EN PT-BR
← Voltar ao feed
medium

CERT-FR: Multiple Microsoft .NET vulnerabilities allow privilege escalation (CVE-2026-111497, CVE-2026-114148)

1 fonte(s) · 1 atualização(ões) · publicado 25/10/2026 21:00 · coletado há 5 dias

CERT-FR published advisory CERTFR-2026-AVI-1382 on multiple vulnerabilities in Microsoft .NET, tracked as CVE-2026-111497 and CVE-2026-114148. According to the advisory, an attacker could exploit them to obtain privilege escalation. They affect .NET 8.0, 9.0, 10.0 and 11.0 on Windows, Linux and macOS, as well as source-build and ASP.NET Core Linux tarballs. The advisory is based on Microsoft MSRC bulletins dated 25 October 2026. It reports no active exploitation and gives no CVSS score or technical detail.

Entenda a falha

A vulnerabilidade

Two privilege escalation vulnerabilities, CVE-2026-111497 and CVE-2026-114148, affect Microsoft .NET. CERT-FR (advisory CERTFR-2026-AVI-1382), based on Microsoft MSRC bulletins of 25 October 2026, gives no CVSS score, no component, and no attacker prerequisites, so the severity order is unknown. Affected: .NET 8.0 before 8.0.427, 9.0 before 9.0.320, 10.0 before 10.0.403 and 11.0 before 11.0.100-rc.3 on Windows, Linux and macOS; source-build Linux tarballs before 10.0.403-servicing.26523.112; and Microsoft-published ASP.NET Core runtime and targeting-pack Linux tarballs before 9.0.22. Fixes are in the listed versions or later.

Como funciona

The available articles do not describe how the vulnerable process works. CERT-FR only states that an attacker could obtain privilege escalation and refers readers to the Microsoft bulletins for details. The input, the component involved and the step where it fails are not public in the material we have.

Por que é vulnerável

The articles do not state the root cause of either CVE, nor why the flaws went unnoticed or what the fixes change. The only known outcome is privilege escalation. Details, if any, must be sought in the Microsoft MSRC bulletins for each CVE.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 26 October 2026, drawing on Microsoft MSRC bulletins dated 25 October 2026 for each CVE. No active exploitation is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 13:22.

Detalhes técnicos

  • Impact: privilege escalation.
  • Affected versions (Windows, Linux and macOS): .NET 8.0 before 8.0.427, .NET 9.0 before 9.0.320, .NET 10.0 before 10.0.403, and .NET 11.0 before 11.0.100-rc.3 (build 11.0.100-rc.3.26522.148).
  • Also affected: .NET source-build Linux tarballs before 10.0.403-servicing.26523.112 and ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) before 9.0.22.
  • No IOCs, threat actors or exploitation details are provided.

Remediação

  • Apply the fixes described in the Microsoft security bulletins for CVE-2026-111497 and CVE-2026-114148, as CERT-FR directs.
  • Update to .NET 8.0.427, 9.0.320, 10.0.403 or 11.0.100-rc.3 or later.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR: Multiple Microsoft .NET vulnerabilities allow privilege escalation (CVE-2026-111497, CVE-2026-114148)

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1382 on multiple vulnerabilities in Microsoft .NET, tracked as CVE-2026-111497 and CVE-2026-114148. According to the advisory, an attacker could exploit them to obtain privilege escalation. They affect .NET 8.0, 9.0, 10.0 and 11.0 on Windows, Linux and macOS, as well as source-build and ASP.NET Core Linux tarballs. The advisory is based on Microsoft MSRC bulletins dated 25 October 2026. It reports no active exploitation and gives no CVSS score or technical detail.

    Technical Details

    • Impact: privilege escalation.
    • Affected versions (Windows, Linux and macOS): .NET 8.0 before 8.0.427, .NET 9.0 before 9.0.320, .NET 10.0 before 10.0.403, and .NET 11.0 before 11.0.100-rc.3 (build 11.0.100-rc.3.26522.148).
    • Also affected: .NET source-build Linux tarballs before 10.0.403-servicing.26523.112 and ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) before 9.0.22.
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in the Microsoft security bulletins for CVE-2026-111497 and CVE-2026-114148, as CERT-FR directs.
    • Update to .NET 8.0.427, 9.0.320, 10.0.403 or 11.0.100-rc.3 or later.