# CERT-FR flags multiple Azure vulnerabilities

Published: 2026-11-12 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/ddd4064f-c910-59d9-a696-a6ad7dd33fb3/cert-fr-flags-multiple-azure-vulnerabilities
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists 17 vulnerabilities across Microsoft Azure services enabling RCE, privilege escalation, and data confidentiality breaches.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1514

## What to check

- Applies to: The 17 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR published an advisory consolidating 17 vulnerabilities affecting multiple Microsoft Azure products and services, including Azure Confidential Clean Room, CycleCloud, DevOps Server/Services, File Sync, Azure Local, Machine Learning, Privileged Identity Management (PIM), Virtual Machines, and Web Apps. The vulnerabilities, disclosed via Microsoft's security bulletins dated November 10, 2026, could allow an attacker to achieve remote code execution, escalate privileges, compromise data confidentiality and integrity, or bypass security policies depending on the affected component.

No exploitation in the wild is mentioned in the advisory; this is a routine vulnerability disclosure and patch bulletin rather than a report of active attacks. Defenders operating any of the listed Azure services should consult Microsoft's official security bulletins for each CVE to determine applicability and apply the vendor-supplied patches or version upgrades as soon as possible. Affected version thresholds vary by product (e.g., Azure DevOps Server prior to Patch 10, Azure File Sync versions prior to 23.2, Azure Virtual Machines prior to build 2610), so administrators should verify current deployed versions against the advisory's systems list.

This is a standard CERT-FR vulnerability bulletin aggregating a vendor's own patch release information rather than original research or an active campaign; severity should be assessed per-CVE based on the specific Azure component and exposure in each organization's environment.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102224, CVE-2026-105734, CVE-2026-108470, CVE-2026-109457, CVE-2026-109462, CVE-2026-109467, CVE-2026-112745, CVE-2026-113822, CVE-2026-113823, CVE-2026-114161, CVE-2026-114162, CVE-2026-118288, CVE-2026-118742, CVE-2026-119989, CVE-2026-120783, CVE-2026-121668, CVE-2026-85923

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1514

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ddd4064f-c910-59d9-a696-a6ad7dd33fb3/cert-fr-flags-multiple-azure-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup