CVE-2026-41104

An attacker sends specially crafted data over the network, which the Microsoft Planetary Computer Pro application deserializes without proper verification of its origin and content. The process of deserializing untrusted data can lead to unintended server-side logic execution. The attack vector is network-based, requires no authentication or any user interaction, and the vulnerability affects components outside the direct scope of the application (Scope: Changed).

An attacker can gain unauthorized access to sensitive information processed or stored by Microsoft Planetary Computer Pro. High impact on confidentiality, integrity, and availability indicates the possibility of serious compromise of the environment in which the application operates.

Apply patches available from the vendor according to the references — details regarding the patched version are available in the Microsoft Security Response Center at: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41104

Microsoft Planetary Computer Pro — versions indicated in the vendor's references