisation that patched earlier in October should not assume it is automatically covered by the latest .NET fixes.
Do users need to install anything themselves?
Usually, no.
In a managed business environment, .NET updates should normally be handled by IT, a software supplier or whoever manages the server or application.
Different types of .NET application also need different treatment. Some can be protected by installing the updated runtime on the server, while self-contained applications may include their own copy of .NET and therefore need to be rebuilt or updated by the application supplier.
If you use specialist business software, the safest approach is to check with the vendor or your IT provider rather than attempting to update application components manually.
What should businesses check now?
For most small and medium-sized businesses, the practical checklist is:
- Ask whoever manages your servers whether affected .NET runtimes are installed.
- Check important line-of-business applications with their supplier where appropriate.
- Do not assume the 13 October update is enough.
- Apply the latest .NET security update promptly where an affected runtime is in use.
- Restart affected applications or services after the runtime update where required.
- Remember self-contained applications separately because updating the server runtime alone may not update the copy bundled inside the application.
Users should continue working normally unless their IT provider or software supplier tells them otherwise.
Quick answers
Why did Microsoft release an emergency .NET update?
Microsoft released an out-of-band security update to fix CVE-2026-111497 and other .NET issues without waiting for the next normal monthly servicing cycle.
Is every Windows PC vulnerable?
No. The vulnerability affects certain applications using affected modern .NET runtimes and Brotli decompression. .NET Framework is not affected.
Could our business software use .NET?
Yes. Many line-of-business applications, web services and server systems are built using .NET, even if end users never see it directly.
Do I need to update .NET myself?
Most business users should not need to. Your IT provider, server administrator or application supplier should determine whether an affected runtime or bundled application needs updating.
What if our systems were patched earlier in October?
Microsoft says affected customers should install the new out-of-band update even if the 13 October security update was already installed.
Sources
