Ubuntu advisory USN-8958-1: three .NET flaws with risk of code execution and privilege escalation

What happened and what to do

The advisory, published by Ubuntu Security on October 29, 2026, covers three CVEs in .NET. The first, CVE-2026-102870, involves the Blazor WebAssembly debugging proxy, which did not properly escape certain values and could allow arbitrary code execution. The fix previously published in USN-8942-1 was found to be incomplete, and the issue affected only dotnet10 and dotnet11. The second, CVE-2026-111497, affects the Brotli decompression library used by .NET, which mishandled certain compressed streams and can cause denial of service or arbitrary code execution by a remote attacker. The third, CVE-2026-114148, reported by Alen Cheung, concerns .NET mishandling file ownership in certain circumstances and may allow local privilege escalation.

In practice, a company should first identify which servers, containers and build pipelines run dotnet10 or dotnet11, and where Blazor WebAssembly runs in debug mode, since the earlier fix was not sufficient. It should then apply the Ubuntu updates, restart affected services and verify the effective runtime version in production. It is also worth restricting the debugging proxy to development environments, reviewing file permissions on shared hosts, and monitoring failure logs and CPU or memory spikes that could indicate exploitation. This work is infrastructure inventory, remediation and monitoring, and can be automated with scripts that collect versions and raise alerts, without depending on AI.

How the consultancy can help

Wendelmaques can diagnose the company's .NET estate, mapping versions, debugging proxy exposure and file permissions, and propose a remediation plan. It can then implement automated version collection, an exposure dashboard and monitoring alerts on your own infrastructure, with agreed ongoing operation.

Next step

If your company runs .NET on servers or pipelines, send a short description of your environment and case to receive a scoped proposal covering diagnosis, timelines and engagement format.