TI-2026-33291 Aliases CVE-2026-45539 GHSA-q5pp-gvjg-h7v4

Information disclosure in Microsoft apm

LOW 33CWE-200Published 2026-05-15 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00654 51st percentileScored 2026-11-07

Fix Fixed apm (microsoft): 0.13.0apm (PyPI): 0.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	apm	0.5.4 to before 0.13.0	0.13.0	Patch available	CNA
—	apm (PyPI)	0.5.4 to before 0.13.0	0.13.0	Patch available	GHSA-q5pp-gvjg-h7v4

apm VendorMicrosoft Affected 0.5.4 to before 0.13.0 Fixed in 0.13.0 Patch available CNA
apm (PyPI) Vendor— Affected 0.5.4 to before 0.13.0 Fixed in 0.13.0 Patch available GHSA-q5pp-gvjg-h7v4

Remediation

Fix · CNA apm (microsoft) Fixed in 0.13.0
Fix · GHSA-q5pp-gvjg-h7v4 apm (PyPI) Fixed in 0.13.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45539
2026-10-03 Alias added: GHSA-q5pp-gvjg-h7v4

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45539

Other 4

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences