# Multiple Azure Linux kernel and library vulnerabilities patched

Published: 2026-07-10 · Severity: elevated · Sectors: infrastructure, technology
Canonical: https://vorant.io/reports/0f453a41-e737-54b9-9730-dd28635b935b/multiple-azure-linux-kernel-and-library-vulnerabilities-patched

> CERT-FR advisory covering 80+ CVEs in Azure Linux 3 kernel, libarchive, libreswan, libtiff, and nginx requiring immediate updates.

CERT-FR has published a security advisory for multiple vulnerabilities discovered in Microsoft Azure Linux (azl3). The affected components include the kernel (6.6.139.1-1 and earlier), libarchive (3.7.7-6 and earlier), libreswan (4.15-1 and earlier), libtiff (4.6.0-13 and earlier), and nginx (1.28.3-6 and earlier). Microsoft has released patched versions addressing all identified CVEs across a series of bulletins published between 27 June and 9 July 2026.

The advisory does not provide specific attack impact details, severity ratings, or CVSS scores from Microsoft, only referencing that vulnerabilities allow attackers to cause unspecified security problems. Organizations running Azure Linux 3 instances should prioritize updating affected packages to the patched versions: kernel 6.6.143.1-1 or later, libarchive 3.7.7-7 or later, libreswan 4.15-2 or later, libtiff 4.6.0-14 or later, and nginx 1.28.3-7 or later.

Defenders should inventory systems running these components and apply updates according to their change-management procedures. The breadth of affected packages suggests this represents a routine maintenance cycle rather than a critical emergency, but prompt patching remains advisable for systems exposed to untrusted input or network access.

## Mentioned in this report

- Vulnerabilities: CVE-2026-52920, CVE-2026-52925, CVE-2026-52933, CVE-2026-52936, CVE-2026-52958, CVE-2026-52963, CVE-2026-52967, CVE-2026-52968, CVE-2026-52969, CVE-2026-52970, CVE-2026-52972, CVE-2026-52974, CVE-2026-52975, CVE-2026-52977, CVE-2026-52981, CVE-2026-52982, CVE-2026-52984, CVE-2026-52985, CVE-2026-52986, CVE-2026-52989, CVE-2026-52993, CVE-2026-52998, CVE-2026-52999, CVE-2026-53002, CVE-2026-53003, CVE-2026-53006, CVE-2026-53011, CVE-2026-53012, CVE-2026-53013, CVE-2026-53021, CVE-2026-53022, CVE-2026-53023, CVE-2026-53032, CVE-2026-53034, CVE-2026-53035, CVE-2026-53036, CVE-2026-53037, CVE-2026-53047, CVE-2026-53050, CVE-2026-53056

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0866

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0f453a41-e737-54b9-9730-dd28635b935b/multiple-azure-linux-kernel-and-library-vulnerabilities-patched.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup