Check the application that uses libcurl. Project curl says this issue requires FTP wildcard mode and does not affect the curl command-line tool.
Project curl published CVE-2026-92388 on October 14. MSRC’s November 13 revision at 01:43 UTC adds Azure Linux 3.0 curl 8.11.1-14 as fixed for its affected 8.11.1-12 package. The production x86-64 and Arm64 indexes list the fixed package. Microsoft rates the Azure Linux row Critical, CVSS 3.1 9.1. Project curl rates the upstream issue Low and describes application-specific callback and handle reuse prerequisites. Neither source confirms exploitation, and CISA KEV does not list this CVE.
Project curl lists upstream 7.21.0 through 8.22.0 with fixes in 8.23.0 and maintained branches 8.20.2, 8.16.2 and 8.14.3. Microsoft’s fixed version is a distribution backport. The Microsoft CVRF does not enumerate every older affected Azure Linux package.
Suggested MSP priority. Expedite customer-facing file-transfer and automation services that enable FTP wildcard listings and connect to servers outside their trust boundary. If patching must wait, disable that feature where feasible. Apply the signed Azure Linux package, restart dependent services or rebuild images, verify the library in use and retest transfers. The reviewed sources give no compromise-check or rotation requirement.
Last verified November 13, 2026 UTC. MSRC October CVRF · Project curl advisory · Azure Linux x86-64 packages · Azure Linux Arm64 packages.