CVE-2026-87697

Microsoft — .NET Remote Code Execution Vulnerability

Patch Tuesday

What EVULNABLE says

An EPSS probability of 0.008, and CVSS base score 8.8.

CISA KEV: did not apply
Ransomware: did not apply
Vendor exploitation: did not apply
EPSS: applied
Microsoft Exploitability Index: did not apply
Pre-patch disclosure: did not apply
KEV recency: did not apply
CVSS: applied

Scheduled Maintenance

EVRS13/100

EVRS priorityElevated

Evidence available

6 of 8 signals

CVSS: CVSS base score 8.8
EPSS: 0.8% EPSS probability
CISA KEV: Not currently CISA KEV-listed
Pre-patch disclosure: Not publicly disclosed pre-patch
Vendor exploitation: No confirmed active exploitation
Microsoft Exploitability Index: Exploitation Less Likely
Ransomware: Ransomware association unavailable
CISA KEV listing date: CISA KEV listing date unavailable

Why some signals show no data

CVSS: 8.8
EPSS: 0.008 (57.1st pctl)

NVD ↗Microsoft ↗

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

Measure	Value	Source	What it means
CVSS base score	8.8	—	How severe the flaw is in itself. It does not say how likely an attack is.
FIRST EPSS	0.008 (57.1st pctl)	FIRST	FIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs.
Actively exploited	Not confirmed	Patch Tuesday	Whether a source of record has confirmed attacks using it in the wild.
Fixed in	Microsoft.WindowsDesktop.App.Runtime.win-arm64: 9.0.21, 8.0.32, 11.0.0-rc.2 \| Microsoft.WindowsDesktop.App.Runtime.win-x64: 9.0.21, 8.0.32, 11.0.0-rc.2 \| Microsoft.WindowsDesktop.App.Runtime.win-x86: 9.0.21, 8.0.32	NVD	The version(s) the vendor has published as fixed, where NVD records one.
Public exploit module	None known	Metasploit	Module existing is not the same as active exploitation.
EUVD cross-reference	Listed	ENISA EUVD	ENISA's own vulnerability database entry for this CVE, where one exists.

Impacted software or hardware: Not identified by the connected sources

Fixed versions: Microsoft.WindowsDesktop.App.Runtime.win-arm64: 9.0.21, 8.0.32, 11.0.0-rc.2 | Microsoft.WindowsDesktop.App.Runtime.win-x64: 9.0.21, 8.0.32, 11.0.0-rc.2 | Microsoft.WindowsDesktop.App.Runtime.win-x86: 9.0.21, 8.0.32

Remediation: Apply the vendor patch or guidance: https://github.com/advisories/GHSA-c27m-942f-rcfh | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697

Remediation basis: External remediation intelligence

ENISA EUVD also lists this CVE at CVSS 8.8 (v3.1), assigned by microsoft. Source: euvd.enisa.europa.eu.

GitHub Advisory Database, GHSA-c27m-942f-rcfh, lists affected packages:

Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) affected >= 9.0.0, <= 9.0.20, fixed in 9.0.21; affected >= 8.0.0, <= 8.0.31, fixed in 8.0.32; affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) affected >= 9.0.0, <= 9.0.20, fixed in 9.0.21; affected >= 8.0.0, <= 8.0.31, fixed in 8.0.32; affected >= 11.0.0-preview.1, <= 11.0.0-rc.1, fixed in 11.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x86 (nuget) affected >= 9.0.0, <= 9.0.20, fixed in 9.0.21; affected >= 8.0.0, <= 8.0.31, fixed in 8.0.32
and 4 more — see GHSA-c27m-942f-rcfh on GitHub for the full list

Advisory data from GitHub, CC-BY-4.0.

2 days recorded, 2026-10-14 to 2026-10-15

0.84% as of 2026-10-15 (57.1st percentile). FIRST EPSS, recorded daily since this page started tracking it.

2026-10-14 2026-10-15

The primary records

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.

NVD ↗ Microsoft ↗

Where this sits

CVE-2026-87697 is one of the entries ranked on the priority feed and in this month's Microsoft release.