Microsoft released urgent security updates on Oct. 25 for two vulnerabilities affecting .NET, PowerShell, and Visual Studio. These updates are part of a special security advisory that Microsoft released outside of its normal monthly cycle of security bulletins. Pitt Digital recommends installing these updates on all affected systems as soon as possible.
What Microsoft Fixed
CVE-2026-111497 is a critical vulnerability in the Brotli decoder, an open-source compression library maintained by Google. Any software that includes its own copy of the decoder can be affected, including Node.js and .NET. Proof-of-concept code is publicly available, and Microsoft rates exploitation as more likely. Microsoft reports no known exploits at this time.
CVE-2026-114148 is an important vulnerability in ASP.NET Core. An attacker needs local access to exploit it, and Microsoft rates exploitation as less likely.
Affected Software
CVE-2026-111497:
• .NET 8.0, 9.0, 10.0, and 11.0
• PowerShell 7.4, 7.5, and 7.6
• Visual Studio 2019, 2022, and 2026
CVE-2026-114148:
• .NET 8.0, 9.0, 10.0, and 11.0
• ASP.NET Core runtime
What You Can Do
• Be sure Microsoft’s Automatic Updates feature is enabled; individual workstations will automatically install necessary updates.
• Systems that are not part of Pitt Digital’s Updates and Encryption program should update affected .NET, PowerShell, and Visual Studio installations as soon as possible, if you have not done so already.
• Check applications your department develops or hosts. Software that bundles its own Brotli decoder, including Node.js, needs a vendor update. The Node.js project released fixes on Oct. 21.
• Share this notice within your department so owners of affected systems can act quickly.
Questions or need help with the update process? Please submit a ticket to the Technology Help Desk or call +1-412-624-HELP (4357).
