On 22 October 2026, the vulnerability CVE-2026-111497 was published. It affects the widely used Brotli decoder, which decompresses compressed data. Under certain conditions, an attacker can use it to read or change memory contents. The vulnerability is rated critical.
We have reviewed our products. Two points are relevant for you:
1. Microsoft .NET runtime (applies to all systems with .NET 8 or .NET 10)
The affected decoder is part of the .NET runtime on which our software runs. Microsoft has fixed the vulnerability in .NET 8.0.33 and .NET 10.0.14; the updates are delivered through Windows Update.
On-premises installations: Please make sure that the latest Windows updates are installed on all workstations and servers that run NET software.
Systems hosted by TKI: We install the updates for you; no action is required on your side. An appointment will be scheduled.
2. Cyclomedia integration in NET Design and NET Engineering
Since NET 13.3, the Cyclomedia integration is part of NET Design and NET Engineering and is active together with these products. To show the Cyclorama, it uses an embedded browser that contains an affected version of the Brotli decoder. This browser is loaded only when you open the Cyclorama. As long as the Cyclorama is not opened, the affected component is not active. We are therefore removing the Cyclomedia integration from all installation packages for the time being. NET 15.3.5 is released without the Cyclomedia integration and no longer contains the affected component; apart from that, the version is unchanged.
Please update to NET 15.3.5. This applies to all affected versions; there will be no separate updates for older versions.
Until then, please do not open the Cyclorama. You can continue to use all other functions of NET Design and NET Engineering without restriction.
Do you use the Cyclomedia integration in production? Please contact our support team. We will agree on a secure solution with you.
All other functions of our products remain unchanged.
If you have questions, please contact our support team as usual.