---
id: "CVE-2026-109485"
page: "https://infrastack.ai/live/CVE-2026-109485"
kind: "vulnerability"
aliases: ["CVE-2026-109485"]
title: "Microsoft 365 Agents SDK: SSRF lets an authorized user read internal data"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["agents-sdk", "ai-tooling", "dotnet", "javascript", "microsoft-365-agents-sdk", "python"]
not_affected_if: ["sdk-not-used"]
published_at: "2026-11-10T19:18:17+00:00"
first_seen_at: "2026-11-10T19:24:25+00:00"
updated_at: "2026-11-10T20:00:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109485", "first_seen_at": "2026-11-10T19:24:25+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109485", "first_seen_at": "2026-11-10T20:00:24+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109485", "https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/secure-your-agent"]}]
exploit_sources: []
---

# Microsoft 365 Agents SDK: SSRF lets an authorized user read internal data

Link for people: https://infrastack.ai/live/CVE-2026-109485 (this .md is for agents)

The Microsoft 365 Agents SDK has a server-side request forgery flaw that lets an attacker with valid access make the server send requests to other hosts. The attacker can use this to disclose information over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until Microsoft names affected versions. Meanwhile: list which Microsoft 365 Agents SDK packages you use (.NET, JavaScript @microsoft/agents-hosting, Python microsoft-agents-hosting-core) and check whether outbound host validation is enabled; Microsoft Learn says it is opt-in and off by default. Check MSRC for CVE-2026-109485 for the fixed version.

## Timeline

- 2026-11-10T19:24:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109485
- 2026-11-10T20:00:24+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-109485 — MSRC page is JS-only and returned nothing; the language repos' GitHub advisory pages are empty. No affected versions or fixed release found, so nothing verified. NVD (CVSS 6.3, AV:N/PR:L, scope changed, confidentiality high) is the only source. Learn's secure-your-agent page says outbound host validation (the SSRF control) is opt-in and off by default. Revisit when MSRC or GitHub advisories appear.

## Documents

- [describes] NVD CVE-2026-109485 https://nvd.nist.gov/vuln/detail/CVE-2026-109485
- [mentions] Secure your agent for production (Microsoft Learn) https://learn.microsoft.com/en-us/microsoft-365/agents-sdk/secure-your-agent

## From the sources

Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_