Serial number: AV26-1142
Date: November 10, 2026
As of November 10, 2026, Microsoft is affected by vulnerabilities in the following products:
- .NET 10.0
- .NET 11.0
- .NET 8.0
- .NET 9.0
- Aspire Dashboard
- Aspire Cli
- Aspire Dashboard Sdk
- Aspire Hosting
- Aspire Hosting AppHost
- Azure Confidential Clean Room
- Azure CycleCloud
- Azure DevOps
- Azure DevOps Server
- Azure DevOps Server 2025
- Azure File Sync
- Azure Front Door
- Azure Local
- Azure Machine Learning
- Azure Managed Grafana
- Azure Open AI
- Azure Privileged Identity Management (PIM)
- Azure Virtual Machines
- Azure Web Apps
- Entra Device Registration
- GitHub Copilot Plugin for JetBrains IDEs
- HEIF Image Extension
- HEVC Video Extensions
- HEVC Video Extensions for Licensed Applications
- HEVC Video Extensions from Device Manufacturer
- Microsoft 365 Apps
- Microsoft Agent Framework SDK
- Microsoft Authentication Library for JavaScript
- Microsoft Configuration Manager 2603
- Microsoft Entra Private Network Connector
- Microsoft Exchange Server Subscription Edition RTM
- Microsoft GDK
- Microsoft HPC Pack 2016
- Microsoft HPC Pack 2019
- Microsoft JDBC Driver
- Microsoft Malware Protection Engine
- Microsoft Office 365
- Microsoft Office LTSC
- Microsoft Power Apps
- Microsoft SQL Server 2017
- Microsoft SQL Server 2019
- Microsoft SQL Server 2022
- Microsoft SQL Server 2025
- Microsoft SharePoint Server Subscription Edition
- Microsoft Teams for Android
- Microsoft Visual Studio 2022
- Microsoft Visual Studio 2026
- Microsoft AspNetCore Http Connections
- Microsoft AspNetCore SignalR StackExchangeRedis
- Microsoft AspNetCore WebUtilities
- Microsoft Data SqlClient
- Microsoft DotNet HotReload Watch Aspire
- Microsoft DotNet Web ProjectTemplates
- Microsoft Extensions Validation
- Microsoft TestPlatform CLI
- Microsoft VisualStudio
- Microsoft dotnet-scaffold
- Microsoft dotnet-scaffold-aspnet
- Office Online Server
- PowerShell
- Raw Image Extension
- System Formats Cbor
- System Text Json
- Visual Studio Code
- Windows 10
- Windows 11
- Windows Admin Center
- Windows App Client for Windows Desktop
- Windows Sandbox
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2012 R2 (Server Core installation)
- Windows Server 2016
- Windows Server 2016 (Server Core installation)
- Windows Server 2019
- Windows Server 2019 (Server Core installation)
- Windows Server 2022
- Windows Server 2022 (Server Core installation)
- Windows Server 2025
- Windows Server 2025 (Server Core installation)
Microsoft indicates that CVE-2026-124194 has been exploited.
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.