CVE-2026-87697 in .NET
Summary
by MITRE • 10/14/2026
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves the deserialization of untrusted data within the Microsoft .NET framework, which represents a critical class of security flaws often categorized under CWE-502: Deserialization of Untrusted Data. This specific weakness arises when an application accepts serialized objects from external sources without adequately validating or sanitizing the input before processing it. In the context of .NET, various serialization formats such as BinaryFormatter, XmlSerializer, and JSON serializers can be exploited if they are configured to allow instantiation of arbitrary types provided by the attacker. The core technical flaw lies in the assumption that serialized data is safe to reconstruct into live objects within the application's memory space. When this assumption fails due to insufficient input validation or lack of type whitelisting, an attacker can craft malicious payloads containing specially constructed object graphs that trigger side effects during the deserialization process.
From a technical perspective, these attacks typically leverage polymorphic references or gadget chains—sequences of existing methods within the .NET framework itself—to achieve arbitrary code execution. The attacker does not need to inject new code directly into the application binary; instead, they manipulate the state and behavior of legitimate classes already present in the environment. For instance, by controlling properties during deserialization, an attacker can force objects to execute dangerous operations such as file system access, network connections, or command-line execution. This mechanism aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically when the exploitation leads to shell commands being executed on the host machine. It also relates to T1203: Exploitation for Client Execution if the attack targets client-side applications like WPF or WinForms apps that process remote data.
The operational impact of this vulnerability is severe, as it allows an unauthorized attacker to achieve full control over the affected system remotely. Once code execution is established, the attacker can escalate privileges, install backdoors, exfiltrate sensitive data, or pivot further into the internal network. The risk is particularly acute in web applications and services that accept user input via HTTP requests, SOAP messages, or other network protocols where serialized objects are transmitted as part of the payload. Because .NET is widely used across enterprise environments for both backend services and desktop applications, a successful exploit can lead to significant business disruption, data breaches, and compliance violations under regulations such as GDPR or HIPAA. The ease with which these exploits can be automated using tools like ysoserial.net further amplifies the threat landscape, making this vulnerability a high-priority target for malicious actors.
Mitigation strategies must focus on preventing the deserialization of untrusted types entirely where possible. Developers should avoid using legacy serializers like BinaryFormatter and instead adopt safer alternatives such as System.Text.Json or DataContractJsonSerializer with strict type restrictions. If serialization is unavoidable, implementing an ObjectManager that restricts allowed types through a whitelist mechanism can significantly reduce the attack surface. Additionally, applying code access security policies to limit what deserialized objects can do provides defense in depth. Network-level controls such as firewalls and intrusion detection systems should be configured to inspect traffic for known malicious patterns associated with serialization exploits. Regular security assessments, including static application security testing (SAST) and dynamic application security testing (DAST), are essential to identify instances of unsafe deserialization practices before they can be exploited in production environments.