{"metadata": {"vulnerability": "CVE-2026-87697", "count": 28, "kinds": {"milestone": 9, "sighting": 4, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-08T23:57:53.797Z", "date_only": false, "value": "2026-09-08T23:57:53.797Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-87697", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87697", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87697", "record": "FKIE_CVE-2026-87697", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T11:56:15Z", "date_only": false, "value": "2026-10-13T11:56:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "record": "CVE-2026-87697", "field": "creation_timestamp", "uuid": "69f970ec-f66e-4c85-ada6-c61e199c199b", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-87697", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:00:16.019Z", "date_only": false, "value": "2026-10-13T19:00:16.019Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-87697", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:21:22.400Z", "date_only": false, "value": "2026-10-13T19:21:22.400", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87697", "record": "FKIE_CVE-2026-87697", "field": "published"}, {"timestamp": "2026-10-13T20:52:24Z", "date_only": false, "value": "2026-10-13T20:52:24Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C27M-942F-RCFH", "record": "GHSA-C27M-942F-RCFH", "field": "published"}, {"timestamp": "2026-10-13T20:52:24Z", "date_only": false, "value": "2026-10-13T20:52:24Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C27M-942F-RCFH", "record": "GHSA-C27M-942F-RCFH", "field": "modified"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:30:57Z", "date_only": false, "value": "2026-10-14T00:30:57.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/c06739f1b3ec99b6674dc62ab70bc728", "record": "CVE-2026-87697", "field": "creation_timestamp", "uuid": "291ce297-c33a-435b-9a2b-0580fa6e9c02", "content": "# CVE-2026-87697: CVE-2026-87697: Untrusted Deserialization in .NET PresentationCore Clipboard Handling\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-87697\n\n## Summary\nA remote code execution vulnerability exists in Microsoft .NET due to untrusted data deserialization within the PresentationCore component. The flaw stems from implicit auto-conversion flags during clipboard data retrieval operations.\n\n## TL;DR\nImplicit type auto-conversion in WPF PresentationCore clipboard routines allowed untrusted data streams to be automatically deserialized, enabling arbitrary code execution upon accessing clipboard data.\n\n## Technical Details\n\n- **CWE ID**: CWE-502\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: Required (UI:R)\n- **CVSS v3.1 Score**: 8.8 (HIGH)\n- **Exploit Status**: None / Unproven\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft .NET 11.0\n- Microsoft Visual Studio 2022 (v17.14)\n- Microsoft Visual Studio 2026 (v18.10)\n- **.NET 8.0**: >= 8.0.0, < 8.0.32 (Fixed in: `8.0.32`)\n- **.NET 9.0**: >= 9.0.0, < 9.0.21 (Fixed in: `9.0.21`)\n- **.NET 10.0**: >= 10.0.0, < 10.0.13 (Fixed in: `10.0.13`)\n- **.NET 11.0**: >= 11.0.0, < 11.0.0-rc.2 (Fixed in: `11.0.0-rc.2`)\n- **Visual Studio 2022**: >= 17.14.0, < 17.14.42 (Fixed in: `17.14.42`)\n- **Visual Studio 2026**: >= 18.10.0, < 18.10.4 (Fixed in: `18.10.4`)\n\n## Mitigation\n\n- Upgrade .NET SDK and runtime components to fixed servicing releases.\n- Explicitly set autoConvert: false when querying external IDataObject contents in WPF application code.\n- Restrict user execution privileges for applications interacting with untrusted clipboard inputs.\n\n**Remediation Steps:**\n1. Identify all installed instances of .NET 8.0, 9.0, 10.0, 11.0, and Visual Studio build hosts.\n2. Apply security update builds: .NET 8.0.32, .NET 9.0.21, .NET 10.0.13, or .NET 11.0.0-rc.2.\n3. Update Visual Studio 2022 installations to 17.14.42 and Visual Studio 2026 to 18.10.4.\n4. Recompile WPF applications against the updated target SDKs.\n\n## References\n\n- [Microsoft Vulnerability Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-87697)\n- [dotnet/wpf Fix Commit](https://github.com/dotnet/wpf/commit/0987b406ba6087cbe14fdff1c9b67dd0c83f9076)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-87697) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/c06739f1b3ec99b6674dc62ab70bc728"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-87697", "field": "creation_timestamp", "uuid": "fd629285-2572-49af-9ed3-b0e99daa96e5", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-14T03:56:59.003Z", "date_only": false, "value": "2026-10-14T03:56:59.003Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-87697", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T04:18:52.500Z", "date_only": false, "value": "2026-10-14T04:18:52.500", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87697", "record": "FKIE_CVE-2026-87697", "field": "lastModified"}, {"timestamp": "2026-10-14T08:20:13.651Z", "date_only": false, "value": "2026-10-14T08:20:13.651506Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117438284634251854", "record": "CVE-2026-87697", "field": "creation_timestamp", "uuid": "1987704f-9455-4489-9680-2f852e9de740", "content": "CVE-2026-87697 .NET Remote Code Execution Vulnerability Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-87697https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87697#Microsoft #.NET10.0 #.NET11.0 #.NET8.0 #.NET9.0 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_87697#bot", "url": "https://infosec.exchange/users/cve/statuses/117438284634251854"}, {"timestamp": "2026-10-15T22:24:44.760Z", "date_only": false, "value": "2026-10-15T22:24:44.760Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-87697", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T22:24:44.760Z", "date_only": false, "value": "2026-10-15T22:24:44.760Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-87697", "field": "containers.cna.providerMetadata.dateUpdated"}]}