Log collection can become a file-write trust boundary. On October 30, 2026, Microsoft added CVE-2026-92709 for Azure Linux 3.0 rsyslog 8.2308.0-7; its fixed-build field is blank. The upstream advisory was published August 20, not today.
Vendor rating: Microsoft Important; rsyslog High, CVSS 3.1 8.1. Suggested MSP priority: high if an affected template accepts untrusted input.
The upstream advisory covers 1.15.0 onward, with no fully patched release listed. Exposure requires omfile dynaFile, untrusted path components without explicit secure-path handling, attacker influence, and privileges/confinement permitting writes outside the intended directory. Code execution needs additional conditions; default Debian/Ubuntu configurations do not enable this combination.
Vendor mitigation: secure every untrusted path component with securepath, secpath-drop or secpath-replace as appropriate. Compatibility modes introduced in 8.2606.0 are not assumed available in Microsoft’s older listed package. Least privilege and confinement supplement template corrections.
MSP action: inventory actual templates, inputs, privileges and confinement → restrict unnecessary senders without losing required telemetry → apply compatible explicit secure-path handling → validate configuration, test hostile and legitimate path values, confirm logs stay inside approved directories and alerts still arrive.
No active exploitation was verified; this CVE is absent from the checked KEV catalog. No federal deadline or blanket credential-rotation requirement was verified. Last verified October 30, 2026; fixed Azure Linux RPM availability remains unverified.
Official sources: Microsoft CVRF · rsyslog advisory · Vendor-authored CNA record · CISA KEV