{"id":"CVE-2026-87697","published":"2026-10-13T19:21:22.400","lastModified":"2026-10-14T04:18:52.500","description":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a critical deserialization vulnerability in .NET applications that allows remote attackers to execute arbitrary code by crafting malicious serialized data. The flaw occurs when untrusted data is deserialized without proper validation, enabling attackers to inject malicious objects that get executed during the deserialization process.","exploitability":"Exploitation is relatively straightforward requiring only network access to send crafted serialized data, with no authentication required for the deserialization endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected .NET applications across the network, potentially leading to full system compromise and lateral movement throughout the enterprise.","remediation":"No fixed version is published in the description. Disable the affected deserialization feature or restrict access to the named endpoint until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["deserialization","rce","dotnet","network"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:01:05.949Z"}}