A file upload or JSON endpoint can look routine while trusting the wrong input. Microsoft’s new Azure Linux entries make Perl CGI worth an application-level check across any customer environment that actually uses it.
What is new — November 7, 2026: MSRC added CVE-2026-120640 at 01:04:12 UTC and CVE-2026-120641 at 01:03:24 UTC to its November CVRF data. Both name azl3 perl-CGI 4.60-1 on Azure Linux 3.0. CPANSec originally published both CVEs on November 3; this is new Microsoft applicability information, not a newly discovered Windows or Microsoft 365 flaw. Last verified: November 7, 2026 UTC.
Applicability and priority
Upstream CGI versions below 5.00 are affected. CVE-2026-120640 lets query/form input populate POSTDATA, PUTDATA, PATCHDATA or XForms:Model, which matters when an application treats those parameters as the real request body. CVE-2026-120641 preserves client-supplied upload paths, which matters when an application saves a file using that name. Check installed packages, application dependencies, container images and the actual endpoint behavior; Azure hosting alone does not establish exposure.
Vendor facts: Microsoft rates each Important and publishes a CVSS v3.1 base score of 9.1. Suggested MSP priority: prioritize reachable upload endpoints and request-body trust boundaries for validation and containment. Do not assume every CGI application is exploitable.
Fixes, limits and exploitation status
CPANSec directs upgrading to CGI 5.00 or later; the maintainer’s November 3 security release confirms both fixes. Microsoft’s CVRF has an empty FixedBuild and no specific KB or RPM download for these rows. A fixed Azure Linux RPM or AKS image is not verified here. Use the supported Microsoft/package-owner path and verify the actual installed build; an upstream version or open pull request does not establish package availability.
If upgrading is blocked, CPANSec advises checking the request Content-Type before trusting param(‘POSTDATA’) and not using a client-supplied upload filename as a path. These are application changes for the relevant code paths, not a blanket WAF workaround. CGI 5.00 changes defaults, including upload-name sanitization, request limits and forwarded-host handling, and requires Perl 5.10 or later; test legitimate traffic before rollout.
Neither CVE is in CISA’s current full KEV catalog. The reviewed Microsoft and CPANSec material does not confirm active exploitation; no KEV addition date or federal deadline applies. No vendor-directed compromise scan or credential-rotation requirement was found in these records. Absence from KEV does not mean absence of exploitation.
What I would do across customer environments
- Inventory Azure Linux 3.0 perl-CGI and separately packaged CGI modules, then identify reachable upload and request-body consumers. Record each customer’s actual applicability.
- Where the vulnerable behavior is confirmed and a supported fix is pending, restrict or suspend the affected endpoint as appropriate and apply the relevant application validation workaround.
- Deploy a supported fixed package/application release after compatibility testing. For AKS, follow Microsoft’s node-image/package update guidance, and separately rebuild application container images that bundle CGI.
- Verify the loaded CGI version and package provenance, upload path confinement, Content-Type enforcement and normal application behavior. Keep remediation open until the supported fix or effective mitigation is evidenced.
Official sources: Microsoft November CVRF data; MSRC CVE-2026-120640; MSRC CVE-2026-120641; CPANSec CNA record: 120640; CPANSec CNA record: 120641; CGI 5.00 maintainer release notes; Microsoft Azure Linux upgrade guidance; CISA KEV data.