A green runtime patch report can still leave vulnerable application packages deployed. The November .NET advisories make that distinction concrete for application packages and the runtime each service loads.
What is new
Microsoft published CVE-2026-118747 and CVE-2026-114149 on November 10, 2026. Fresh MSRC data corrects the standalone System.Formats.Cbor 9.x fix to 9.0.24 and the standalone Microsoft.AspNetCore.WebUtilities 11.x fix to 11.0.0. Microsoft’s own repository advisories verify the complete package ranges and rebuild instructions. MSRC does not give a separate revision timestamp for those changed rows; no new exploitation is claimed.
CVE-2026-118747 concerns hash collisions in CBOR map-key uniqueness checks. Attacker-controlled input can cause excessive processing. CVE-2026-114149 concerns multipart form processing bypassing a configured header-count limit and consuming excessive resources. Check whether an application accepts relevant untrusted CBOR or multipart data; merely finding .NET installed does not establish a reachable attack path.
Microsoft rates both Important in MSRC; the maintainer advisories rate both High, CVSS 3.1 7.5. MSRC reports no public disclosure or known exploitation and assesses exploitation Less Likely. Neither appears in the checked CISA KEV catalog, so no federal KEV deadline applies. Suggested MSP priority: expedited for exposed applications that process the relevant untrusted data.
Affected and fixed versions
These vulnerabilities cover supported Windows, Linux and macOS deployments across the architectures listed in the maintainer advisories. System.Formats.Cbor is independently versioned: 9.0.23 is not its fix. Microsoft also documents System.Formats.Cbor 10.0.15, which has a net9.0 target, as an alternative for 9.0 applications. Select a supported dependency path with the application owner.
| Component and CVE | Affected versions | Fixed versions by branch |
|---|---|---|
| System.Formats.Cbor / CVE-2026-118747 | >=8.0.0-0, <8.0.2; >=9.0.0-0, <9.0.24; >=10.0.0-0, <10.0.15; >=11.0.0-0, <11.0.0 | 8.0.2 / 9.0.24 / 10.0.15 / 11.0.0 |
| WebUtilities / CVE-2026-114149 | >=8.0.0-preview.5.23302.2, <=8.0.33; >=9.0.0-preview.1.24081.5, <=9.0.22; >=10.0.0-preview.1.25120.3, <=10.0.14; >=11.0.0-preview.1.26104.118, <=11.0.0-rc.3.26522.148 | 8.0.34 / 9.0.23 / 10.0.15 / 11.0.0 |
| ASP NET Core runtime packages / CVE-2026-114149 | >=8.0.0-preview.1.23112.2, <=8.0.33; >=9.0.0-preview.1.24081.5, <=9.0.22; >=10.0.0-preview.1.25120.3, <=10.0.14; >=11.0.0-preview.1.26104.118, <=11.0.0-rc.3.26522.148 | 8.0.34 / 9.0.23 / 10.0.15 / 11.0.0 |
For CVE-2026-114149, the runtime package family is Microsoft.AspNetCore.App.Runtime for the relevant Windows, Linux, musl Linux or macOS architecture. Independently referenced Microsoft.AspNetCore.WebUtilities must also be updated. The normal runtime updates are mapped by MSRC to KB5135243 (8.0.34), KB5135242 (9.0.23) and KB5135241 (10.0.15); 11.0.0 uses its release download. A runtime fix and a standalone package fix are separate deployment checks.
What changed on November 11
The November MSRC data now explicitly includes macOS for CVE-2026-109475 alongside Linux. Microsoft originally published the issue November 10 and does not date the platform row change separately. A reachable managed HttpListener on an affected runtime can suffer unauthenticated denial of service. Microsoft’s maintainer advisory lists Linux and macOS across the affected architectures. MSRC rates it Important and the maintainer advisory rates it High, CVSS 3.1 7.5. MSRC reports no public disclosure or known exploitation and assesses exploitation Less Likely. The CVE is absent from the checked CISA KEV catalog.
For Microsoft.NETCore.App.Runtime packages on Linux, musl Linux and macOS, affected ranges and corresponding first fixes are 8.0.0-0–8.0.33 → 8.0.34, 9.0.0-0–9.0.22 → 9.0.23, 10.0.0-0–10.0.14 → 10.0.15, and 11.0.0-preview.1.26104.118–11.0.0-rc.3.26522.148 → 11.0.0. Use the platform-specific runtime or package listed by Microsoft.
Expedite exposed managed listeners. Identify the loaded runtime and reachable listener, restrict unnecessary access while patching, restart the service and verify that it loads the fixed runtime. Rebuild and redeploy self-contained apps and images before validating every replica. Microsoft gives no complete workaround or credential-rotation requirement for this issue.
Microsoft .NET HttpListener advisory · MSRC CVE-2026-109475
MSP action sequence
Inventory → reduce exposure where needed → update and rebuild → verify. Obtain application dependency manifests or SBOMs, resolved package versions and actual deployed runtime paths. Include IIS services, Azure-hosted applications, containers and self-contained deployments where used; do not assume any customer operates them. Identify which request paths process CBOR or multipart forms.
If an affected application is exposed, reduce unnecessary access and coordinate application-owner controls while patching. No vendor-certified complete workaround was verified; a proxy limit or restart alone is not evidence of remediation. Update each affected standalone package reference, rebuild and redeploy the application, including framework-dependent applications. Update the applicable shared runtime and restart applications. Rebuild and redeploy self-contained applications and affected container images; updating a machine-wide runtime does not replace their embedded runtime.
Verify resolved package versions in the deployed output, the runtime actually loaded by the service, replacement of every affected instance or replica, and normal upload or CBOR processing. An SDK update alone does not update standalone package references. No blanket credential rotation or vendor-directed incident-response procedure was verified for either issue.
Evidence and limits
The current Microsoft CNA record for CVE-2026-118747 has an inconsistent generic version range. Use the component-specific affected and fixed matrix in Microsoft’s maintainer advisory, corroborated by the current MSRC fix rows. Do not interpret the malformed generic range as proof that a deployed branch is unaffected.
Microsoft System.Formats.Cbor advisory · Microsoft ASP NET Core/WebUtilities advisory · CVE-2026-118747 · CVE-2026-114149 · Official MSRC November data · Official CISA KEV mirror
Original vendor publication November 10, 2026. Last verified November 11, 2026 (US Eastern).