Description
Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Agent Framework SDK | 1.21.0 – < 1.8.77 | 1.8.77 |
Advisories 1
- MSRC-CVE-2026-109485 Microsoft 365 Agents SDK Information Disclosure Vulnerability Microsoft Security Response Center · Nov 10, 2026
References
- Microsoft 365 Agents SDK Information Disclosure Vulnerability vendor-advisory patch