If a Swarm worker can reach the manager, check how much trust that connection carries. Also verify that encrypted overlays stay protected after firewall reloads.
Docker published Engine 29.9.3 on November 3. On November 13 at 01:09 UTC, MSRC listed Azure Linux 3.0 moby-engine 25.0.18-1 for CVE-2026-115539 and CVE-2026-115538. Microsoft rates both Important and supplies neither a CVSS score nor a complete Azure Linux affected range in the CVRF. Neither CVE appears in CISA KEV, and the reviewed official material does not confirm exploitation.
CVE-2026-115539 concerns Swarm role escalation when someone has a valid worker-node TLS certificate and its private key and a leader change occurs. CVE-2026-115538 concerns loss of encryption and spoofing protection for encrypted Swarm overlays after firewalld reloads and flushes Docker rules. Confirm Swarm mode, manager reachability and whether encrypted overlays and firewalld are in use. Docker’s November 10 CNA records rate CVE-2026-115539 High at CVSS 4.0 7.7 and CVE-2026-115538 High at 7.0. Docker Engine 29.9.3 contains both fixes. The upstream Moby fix starts at 2.0.0-beta.29, and SwarmKit v2 builds below 2.1.3 are affected by CVE-2026-115539.
Suggested MSP priority. Expedite clusters spanning trust zones and clusters where worker keys may be exposed. Restrict Swarm management traffic to intended nodes. After any firewall reload, validate overlay protection and isolate affected traffic if protections fail. Docker Engine 29.9.3 contains the upstream fixes. Microsoft has not identified a fixed Azure Linux RPM in the reviewed CVRF. Apply the signed fix supported by the deployed product, then verify manager and worker roles and encrypted traffic behavior after a controlled reload.
Last verified November 13, 2026 UTC. MSRC November CVRF · Docker Engine 29.9.3 release notes · Azure Linux production packages · CISA KEV · Docker CNA CVE-2026-115539 · Moby overlay advisory.