← Lark216 Home

Microsoft Update Intelligence

Administrator notices from Microsoft, summarised: what changed, and what you should do.

Latest Weekly DigestOct 19 – Oct 25, 20264 service updates · 1 security advisory →
0Action Required 270Review Recommended

Last updated Oct 29, 2026 9:59 PM EDT

Microsoft Services
Product families
Microsoft 365
Clear
Needs Attention All Updates
7,996 results
Advanced Filters
Not analysed

CVE-2026-115889: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

Severity Critical Exploited not stated Disclosed not stated Affects azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Critical · CVSS 9.9
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115893: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction

Severity Critical Exploited not stated Disclosed not stated Affects azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Critical · CVSS 9.9
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-16762: Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 qtbase 6.6.3-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115775: Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-twisted 22.10.0-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115774: Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-twisted 22.10.0-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 4.9
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115778: Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-twisted 22.10.0-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 7.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115776: Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-twisted 22.10.0-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 7.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115877: Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-twisted 22.10.0-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.4
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115897: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

Severity Low Exploited not stated Disclosed not stated Affects azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Low
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115754: serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body

Severity Low Exploited not stated Disclosed not stated Affects azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Low · CVSS 4.7
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-116137: adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 3.7
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115484: Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Severity Important Exploited not stated Disclosed not stated Affects azl3 iscsi-initiator-utils 2.1.12-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Important · CVSS 7.6
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115486: Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 iscsi-initiator-utils 2.1.12-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 7.1
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-115485: Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 iscsi-initiator-utils 2.1.12-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 6.3
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99216: Drivers: hv: Don't reset VMBus connection state on error/exit paths

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99215: power: supply: core: prevent unregistering a power supply while a callback runs

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99213: vsock: treat TCP_CLOSING as once-established

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99212: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99211: netlink: reset skb headers before unicast and multicast filtering

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 5.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99206: scsi: target: iscsi: Fix race in discovery auth updates

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 4.1
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99204: ocfs2/dlm: Protect the recovery list during debugfs reads

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 7.1
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99203: pipe: preserve existing fasync readers on writer setup failure

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 4.7
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99192: net: bcmgenet: unshare the skb before writing the control block

Severity Important Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Important · CVSS 7.8
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published
Not analysed

CVE-2026-99191: calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()

Severity Moderate Exploited not stated Disclosed not stated Affects azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 Fix see release notes
Azure Linux · msrc Original Microsoft announcement ↗
Details
Severity
Moderate · CVSS 6.5
Type
Security updates
Tags
Mariner, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: not stated · Publicly disclosed: not stated · Remediation: update published