CVE-2026-87697

Summary

This CVE describes a critical deserialization vulnerability in .NET applications that allows remote attackers to execute arbitrary code by crafting malicious serialized data. The flaw occurs when untrusted data is deserialized without proper validation, enabling attackers to inject malicious objects that get executed during the deserialization process.

Exploitability

Exploitation is relatively straightforward requiring only network access to send crafted serialized data, with no authentication required for the deserialization endpoint.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on affected .NET applications across the network, potentially leading to full system compromise and lateral movement throughout the enterprise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published in the description. Disable the affected deserialization feature or restrict access to the named endpoint until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.