CVE-2026-109485: Microsoft 365 Agents SDK Information Disclosure Vulnerability

Q: What level of access does an attacker need?

An attacker must be authorized, meaning they need low-level privileges before exploiting the issue. Exploitation is possible over a network and does not require user interaction.

Q: What is the expected impact if exploitation succeeds?

The vulnerability can disclose information through server-side request forgery. The provided severity data indicates high confidentiality impact, with no indicated integrity or availability impact.

Q: How difficult is exploitation expected to be?

The attack complexity is rated high. This indicates that exploitation depends on conditions beyond simply reaching the affected SDK over the network.

Published Nov 10, 2026

Updated

Microsoft 365 Agents SDK Information Disclosure Vulnerability

Other sources

Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Agent Framework SDK - dotnet<1.8.77

1.8.77

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.77

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

An attacker must be authorized, meaning they need low-level privileges before exploiting the issue. Exploitation is possible over a network and does not require user interaction.

What is the expected impact if exploitation succeeds?

The vulnerability can disclose information through server-side request forgery. The provided severity data indicates high confidentiality impact, with no indicated integrity or availability impact.

How difficult is exploitation expected to be?

The attack complexity is rated high. This indicates that exploitation depends on conditions beyond simply reaching the affected SDK over the network.

CVE-2026-109485: Microsoft 365 Agents SDK Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?

How difficult is exploitation expected to be?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the expected impact if exploitation succeeds?

How difficult is exploitation expected to be?