.NET XML and CMS denial-of-service findings in the 1.0.0–1.2.1 Orchestrator images
Microsoft's 13 October 2026 advisories for System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs apply to the .NET 10.0.12 runtime in the Orchestrator images of 1.0.0 through 1.2.1. All five are denial-of-service flaws in XML signature and encryption and in CMS processing, which BROKA never performs; 1.3.0 runs on .NET 10.0.13.
Not exploitable in any configuration BROKA ships
- Affected
- 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1
- Fixed in
- 1.3.0
- Editions
- Community and Commercial
- Severity
- High
- CVEs
- CVE-2026-96958, CVE-2026-96959, CVE-2026-96960, CVE-2026-84008, CVE-2026-70162
What was found
On 13 October 2026 Microsoft published five advisories for two .NET libraries: System.Security.Cryptography.Xml, which signs, verifies, encrypts and decrypts XML documents, and System.Security.Cryptography.Pkcs, which reads and checks CMS (PKCS #7) messages such as S/MIME e-mail. Versions up to 10.0.12 are affected and 10.0.13 fixes them.
Both libraries are part of the .NET runtime the Orchestrator image is built on, and every published version so far runs on .NET 10.0.12. A scanner that reads the .NET runtime's own components reports them in these images.
| Component | Image | CVE | Upstream severity | In BROKA |
|---|---|---|---|---|
| System.Security.Cryptography.Xml, in .NET 10.0.12 | Orchestrator | CVE-2026-96958, CVE-2026-96959, CVE-2026-96960 | High | never run |
| System.Security.Cryptography.Pkcs, in .NET 10.0.12 | Orchestrator | CVE-2026-84008 | High | never run |
| System.Security.Cryptography.Pkcs, in .NET 10.0.12 | Orchestrator | CVE-2026-70162 | Moderate | never run |
Both editions are affected the same way: Community 1.0.0 through 1.2.1, and Commercial 1.0.1 through 1.2.1, the Commercial Linux package included. The broker service and console images carry no .NET and none of these.
Why none of them reaches BROKA
XML signatures and encryption — CVE-2026-96958, CVE-2026-96959, CVE-2026-96960
The three let a crafted XML document exhaust the CPU or memory of an application that verifies its signature or decrypts it. BROKA never verifies or decrypts XML: nothing in it signs or encrypts XML, and it speaks no XML-based protocol — the single sign-on 1.3.0 adds is OpenID Connect and LDAP, not SAML. The one XML document the Orchestrator reads is its own key ring, which is wrapped by BROKA's own encryption rather than .NET's XML encryption and is read only from BROKA's own database.
CMS messages — CVE-2026-84008, CVE-2026-70162
The two let a crafted CMS message exhaust the CPU of an application that checks its signature or decodes it as encrypted. BROKA never reads a CMS message: it only sends e-mail, and never signs, encrypts, verifies or decrypts it. CVE-2026-70162 also affects Windows only, and BROKA runs on Linux.
What to do
Upgrade to 1.3.0. It runs the Orchestrator on .NET 10.0.13, so its images and the Linux package carry none of the five; an upgrade is new images and a restart, and the 1.3.0 release notes have the details. No earlier version needs a workaround in the meantime.
Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.
Timeline
- 2026-10-13: Microsoft publishes the five advisories and .NET 10.0.13.
- 2026-10-14: the Orchestrator's build reports the two libraries as affected.
- 2026-10-15: the Orchestrator's base images move to .NET 10.0.13 for the next release; this advisory is published.
- 2026-10-16: 1.3.0 is released on .NET 10.0.13.