Menu principale

Sicurezza & conformità

Manteniamo i più elevati standard per proteggere i suoi dati e garantire la fiducia.

DEVO-2026-0040

Remediation notice for CVE-2026-111497 in Brotli

Prodotti interessati

Remote Desktop Manager
Windows2026.3.15.0 and earlier
macOS2026.3.2.2 and earlier
Linux2026.3.2.0 and earlier
PowerShell Universal
2026.3.3 and earlier
Devolutions Cloud
2026.3.2.2 and earlier (Encryption Service only)
2026.3.2.2 and earlier (Encryption Service only)
UniGetUI
2026.3.2 and earlier

Registro delle modifiche

Initial publication - 2026-11-05

Remote Desktop Manager

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Correzione e soluzioni alternative

Upgrade to Remote Desktop Manager Windows 2026.3.16.0, macOS 2026.3.2.3 or Linux 2026.3.2.1 or higher. For Remote Desktop Manager Windows, also install Microsoft .NET Desktop Runtime 10.0.14 or later. For Devolutions.PowerShell, update PowerShell 7 to 7.6.9 or later.

PowerShell Universal

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Correzione e soluzioni alternative

We expect to release a version of PowerShell Universal that includes the fix next week. PowerShell cmdlets such as Invoke-WebRequest and Invoke-RestMethod can decode Brotli responses. Until the update is available, we recommend limiting outbound requests to trusted endpoints.

Devolutions Cloud Encryption Service

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Correzione e soluzioni alternative

We expect to release a version of Devolutions Cloud Encryption Service that includes the fix this week. Outbound web requests made by the service can decode Brotli responses. The Devolutions Cloud Encryption Service only communicates with Devolutions systems.

UniGetUI

Medium

CVE-2026-111497 is a vulnerability in the Brotli decompression library. Microsoft updated the version that ships in the .NET SDK 8.0.33, 9.0.22 and 10.0.14.

CVE(s)

CVE-2026-111497

Correzione e soluzioni alternative

Upgrade to UniGetUI 2026.3.3 or higher. This version updates the .NET runtime to 10.0.14.