Vendor advisories

Microsoft Security Response Center

Browse 15,985 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours

15,985 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2025-21949
HighCVSS 7.8

LoongArch: Set hugetlb mmap base address aligned with pmd size

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2024-38608
MediumCVSS 5.5

net/mlx5e: Fix netif state handling

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.104.2-4 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2025-29923
LowCVSS 3.7

go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 telegraf 1.31.0-10 on Azure Linux 3.0, azl3 telegraf 1.31.0-11 on Azure Linux 3.0, azl3 telegraf 1.31.0-12 on Azure Linux 3.0, azl3 telegraf 1.31.0-17 on Azure Linux 3.0
Fixed versions1.31.0-24, 2.14.1-5, 1.31.0-27
Vendor guidance

CBL-Mariner Releases

Microsoft Security Response CenterCVE-2024-41085
MediumCVSS 5.5

cxl/mem: Fix no cxl_nvd during pmem region auto-assembling

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.117.1-1 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2025-21723
MediumCVSS 5.5

scsi: mpi3mr: Fix possible crash when setting up bsg fails

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 kernel 6.6.96.2-1 on Azure Linux 3.0, azl3 kernel 6.6.96.2-2 on Azure Linux 3.0, azl3 kernel 6.6.112.1-2 on Azure Linux 3.0, azl3 kernel 6.6.119.3-1 on Azure Linux 3.0
Microsoft Security Response CenterCVE-2021-34474
CriticalCVSS 8.0

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). Can the exploit move from Dynamics Business Central to the underlying operating system? An attacker who successfully exploited this vulnerability could use it to pivot from the machine ...

Affected productsMicrosoft Dynamics 365 Business Central 2020 Release Wave 1 - Update 16.14, Microsoft Dynamics 365 Business Central 2020 Release Wave 2 - Update 17.8, Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.3
Fixed versions16.0.27253, 17.0.27235, 18.0.27469
Vendor guidance

Install KB5004717. Install KB5004716. Install KB5004715.

Microsoft Security Response CenterCVE-2023-38167
HighCVSS 7.2

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

According to the CVSS metric, privileges required is high (PR:H). What privileges does an attacker require to exploit this vulnerability? Successful exploitation of this vulnerability requires an attacker to already have admin or high privilege access to a security group withi...

Affected productsMicrosoft Dynamics 365 Business Central 2023 Release Wave 1
Fixed versions22.0.59520
Vendor guidance

Install KB5029765.

Microsoft Security Response CenterCVE-2024-35249
HighCVSS 8.8

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

Affected productsMicrosoft Dynamics 365 Business Central 2024 Release Wave 1, Microsoft Dynamics 365 Business Central 2023 Release Wave 1, Microsoft Dynamics 365 Business Central 2023 Release Wave 2
Fixed versions24.0.19487, 22.0.64336, 23.0.18933
Vendor guidance

Install KB5038531. Install KB5038529. Install KB5038530.

Microsoft Security Response CenterCVE-2025-29821
HighCVSS 5.5

Microsoft Dynamics Business Central Information Disclosure Vulnerability

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

Affected productsMicrosoft Dynamics 365 Business Central Wave 1 2024 - Update 24.12, Microsoft Dynamics 365 Business Central 2023 Wave 2 - Update 23.18, Microsoft Dynamics 365 Business Central 2024 Wave 2 - Update 25.6, Microsoft Dynamics 365 Business Central 2025 Wave 1 - Update 26.0
Fixed versions24.0.32305, 23.0.32309, 25.2.32308, 26.0.32481
Vendor guidance

Release Notes Install KB5056717. Install KB5056716. Install KB5056718.

Microsoft Security Response CenterCVE-2026-40417
HighCVSS 7.8

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.

Affected productsMicrosoft Dynamics 365 Business Central 2026 Release Wave 1, Microsoft Dynamics 365 Business Central Release Wave 1 2025, Microsoft Dynamics 365 Business Central Release Wave 2 2025, Microsoft Dynamics 365 Business Central 2024 Release Wave 2
Fixed versions28.0.49873, 26.0.48120, 27.0.48102, 25.2.48119
Vendor guidance

Install KB5093780. Install KB5086069. Install KB5086070. Install KB5086068.

Microsoft Security Response CenterCVE-2023-51580
MediumCVSS 5.4

BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productsazl3 bluez 5.63-6 on Azure Linux 3.0, cbl2 bluez 5.63-6 on CBL Mariner 2.0, cbl2 bluez 5.63-6, cbl2 bluez 5.63-6 on CBL-Mariner 2.0
Microsoft Security Response CenterCVE-2023-51592
MediumCVSS 5.4

BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability? One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the mos...

Affected productscbl2 bluez 5.63-6, cbl2 bluez 5.63-6 on CBL Mariner 2.0, azl3 bluez 5.63-6 on Azure Linux 3.0, cbl2 bluez 5.63-6 on CBL-Mariner 2.0
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources