Acknowledgement Updated

Corrected the CVSS Attack Vector metric from Network (AV:N) to Adjacent (AV:A) to reflect the requirement for Layer 2 network adjacency. The CVSS base score has decreased from 9.8 to 8.8. This is an informational change only. Customers who have successfully installed the update do not need to take any further action.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.

Corrected Fixed Build Number and Download links in the Security Updates table. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

The vulnerability associated with this CVE was fixed in July, however was inadvertently not included with that release. Microsoft recommends updating to the most current release of the SharePoint server.

Updated CVE to relect that this vulnerability is in the Windows Subsystem for Linux product. Microsoft recommends that customer using this product should install the latest version to be protected.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Microsoft is aware that the vulnerability for which this CVE was assigned has not been addressed. We are working to prepare and test a complete mitigation. We will update this document when there is more information.

Updated the Security Updates table to list Microsoft Identity Web v3 and v4 separately and clarify the affected version ranges. The existing security updates are versions 3.16.0 and 4.16.1, respectively. This is an informational change only.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.

Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.