PowerShell Universal bundled .NET runtime — CVE-2026-111497 (broccoli2shell)

We reviewed our PSU 2026.3.3 Ubuntu container and found bundled .NET 10.0.12, below the 10.0.14 fix listed in Microsoft’s advisory for CVE-2026-111497.
We did some local testing and confirmed that PowerShell web cmdlets can decode Brotli responses using this runtime. We have not confirmed an exploitable inbound path through PSU.
Will Devolution releases be updated? and how to mitigate?