Microsoft 365 threat report

CVE-2026-111497, a critical Brotli decoder vulnerability (CVSS 9.8), is being actively exploited to achieve remote code execution or information disclosure. Microsoft .NET 8, 9, 10, and 11—foundational components used by Microsoft 365 services—are affected. Exploitation requires an application to decompress attacker-controlled Brotli-compressed data. Public proof-of-concept code is available. Immediate patching is required.

• Active Exploitation of Critical Brotli Vulnerability Affecting M(opens in a new tab)
• Red Hat Security Advisory: .NET 8.0 security update | Threat Rad(opens in a new tab)