CVE-2026-11824,CVE-2026-11822 - Azure CLI bundles sqlite3.dll 3.50.4.0, below upstream security fix 3.53.2

### Describe the bug

Our vulnerability scanner detected an outdated SQLite library installed with
Azure CLI for Windows:

Path:
C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll

Installed file version:
3.50.4.0

Scanner remediation threshold:
3.53.2

The finding appears to correspond to SQLite vulnerabilities fixed upstream in
SQLite 3.53.2, including CVE-2026-11822 and CVE-2026-11824, which affect the
FTS5 extension in builds compiled with SQLITE_ENABLE_FTS5.

Could the Azure CLI team please confirm if whether this is assessed as exploitable in Azure CLI and the planned Azure CLI version/ETA containing SQLite 3.53.2 or later. Thank you.

For info:

Scanner used: Nessus

```powershell
PS C:\Users\> $cliDll = 'C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll'
PS C:\Users\> Write-Output '=== Azure CLI SQLite DLL ==='
=== Azure CLI SQLite DLL ===
PS C:\Users\> Get-Item $cliDll | Select-Object `
>> FullName,
>> Length,
>> LastWriteTime,
>> @{Name='FileVersion'; Expression = { $_.VersionInfo.FileVersion }},
>> @{Name='ProductVersion'; Expression = { $_.VersionInfo.ProductVersion }}

FullName : C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll
Length : 1584864
LastWriteTime : 6/10/2026 11:30:36 AM
FileVersion : 3.50.4.0
ProductVersion : 3.50.4.0

PS C:\Users\>
PS C:\Users\> Write-Output "`n=== SQLite DLL SHA-256 ==="

=== SQLite DLL SHA-256 ===
PS C:\Users\> Get-FileHash $cliDll -Algorithm SHA256

Algorithm Hash Path
--------- ---- ----
SHA256 2940BEE51C4A00C7E8F2A8A1BE857D4C4AD23B2657FBF7FDF18E3A3FD20066C6 C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll

PS C:\Users\>
PS C:\Users\> Write-Output "`n=== Azure CLI Version ==="

=== Azure CLI Version ===
PS C:\Users\> az version
{
"azure-cli": "2.90.0",
"azure-cli-core": "2.90.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"log-analytics": "1.0.0b1"
}
}
PS C:\Users\> Write-Output "`n=== Windows OS ==="

=== Windows OS ===
PS C:\Users\> Get-CimInstance -ClassName Win32_OperatingSystem |
>> Select-Object `
>> Caption,
>> Version,
>> BuildNumber,
>> OSArchitecture,
>> LastBootUpTime

Caption : Microsoft Windows Server 2022 Datacenter
Version : 10.0.20348
BuildNumber : 20348
OSArchitecture : 64-bit
LastBootUpTime : 8/13/2026 5:30:06 AM

PS C:\Users\> Write-Output "`n=== Windows Release Details ==="

=== Windows Release Details ===
PS C:\Users\> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
>> Select-Object `
>> ProductName,
>> DisplayVersion,
>> CurrentBuildNumber,
>> UBR,
>> EditionID,
>> InstallationType

ProductName : Windows Server 2022 Datacenter
DisplayVersion : 21H2
CurrentBuildNumber : 20348
UBR : 5499
EditionID : ServerDatacenter
InstallationType : Server
```

### Related command

No commands related to this

### Errors

No errors on the commands as this is flagged on a security scanner

### Issue script & Debug output

N/A

### Expected behavior

Vulnerability should be addressed.

### Environment Summary

azure-cli 2.90.0

core 2.90.0
telemetry 1.1.0

Extensions:
log-analytics 1.0.0b1

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\\.azure'
Extensions directory 'C:\Users\\.azure\cliextensions'

Python (Windows) 3.14.6 (tags/v3.14.6:c63aec6, Jun 10 2026, 10:26:10) [MSC v.1944 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

### Additional context

_No response_