CERT-FR Patch Tuesday Advisory for Windows
CERT-FR advisory lists numerous Microsoft Windows vulnerabilities enabling RCE, privilege escalation, and denial of service; patches required.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
This CERT-FR bulletin (CERTFR-2026-AVI-1513) compiles multiple vulnerabilities disclosed by Microsoft affecting a broad range of Windows products, including Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025), Windows Admin Center, Windows App Client, and Windows Sandbox. The flaws collectively allow attackers to achieve remote code execution, privilege escalation, denial of service, data integrity and confidentiality breaches, and security policy bypass.
The advisory references over 150 individual CVEs (dated 10 November 2026) tied to the corresponding Microsoft Security Response Center bulletins, consistent with a monthly Patch Tuesday-style cumulative update release. No specific exploitation in the wild is mentioned in the excerpt provided, and no technical details of exploitation chains are disclosed. Defenders should treat this as a standard but large-scale patch advisory requiring prompt deployment of the referenced updates across all affected Windows client, server, and admin tooling to close the listed remote code execution and privilege escalation vectors.
As this is CERT-FR's own primary advisory aggregating Microsoft's official per-CVE bulletins (not a summary of third-party reporting), it should be treated as authoritative patch guidance rather than a rollup of unrelated coverage. Organizations should prioritize patching based on exposure (internet-facing servers, admin consoles) and apply updates to all listed versions, as Microsoft's update guide is the authoritative source for remediation details.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1513
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs