If your Azure Linux automation uploads mail or sends credentials through a proxy, check the curl RPM it actually uses.
What changed November 10, 2026. MSRC’s October CVRF revisions from 14:42 to 14:43 UTC now list curl 8.11.1-13 as the fixed build for the 8.11.1-12 Azure Linux 3.0 row across 14 CVEs. Eight CVEs also list 8.11.1-11 with a blank fixed-build field. CVE-2026-107929 also lists a Rust package with a separate, blank fix field.
What changed November 11, 2026. Microsoft’s production metadata now lists curl and curl-libs 8.11.1-13.azl3 for x86-64 and Arm64. The repositories list the November 11 packages at 14:55 UTC and 15:02 UTC respectively. Update the matching packages, rebuild any affected images, and verify what library the running application loads. The older curl rows and separate Rust row still need their own applicability checks.
Publication dates. Microsoft first published the individual CVE mappings on separate dates. The fix-matrix revisions described here were published November 10, 2026.
Check the workflows that use curl
For CVE-2026-87864, MSRC rates the curl rows Important, CVSS 3.1 8.2. The curl project published its advisory October 14. Check IMAP uploads that enable CRLF conversion and accept untrusted message content. For CVE-2026-86414, MSRC rates the rows Moderate, CVSS 3.1 7.5. Check whether authenticated HTTP transfers pass through a proxy. For CVE-2026-94266, MSRC rates the curl row Moderate, CVSS 3.1 5.9. Review applications that log the effective URL after transfers.
MSRC lists both 8.11.1-11 and 8.11.1-12 for CVE-2026-86410, CVE-2026-86414, CVE-2026-87862, CVE-2026-87863, CVE-2026-87864, CVE-2026-92386, CVE-2026-92387 and CVE-2026-92391. The listed curl build is 8.11.1-12 for CVE-2026-107929, CVE-2026-86409, CVE-2026-87865, CVE-2026-92389, CVE-2026-92390 and CVE-2026-94266.
MSP action
Suggested priority is high for credential-bearing proxy traffic or affected IMAP upload jobs. Inventory the installed RPM and the libcurl copy actually loaded by applications and containers. If the workflow allows it, avoid CRLF conversion on untrusted IMAP uploads, restrict untrusted redirect schemes and avoid logging sensitive URLs while waiting for the update. Use the supported Azure Linux repository with signature checking enabled. Patch or rebuild affected images, restart workloads and verify the package build and transfer tests. Review proxy and application logs for credential exposure and rotate affected credentials if exposure is found.
Official sources
MSRC October CVRF · MSRC CVE-2026-87864 · curl IMAP advisory · curl proxy advisory · curl effective URL advisory · Microsoft x86-64 package index · Microsoft Arm64 package index · Azure Linux upgrade guide · CISA KEV
Last verified November 11, 2026. MSRC’s exploitation fields contain no determination in these rows. No confirmed active exploitation or mandatory incident-response action was verified in the reviewed advisories. The listed CVEs are absent from CISA’s 1,779-record KEV catalog, so there is no KEV federal deadline for them.