Hauptmenü

Sicherheit & Compliance

Höchste Standards zum Schutz Ihrer Daten und zur Gewährleistung von Vertrauen.

DEVO-2026-0040

Remediation notice for CVE-2026-111497 in Brotli

Betroffene Produkte

Remote Desktop Manager
Windows2026.3.15.0 and earlier
macOS2026.3.2.2 and earlier
Linux2026.3.2.0 and earlier
PowerShell Universal
2026.3.3 and earlier
Devolutions Cloud
2026.3.2.2 and earlier (Encryption Service only)
2026.3.2.2 and earlier (Encryption Service only)
UniGetUI
2026.3.2 and earlier

Änderungsprotokoll

Initial publication - 2026-11-05

Remote Desktop Manager

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Behebung und Workarounds

Upgrade to Remote Desktop Manager Windows 2026.3.16.0, macOS 2026.3.2.3 or Linux 2026.3.2.1 or higher. For Remote Desktop Manager Windows, also install Microsoft .NET Desktop Runtime 10.0.14 or later. For Devolutions.PowerShell, update PowerShell 7 to 7.6.9 or later.

PowerShell Universal

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Behebung und Workarounds

We expect to release a version of PowerShell Universal that includes the fix next week. PowerShell cmdlets such as Invoke-WebRequest and Invoke-RestMethod can decode Brotli responses. Until the update is available, we recommend limiting outbound requests to trusted endpoints.

Devolutions Cloud Encryption Service

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Behebung und Workarounds

We expect to release a version of Devolutions Cloud Encryption Service that includes the fix this week. Outbound web requests made by the service can decode Brotli responses. The Devolutions Cloud Encryption Service only communicates with Devolutions systems.

UniGetUI

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Behebung und Workarounds

Upgrade to UniGetUI 2026.3.3 or higher. This version updates the .NET runtime to 10.0.14.