CVE-2026-87697 Overview
CVE-2026-87697 is a deserialization of untrusted data vulnerability in Microsoft .NET. An unauthorized attacker can execute code over a network by delivering crafted serialized payloads to a vulnerable .NET application. The flaw is classified under CWE-502: Deserialization of Untrusted Data and requires user interaction to trigger exploitation. Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected host.
Critical Impact
Remote attackers can achieve arbitrary code execution within the context of the vulnerable .NET process when a user interacts with attacker-supplied serialized content.
Affected Products
- Microsoft .NET (see Microsoft Security Update Guide for specific versions)
Discovery Timeline
- 2026-10-13 - CVE-2026-87697 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-87697
Vulnerability Analysis
The vulnerability resides in how .NET deserializes attacker-controlled data. When a vulnerable component reconstructs objects from a serialized stream, it instantiates types and invokes constructors or callbacks without validating that the resulting object graph is safe. Attackers craft serialized payloads referencing gadget chains that trigger code execution during the deserialization process.
Exploitation requires user interaction, such as opening a crafted file or loading attacker-supplied content in a .NET application. The attack travels over the network and requires no prior authentication. Once the payload deserializes, the attacker executes code within the privilege context of the .NET process.
Because the issue sits in a core runtime capability, any application that accepts serialized input from untrusted sources is a candidate for exploitation. Common gadget chains in .NET deserialization abuse types that perform file, process, or reflection operations during object reconstruction.
Root Cause
The root cause is unsafe object reconstruction from untrusted serialized data [CWE-502]. The deserializer does not restrict the set of types it will instantiate, allowing attackers to steer the runtime toward dangerous gadget chains that execute arbitrary code.
Attack Vector
The attack vector is network-based with required user interaction. An attacker delivers a crafted serialized payload through a file, message, or network response. When the victim's .NET application deserializes the content, the gadget chain fires and the attacker's code runs. See the Microsoft Security Update Guide for additional protocol-level detail.
No public exploit code or proof-of-concept has been published for CVE-2026-87697 at the time of writing. Microsoft has not disclosed detailed exploitation internals.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87697
Indicators of Compromise
- Unexpected child processes spawned by .NET host processes such as dotnet.exe, w3wp.exe, or custom .NET service binaries.
- .NET applications loading serialized content from untrusted file shares, email attachments, or inbound network streams.
- Outbound network connections initiated immediately after a .NET process parses user-supplied input.
Detection Strategies
- Hunt for process lineage anomalies where .NET runtime processes launch command shells, scripting hosts, or LOLBins.
- Inspect application logs for deserialization exceptions or type-resolution errors, which can precede successful exploitation attempts.
- Correlate file write and execution events that follow consumption of serialized input such as .bin, .soap, or custom formats.
Monitoring Recommendations
- Enable detailed .NET runtime and application event logging on servers and workstations that process external data.
- Monitor endpoint telemetry for in-memory code execution patterns originating from managed processes.
- Alert on new or unsigned assemblies loaded by production .NET applications outside of change windows.
How to Mitigate CVE-2026-87697
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected .NET runtimes and SDKs.
- Inventory applications that call legacy formatters such as BinaryFormatter, SoapFormatter, NetDataContractSerializer, or ObjectStateFormatter and prioritize them for review.
- Restrict exposure of .NET endpoints that accept serialized input from untrusted networks until patching completes.
Patch Information
Microsoft has issued fixes through its standard update channels. Refer to the Microsoft Security Update Guide for the complete list of affected versions, patched builds, and installation guidance. Update both the shared .NET runtime and any self-contained applications that bundle vulnerable runtime components.
Workarounds
- Replace insecure formatters with safer serializers such as System.Text.Json or DataContractSerializer configured with a known type allowlist.
- Enforce input validation and signature verification on serialized payloads before deserialization.
- Apply the principle of least privilege to .NET service accounts so that exploitation yields reduced impact.
- Block untrusted file types and inbound serialized content at email and web gateways where feasible.
# Verify installed .NET runtime versions on a host
dotnet --list-runtimes
dotnet --list-sdks
# On Windows, confirm applied security updates
wmic qfe list brief /format:table
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
