Microsoft 365 Agents SDK: Server-side request forgery with information disclosure
Summary
Server-side request forgery (SSRF) in the Microsoft 365 Agents SDK allows an authorized attacker to disclose information over the network. The attacker needs a valid low-privilege account and conditions outside their control, and the impact is limited to confidentiality. The flaw affects applications that build or host agents with this SDK, not standard Microsoft 365 end-user installations.
Affected
- Unknown. The CVE record gives a range (1.21.0 to < 1.8.77) that is internally inconsistent, so do not rely on it.
- MSRC names the affected component as Microsoft Agent Framework SDK - dotnet.
- Verify the exact affected versions on the MSRC page.
Fixed in
- Build 1.8.77 is listed on the MSRC page as the fix.
- Confirm this against the Knowledge Base article and download links on the MSRC page.
Workaround
Unknown. No vendor-published workaround found.
- Until patched, restrict outbound connections from agent hosts to required destinations.
- Block access to internal address ranges and cloud metadata endpoints, and log outbound requests (general SSRF hardening, not from the advisory).
Exploitation
- Not publicly disclosed; exploit maturity rated "Unproven" by MSRC.
- CISA SSVC: exploitation none, automatable no.
- Rapid7 rates exploitation as "Exploitation Less Likely".
- No evidence of exploitation in the wild and no public proof of concept found.
Our recommendation
- Inventory .NET projects and deployments that reference the Agents SDK or Agent Framework packages.
- Confirm the affected and fixed versions on the MSRC page, then update to the fixed build.
- Until patched, restrict outbound traffic from agent hosts and review logs for unexpected server-side requests.
- Recheck NVD and MSRC for changes, as NVD analysis is pending.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-109485 msrc.microsoft.com
- CVE Record: CVE-2026-109485 www.cve.org
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
- Strix: CVE-2026-109485 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:58.
Original description (NVD)
Server-side request forgery (ssrf) in Microsoft 365 Agents SDK allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.