Microsoft has released out-of-band .NET security updates affecting .NET 8, .NET 9, .NET 10 and Release Candidate 3 of .NET 11. This is not the usual monthly patch: when the vendor breaks its own schedule and recommends updating "as soon as possible", it is worth listening. If your company has custom applications, a customer portal, an integration API with the ERP or an internal app built on .NET, this concerns you directly.
In this article we summarise what has been published, why it matters for a private company that depends on its own software and, above all, what practical steps to take this week. The original source is Microsoft’s official .NET blog: ".NET October 2026 Out-of-Band Security Updates" (devblogs.microsoft.com/dotnet).
What Microsoft has published
According to the official advisory, the release fixes two new vulnerabilities and re-issues two others that had not been completely resolved in the 13 October 2026 delivery.
- CVE-2026-111497 — Brotli. A buffer overflow in .NET’s use of the Brotli decompression algorithm. It may allow an unauthenticated attacker to read or corrupt process memory, with a risk of information disclosure, denial of service or elevation of privilege. It affects all platforms.
- CVE-2026-114148 — file ownership in Linux tarballs. Insecure ownership metadata in certain
.tarpackages that could allow a local attacker to modify files and escalate privileges. Linux only. - CVE-2026-70197 (memory corruption in
SocketAsyncEventArgs) and CVE-2026-102870 (Blazor WebAssembly debugger) are being re-published because the previous delivery did not fully fix them.
Two important nuances from the advisory. First: .NET Framework is not affected. Second: the paths most exposed to Brotli —request decompression in ASP.NET Core and automatic response decompression in HttpClient— are not enabled by default. The fact that it is not enabled by default does not mean you have not enabled it: you have to check, not assume.
Why these .NET security updates affect your business
A decompression vulnerability sounds very technical, but the risk is quickly understood in business terms: the attacker does not need credentials, it is enough to send manipulated compressed data to a service that processes it. If that service is your order portal, your integration gateway with suppliers or the API that feeds your mobile application, the impact ranges from service outage to data exposure.
The pattern we see time and again is not a lack of intent, but a lack of inventory. Many companies know which ERP they have, but they do not know precisely how many of their own applications are in production, which .NET version they run on and who is responsible for updating them. When a notice like this arrives, days are lost just finding out. And in security, days count.
Where your runtime actually lives (what is most often forgotten)
Here is the detail that usually leaves systems unpatched. Updating does not mean the same thing in every scenario:
Framework-dependent applications
Install the updated runtime for the version your application uses and restart. This is the simplest case.
Self-contained applications
Updating the server is not enough: these applications carry their own embedded runtime. They have to be recompiled and republished with the fixed runtime. If you only update the machine, you will still be running vulnerable code.
Containers
You have to rebuild and redeploy using the updated .NET images. An image built last week will still carry the old runtime.
Linux: tarballs and source-build
For .NET 10 and .NET 11, the ownership issue only affects source-build tarballs. For .NET 8 and .NET 9 it also affects ASP.NET Core distributions obtained via tarball, even if you do not build .NET from source. This is an easy scenario to overlook on legacy servers.
The fixed versions released are 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3 (anyone on RC2 should move to RC3). To see what you have installed on a machine, the usual command:
dotnet --list-runtimes
Remember that self-contained applications and containers will not appear there: they are reviewed separately.
Five-step action plan
- Take inventory. List your own applications in production, .NET version, deployment model (framework-dependent, self-contained, container) and the person responsible.
- Prioritise by exposure. First whatever receives traffic from the internet or from third parties: portals, public APIs, e-commerce, integrations with customers and suppliers.
- Check your use of Brotli. Review whether you have request decompression enabled in ASP.NET Core, automatic decompression in
HttpClientor direct use of theSystem.IO.CompressionAPIs. - Update and verify. Apply the fixed runtime, recompile self-contained apps, rebuild images and confirm the version after deployment. Go through a test environment first.
- Document. Record what was patched, when and who validated it. Next time it will take you hours instead of days.
From emergency patch to planned maintenance
Out-of-band releases will keep happening. The difference between a company that absorbs them without disruption and one that panics comes down to three things: a living inventory of its own software, a test environment where it can validate before touching production and a clear owner for each application’s lifecycle. None of this is exotic; it is basic hygiene, and it saves a lot of money on the day it is needed.
At Tisa we have been developing and maintaining custom applications for private companies since 1987 —retail, distribution, construction, food industry, services— as well as implementing Business Central and Power Platform. Within our custom development line we support the evolution and maintenance of the software you already have, and in basic cybersecurity we work on risk assessment and response plans so that a notice like this is a routine task and not an emergency.
Do you need help applying these .NET security updates?
If you are not clear about which .NET versions are running in your organisation, who maintains each application or how to validate that the patch has been properly applied, let’s talk. We carry out an initial assessment with no obligation and tell you frankly what is urgent and what can wait.
Write to us at info@grupotisa.com, call us on (+34) 971 305 885 or visit grupotisa.com.
Source: Microsoft, ".NET October 2026 Out-of-Band Security Updates", official .NET blog (devblogs.microsoft.com/dotnet). For full details of each CVE and the affected products, see the security advisories linked in the original publication.
