What’s Vulnerable › Products

microsoft apm vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your microsoft apm version is affected

Latest microsoft apm vulnerabilities

• CVE-2026-46383 — Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install` (CVSS 5.5)
• CVE-2026-45539 — Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree (CVSS 7.4)
• CVE-2026-44641 — Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install (CVSS 7.1)