Microsoft Azure Linux patches dozens of CVEs

CERT-FR advisory details ~40 vulnerabilities across multiple Azure Linux (azl3) packages including OpenSSH, ClamAV, Node.js, and Vim, with no vendor-specified severity or known exploitation.

CERT-FR has published an advisory summarizing a large batch of vulnerabilities affecting Microsoft Azure Linux (azl3) distribution packages, including clamav, curl, erlang, glib, keras, libXfont2, mtr, nodejs, openssh, perl-DBI, python-msgpack, python-setuptools, telegraf, vim, and xorg-x11-server-Xwayland. Each affected package has a specific version threshold below which systems are considered vulnerable, with fixed versions available from Microsoft.

The advisory does not specify the exact nature of the security impact for each CVE, stating only that a successful attacker could trigger an unspecified security issue. Roughly 40 CVEs are referenced across the affected components, spanning issue disclosure dates from late June through mid-July 2026. This is a standard vendor patch bulletin aggregation rather than a report of active exploitation, targeted campaign, or novel technique.

Organizations running Microsoft Azure Linux 3.0 (azl3) should prioritize patching per the referenced Microsoft Security Response Center bulletins for each CVE. No indicators of compromise, threat actor attribution, or malware association are present in this disclosure; the advisory is purely a consolidated notification of upstream package updates.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0873