{"id":"CVE-2026-109485","kind":"vulnerability","aliases":["CVE-2026-109485"],"related":[],"title":"Microsoft 365 Agents SDK: SSRF lets an authorized user read internal data","description":"Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.","summary":"The Microsoft 365 Agents SDK has a server-side request forgery flaw that lets an attacker with valid access make the server send requests to other hosts. The attacker can use this to disclose information over the network.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agents-sdk","ai-tooling","dotnet","javascript","microsoft-365-agents-sdk","python"],"not_affected_if":["sdk-not-used"],"how_to_check":"Unknown until Microsoft names affected versions. Meanwhile: list which Microsoft 365 Agents SDK packages you use (.NET, JavaScript @microsoft/agents-hosting, Python microsoft-agents-hosting-core) and check whether outbound host validation is enabled; Microsoft Learn says it is opt-in and off by default. Check MSRC for CVE-2026-109485 for the fixed version.","fix":null,"status":"open","published_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","triaged_at":"2026-11-10T19:58:26+00:00","updated_at":"2026-11-10T20:00:24+00:00","category":"ai-tooling","confidence":0.3,"triage":{"at":"2026-11-10T19:58:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft 365 Agents SDK: SSRF lets an authorized user read internal data","impact":"low","summary":"The Microsoft 365 Agents SDK has a server-side request forgery flaw that lets an attacker with valid access make the server send requests to other hosts. The attacker can use this to disclose information over the network.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["microsoft-365-agents-sdk","agents-sdk","dotnet","python","javascript"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"server reaches internal hosts and discloses information over network","analyst_note":"Find affected SDK versions and the fixed release in the Microsoft Security Response Center advisory for CVE-2026-109485, and confirm which SDK component handles the outbound request.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["sdk-not-used"],"who_is_affected":"Teams building agents or bots on the Microsoft 365 Agents SDK that accept requests from authorized users are the likely exposure; the sources do not name affected versions or the exact triggering feature. Teams not using this SDK can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4507,"output_tokens":482,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find affected SDK versions and the fixed release in the Microsoft Security Response Center advisory for CVE-2026-109485, and confirm which SDK component handles the outbound request.","search":"'-109485':15A,18A '-2026':14A,17A '-365':28B '365':2A,35B,80C 'access':52B 'agent':3A,20B,30B,36B,81C 'agents-sdk':19B,29B 'ai':23B 'ai-tool':22B 'allow':83C 'attack':49B,62B,86C 'author':8A,85C 'cve':13A,16A 'data':12A 'disclos':67B,88C 'dotnet':25B 'flaw':45B 'forgeri':44B,76C 'host':60B 'inform':68B,89C 'intern':11A 'javascript':26B 'let':6A,47B 'make':53B 'microsoft':1A,27B,34B,79C 'network':71B,92C 'python':32B 'read':10A 'request':43B,57B,75C 'sdk':4A,21B,31B,37B,82C 'send':56B 'server':41B,55B,73C 'server-sid':40B,72C 'side':42B,74C 'ssrf':5A,77C 'tool':24B 'use':64B 'user':9A 'valid':51B","nicknames":[],"mitigations":[],"who_affected":"Teams running agents or bots on the Microsoft 365 Agents SDK (.NET, JavaScript or Python) that accept requests from authenticated users. NVD gives no affected versions or triggering component. Teams not using this SDK can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentssdk","aitooling","dotnet","javascript","medium","microsoft365agentssdk","python"],"campaign_type":null,"search_a":"'-109485':15A,18A '-2026':14A,17A '365':2A 'agent':3A 'author':8A 'cve':13A,16A 'data':12A 'intern':11A 'let':6A 'microsoft':1A 'read':10A 'sdk':4A 'ssrf':5A 'user':9A","search_b":"'-365':28B '365':35B 'access':52B 'agent':20B,30B,36B 'agents-sdk':19B,29B 'ai':23B 'ai-tool':22B 'attack':49B,62B 'disclos':67B 'dotnet':25B 'flaw':45B 'forgeri':44B 'host':60B 'inform':68B 'javascript':26B 'let':47B 'make':53B 'microsoft':27B,34B 'network':71B 'python':32B 'request':43B,57B 'sdk':21B,31B,37B 'send':56B 'server':41B,55B 'server-sid':40B 'side':42B 'tool':24B 'use':64B 'valid':51B","search_c":"'365':80C 'agent':81C 'allow':83C 'attack':86C 'author':85C 'disclos':88C 'forgeri':76C 'inform':89C 'microsoft':79C 'network':92C 'request':75C 'sdk':82C 'server':73C 'server-sid':72C 'side':74C 'ssrf':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109485","severity":null,"published_at":"2026-11-10T19:18:17+00:00","modified_at":"2026-11-10T19:18:17+00:00","first_seen_at":"2026-11-10T19:24:25+00:00","fetched_at":"2026-11-10T19:24:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109485:2589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109485","severity":null,"published_at":"2026-11-10T20:00:24+00:00","modified_at":"2026-11-10T20:00:24+00:00","first_seen_at":"2026-11-10T20:00:24+00:00","fetched_at":"2026-11-10T20:00:24+00:00","note":"MSRC page is JS-only and returned nothing; the language repos' GitHub advisory pages are empty. No affected versions or fixed release found, so nothing verified. NVD (CVSS 6.3, AV:N/PR:L, scope changed, confidentiality high) is the only source. Learn's secure-your-agent page says outbound host validation (the SSRF control) is opt-in and off by default. Revisit when MSRC or GitHub advisories appear.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-109485","https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/secure-your-agent"]}],"documents":[{"id":117726,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109485","title":"NVD CVE-2026-109485","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117727,"url":"https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/secure-your-agent","title":"Secure your agent for production (Microsoft Learn)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}