CERT-FR Patch Tuesday bulletin: Microsoft products
CERT-FR advisory covers numerous Microsoft products affected by vulnerabilities allowing RCE, privilege escalation, DoS, and data exposure; apply vendor patches.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
This CERT-FR advisory (CERTFR-2026-AVI-1515) is the French national CERT's monthly roundup of Microsoft security bulletins published on November 10, 2026, as part of Patch Tuesday. It enumerates a very large number of affected Microsoft products and components, including Windows extensions (HEIF, HEVC, Raw Image), SQL Server (2017-2025), Visual Studio, Exchange Server, SharePoint Server, PowerShell, .NET/ASP.NET Core libraries, Microsoft Teams for Android, Entra Private Network Connector, Configuration Manager, and various developer tooling (Aspire, dotnet-scaffold, JDBC drivers). The risks identified span remote code execution, privilege escalation, denial of service, confidentiality breaches, and security bypass.
The advisory lists well over 100 distinct CVE identifiers, each pointing to a separate Microsoft Security Response Center (MSRC) bulletin, without detailing exploitation status, severity scoring, or technical specifics for individual CVEs in the truncated text provided. As a primary-source national CERT bulletin aggregating the vendor's own monthly patch release, this is standard Patch Tuesday reporting rather than a rollup of third-party research. Defenders should treat this as a reminder to apply the November 2026 Microsoft cumulative updates across affected products, prioritizing patching based on exploitability and criticality of each specific CVE as detailed in the corresponding MSRC entries, since the CERT-FR advisory itself provides no indication that any of these flaws are being actively exploited in the wild.
Given the sheer volume and breadth of products covered (ranging from core OS components to developer SDKs and cloud connectors), organizations should inventory which of the listed products are in use within their environment and cross-reference the specific CVE IDs against MSRC for CVSS scores and exploitability assessments before prioritizing remediation.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1515
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs