Multiple Critical Vulnerabilities in Microsoft Products Allow Remote Code Execution and Data Exposure
A comprehensive set of security vulnerabilities has been disclosed in numerous Microsoft products affecting a wide range of software including Azure components, Microsoft SQL Server versions from 2017 to 2025, Microsoft Visual Studio, PowerShell, and several Microsoft extensions and SDKs. These vulnerabilities allow attackers to perform remote code execution, elevate privileges, cause denial of service, and bypass security policies, seriously impacting data confidentiality and system integrity. The vulnerabilities were detailed in multiple Microsoft security bulletins published on November 10, 2026, with patched versions provided for affected software. Organizations using these Microsoft products are strongly advised to consult the official Microsoft security update guide and apply all relevant patches immediately to mitigate potential exploitation.
Entenda a falha
A vulnerabilidade
This is a bulletin covering dozens of CVEs across many Microsoft products, published by Microsoft on 10 November 2026. CERT-FR groups the impacts as remote code execution, privilege escalation, denial of service, security policy bypass and loss of data confidentiality. Affected products include Aspire (Dashboard, Cli, Hosting) before 13.6.5, aznfs before 3.0.20, GitHub Copilot Plugin for JetBrains before 1.17.0-251, HEIF Image Extension before 1.2.62.0, Microsoft Agent Framework SDK dotnet before 1.8.77, Microsoft Authentication Library for JavaScript before 5.21.0 and Configuration Manager 2603 before 5.0.9146.1045. CERT-FR also lists SQL Server 2017 to 2025, Exchange Server SE, SharePoint Server SE, Visual Studio, PowerShell 7.6 and 7.7, Visual Studio Code and several .NET libraries. The articles do not say which CVE affects which product, nor what an attacker needs for each one. The fix is to move to the patched versions listed in the Microsoft bulletins.
Como foi descoberta
The articles do not say who found the flaws or how. Microsoft published individual security bulletins for each CVE on 10 November 2026, and CERT-FR consolidated them into advisory CERTFR-2026-AVI-1515 on 12 November 2026. The articles do not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:32.
Linha do tempo
-
Multiple Critical Vulnerabilities in Microsoft Products Allow Remote Code Execution and Data Exposure
ler a análise desta fonte ocultar
A comprehensive set of security vulnerabilities has been disclosed in numerous Microsoft products affecting a wide range of software including Azure components, Microsoft SQL Server versions from 2017 to 2025, Microsoft Visual Studio, PowerShell, and several Microsoft extensions and SDKs. These vulnerabilities allow attackers to perform remote code execution, elevate privileges, cause denial of service, and bypass security policies, seriously impacting data confidentiality and system integrity. The vulnerabilities were detailed in multiple Microsoft security bulletins published on November 10, 2026, with patched versions provided for affected software. Organizations using these Microsoft products are strongly advised to consult the official Microsoft security update guide and apply all relevant patches immediately to mitigate potential exploitation.