WinGuard is affected by the vulnerability CVE-2026-111497 in the Google Brotli library starting with X5 Build 6.0. We assess the risk as high.
The vulnerability in the .NET runtime is resolved by Microsoft’s security update to version 10.0.14 (KB5133966). The update is provided directly by Microsoft and must be installed on all WinGuard servers and clients as part of regular Windows patch management. If the optional Node.js package is used, an upgrade to a current Node.js long-term support (LTS) release, version 24.22.1 or later, is also required. Starting with WinGuard X5 Build 7.4 (expected to be available on November 2, 2026), the updated components will be included.