# CERT-FR Patch Tuesday Advisory for Windows

Published: 2026-11-12 · Severity: routine
Canonical: https://vorant.io/reports/bec7bf2d-5629-5f9b-aade-e7e22958ce0e/cert-fr-patch-tuesday-advisory-for-windows
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists numerous Microsoft Windows vulnerabilities enabling RCE, privilege escalation, and denial of service; patches required.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1513

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

This CERT-FR bulletin (CERTFR-2026-AVI-1513) compiles multiple vulnerabilities disclosed by Microsoft affecting a broad range of Windows products, including Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025), Windows Admin Center, Windows App Client, and Windows Sandbox. The flaws collectively allow attackers to achieve remote code execution, privilege escalation, denial of service, data integrity and confidentiality breaches, and security policy bypass.

The advisory references over 150 individual CVEs (dated 10 November 2026) tied to the corresponding Microsoft Security Response Center bulletins, consistent with a monthly Patch Tuesday-style cumulative update release. No specific exploitation in the wild is mentioned in the excerpt provided, and no technical details of exploitation chains are disclosed. Defenders should treat this as a standard but large-scale patch advisory requiring prompt deployment of the referenced updates across all affected Windows client, server, and admin tooling to close the listed remote code execution and privilege escalation vectors.

As this is CERT-FR's own primary advisory aggregating Microsoft's official per-CVE bulletins (not a summary of third-party reporting), it should be treated as authoritative patch guidance rather than a rollup of unrelated coverage. Organizations should prioritize patching based on exposure (internet-facing servers, admin consoles) and apply updates to all listed versions, as Microsoft's update guide is the authoritative source for remediation details.

## Mentioned in this report

- Vulnerabilities: CVE-2026-100223, CVE-2026-102200, CVE-2026-102219, CVE-2026-102868, CVE-2026-103571, CVE-2026-105017, CVE-2026-105018, CVE-2026-105020, CVE-2026-105021, CVE-2026-105022, CVE-2026-105023, CVE-2026-105024, CVE-2026-105025, CVE-2026-105026, CVE-2026-105028, CVE-2026-105490, CVE-2026-105491, CVE-2026-105492, CVE-2026-105493, CVE-2026-105495, CVE-2026-105496, CVE-2026-105497, CVE-2026-105498, CVE-2026-105499, CVE-2026-105501, CVE-2026-105503, CVE-2026-105504, CVE-2026-105505, CVE-2026-105506, CVE-2026-105507, CVE-2026-105509, CVE-2026-105510, CVE-2026-105511, CVE-2026-105512, CVE-2026-105513, CVE-2026-105515, CVE-2026-105518, CVE-2026-105520, CVE-2026-108401, CVE-2026-112727

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1513

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bec7bf2d-5629-5f9b-aade-e7e22958ce0e/cert-fr-patch-tuesday-advisory-for-windows.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup