/
← Voltar ao feed
high

CERT-FR: Multiple Microsoft product vulnerabilities allow remote code execution, privilege escalation and DoS (October 2026 patches)

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 21:00 · coletado há 7 horas

CERT-FR advisory CERTFR-2026-AVI-1316 reports multiple vulnerabilities across Microsoft products, based on Microsoft security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and confidentiality breaches and security policy bypass. The advisory does not state whether any of the flaws are exploited in the wild and gives no technical detail or attribution.

Technical Details

  • Affected products include Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, Subscription Edition RTM), SharePoint Server (2016, 2019, Subscription Edition), SQL Server (2017, 2019, 2022, 2025), Configuration Manager (2503, 2509, 2603), Skype for Business Server, Dynamics NAV, Visual Studio 2022/2026, Visual Studio Code, PowerShell 7.4/7.5/7.6, PowerToys, Paint, Power Apps, Sysinternals Suite, Microsoft Defender for Endpoint for Linux, the Linux kernel Microsoft MANA network driver, HEVC/MPEG-2/Raw Image codec extensions, and several ASP.NET Core and System.Security.Cryptography NuGet packages.
  • The advisory lists about 90 CVE identifiers, each with its own Microsoft bulletin.
  • No IOCs, exploitation status or per-CVE severity are given in the advisory.

Remediation

  • Consult the Microsoft security bulletins (MSRC Update Guide) for each CVE and apply the fixed versions listed there.
  • Prioritise internet-facing servers such as Exchange and SharePoint.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 13/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Microsoft product vulnerabilities allow remote code execution, privilege escalation and DoS (October 2026 patches)

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1316 reports multiple vulnerabilities across Microsoft products, based on Microsoft security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and confidentiality breaches and security policy bypass. The advisory does not state whether any of the flaws are exploited in the wild and gives no technical detail or attribution.

    Technical Details

    • Affected products include Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, Subscription Edition RTM), SharePoint Server (2016, 2019, Subscription Edition), SQL Server (2017, 2019, 2022, 2025), Configuration Manager (2503, 2509, 2603), Skype for Business Server, Dynamics NAV, Visual Studio 2022/2026, Visual Studio Code, PowerShell 7.4/7.5/7.6, PowerToys, Paint, Power Apps, Sysinternals Suite, Microsoft Defender for Endpoint for Linux, the Linux kernel Microsoft MANA network driver, HEVC/MPEG-2/Raw Image codec extensions, and several ASP.NET Core and System.Security.Cryptography NuGet packages.
    • The advisory lists about 90 CVE identifiers, each with its own Microsoft bulletin.
    • No IOCs, exploitation status or per-CVE severity are given in the advisory.

    Remediation

    • Consult the Microsoft security bulletins (MSRC Update Guide) for each CVE and apply the fixed versions listed there.
    • Prioritise internet-facing servers such as Exchange and SharePoint.