CVE-2026-87697

Executive Summary

CVE-2026-87697 is a deserialization of untrusted data vulnerability (CWE-502) in the .NET runtime and associated frameworks, with a CVSSv3.1 base score of 8.8. An unauthorized attacker can exploit this flaw over a network to execute arbitrary code, but exploitation requires user interaction (UI:R), indicating that a victim must initiate a request or open a crafted payload. No public proof-of-concept, Nuclei template, or evidence of active exploitation is currently available.

Technical Analysis

The vulnerability class is CWE-502: Deserialization of Untrusted Data. .NET applications commonly use serialization mechanisms to convert objects to/from byte streams or text formats (e.g., BinaryFormatter, JSON.NET with TypeNameHandling, XML serializers, or custom formatters). When an application deserializes data from an untrusted source without proper type validation, an attacker can supply a serialized payload that, during deserialization, instantiates attacker-controlled types or triggers gadget chains that result in remote code execution.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates:

• The attack is launched over the network (AV:N).
• No special privileges are required (PR:N).
• No complex conditions must be met beyond the user action (AC:L).
• User interaction (UI:R) is required — for example, the victim must click a link, open a file, or use a client that processes the malicious payload.
• Successful exploitation yields high confidentiality, integrity, and availability impact to the vulnerable component (C:H/I:H/A:H), while the scope remains unchanged (S:U).

The NVD description provides no details on specific affected APIs, serialization formats, or function names. Therefore, the exact vector (e.g., a particular endpoint accepting serialized data, a file upload, or a client-side deserialization) cannot be confirmed. It is likely that the vulnerability resides in how .NET handles deserialization of a specific format, but the low-level mechanism (gadget chain, formatter type) is insufficiently described in the available data.

Because no CNA title or version range is provided, it is not possible to name the precise component or version affected beyond the generic ".NET" designation.

Exploitation Scenarios

No public PoC or exploit code is available. The following attack chain is inferred strictly from the vulnerability class and CVSS vector; no specific implementation details are fabricated.

1. Reconnaissance/target identification: The attacker identifies a .NET-based application or service that accepts serialized data from untrusted sources. This might be a web endpoint that deserializes user-supplied input (e.g., view state, cookies, or API request bodies), a client application that processes serialized files, or a message queue. The attacker maps the network exposure using the fact that the vulnerability is remotely triggerable (AV:N).

2. Triggering the flaw: The attacker crafts a malicious serialized payload that contains a gadget chain. Because user interaction is required (UI:R), the attacker must socially engineer a victim (e.g., via phishing) to cause the application to deserialize the payload — for instance, by clicking a link that causes the client to process a serialized object, or by opening a file that is later deserialized by a .NET application. The exact delivery vector is not specified in the available data.

3. Payload/execution method at the vulnerability-class level: The crafted serialized data, when deserialized by the vulnerable .NET component, results in the instantiation of unexpected types and execution of arbitrary code. The mechanism relies on the deserializer not restricting the types that can be instantiated from the input. The attacker embeds a gadget chain that leads to code execution with the privileges of the application.

4. Post-exploitation impact: Successful exploitation gives the attacker code execution in the context of the vulnerable process. Given the high CIA impact (C:H/I:H/A:H), the attacker could read sensitive data, modify application data, or cause a denial of service, and potentially pivot within the network depending on the application's permissions.

Because no technical details (functions, classes, endpoints, parameters) are given in the NVD description, no further concrete steps can be described.

Impact Assessment

The CVSS base score of 8.8 (High) reflects the combined effect of network exploitability, low attack complexity, no privilege requirement, and high confidentiality, integrity, and availability impact. The user interaction requirement (UI:R) somewhat limits mass exploitation compared to a zero-click flaw, but it remains a severe issue because .NET is massively deployed across enterprise environments and web applications.

Business impact includes:

• Unauthorized remote code execution on servers or clients.
• Full compromise of application data (read/write) and potential lateral movement.
• Service disruption (denial of service) if the attacker chooses to crash the process.
• Reputational and regulatory consequences if sensitive data is exfiltrated.

The blast radius depends on the specific .NET application affected. Because the vendor is listed as "Unknown", the affected product scope could range from a widely used framework component to a niche library. Organizations using .NET for custom applications, web APIs, or desktop software should consider themselves potentially at risk until the exact patched version is identified.

Detection Guidance

Sigma Rule

title: Suspicious .NET Deserialization Activity
id: 8a4b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
status: experimental
description: Detects potential exploitation of CVE-2026-87697 via process creation of .NET binaries or suspicious module loads related to serialization.
author: Threat Intelligence
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
            - '\w3wp.exe'
            - '\dotnet.exe'
            - '\msbuild.exe'
    selection_cmd:
        - CommandLine|contains:
            - 'BinaryFormatter'
            - 'TypeNameHandling'
            - 'ObjectStateFormatter'
            - 'LosFormatter'
    condition: selection_img and selection_cmd
falsepositives:
    - Legitimate administrative scripts using serialization
level: high

YARA Rule

rule CVE_2026_87697_Deserialization_Payload
{
    meta:
        description = "Detects potential .NET deserialization payloads targeting CVE-2026-87697"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-87697"
        hash = "unknown"
    strings:
        $a = "BinaryFormatter" ascii wide nocase
        $b = "TypeNameHandling" ascii wide nocase
        $c = "ObjectStateFormatter" ascii wide nocase
        $d = "LosFormatter" ascii wide nocase
        $e = "System.Windows.Data.ObjectDataProvider" ascii wide nocase
        $f = "System.Diagnostics.Process" ascii wide nocase
    condition:
        uint32(0) == 0x00000000 or true
        and 2 of ($a, $b, $c, $d, $e, $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87697 .NET Deserialization Attempt"; flow:to_server,established; content:"BinaryFormatter"; http_client_body; nocase; content:"TypeNameHandling"; http_client_body; nocase; distance:0; within:200; classtype:attempted-admin; sid:100087697; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
[process where process.name == "w3wp.exe" or process.name == "dotnet.exe"]
[network where network.direction == "outbound" and process.name in ("w3wp.exe", "dotnet.exe")]

Splunk SPL Query

index=windows (EventCode=4688 OR EventCode=1)
(Image="*\\w3wp.exe" OR Image="*\\dotnet.exe")
(CommandLine="*BinaryFormatter*" OR CommandLine="*TypeNameHandling*" OR CommandLine="*ObjectStateFormatter*")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, Image, CommandLine
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`

Wazuh OSSEC Rule

<group name="windows,dotnet,">
  <rule id="100697" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">\.(w3wp|dotnet)\.exe$</field>
    <field name="win.eventdata.commandLine">BinaryFormatter|TypeNameHandling|ObjectStateFormatter</field>
    <description>CVE-2026-87697: Potential .NET deserialization exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations:

   • Disable or restrict unsafe deserialization in .NET applications. Avoid BinaryFormatter and similar unsafe formatters; use safe serialization formats (e.g., System.Text.Json with strict type handling).
   • Implement allow-list based type resolution (SerializationBinder) to prevent arbitrary type instantiation.
   • Enforce network segmentation and least privilege to limit the impact of successful exploitation.
   • Train users on phishing awareness since user interaction (UI:R) is required — prevent them from opening untrusted files or clicking malicious links.

2. Patch/upgrade steps:

   • A GitHub Security Advisory (GHSA) claims a patch exists, but the vendor advisory and exact patched version are unavailable. Monitor official .NET security advisories and Microsoft Security Response Center (MSRC) for updates. Apply the latest cumulative updates for .NET runtime and frameworks as soon as they are published.
   • Until a confirmed patch is available, consider the mitigations above as compensating controls.

3. Long-term hardening:

   • Adopt secure coding practices: never deserialize data from untrusted sources; use data transfer objects (DTOs) with explicit schemas.
   • Conduct regular security reviews of .NET applications for deserialization flaws.
   • Integrate static application security testing (SAST) and dynamic analysis to detect CWE-502 patterns.
   • Implement runtime application self-protection (RASP) or deserialization firewalls where feasible.

References

• NVD – CVE-2026-87697: https://nvd.nist.gov/vuln/detail/CVE-2026-87697
• MITRE CWE-502: https://cwe.mitre.org/data/definitions/502.html
• GitHub Security Advisory (GHSA) – claimed patch source (advisory ID not provided)
• Microsoft .NET Security Advisories: https://github.com/dotnet/announcements
• OWASP Deserialization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html

No specific threat actor campaigns or exploit-in-the-wild evidence is available for this CVE at the time of writing.