/
← Voltar ao feed
high

CERT-FR: Multiple Microsoft vulnerabilities (SharePoint, Visual Studio, Identity libraries, System.Formats.Cbor) allow RCE, DoS

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 21:00 · coletado há 10 horas

CERT-FR advisory CERTFR-2026-AVI-1332, published 16 October 2026, reports multiple vulnerabilities in Microsoft products that may allow remote arbitrary code execution, privilege escalation, remote denial of service and breach of data confidentiality. The advisory is based on Microsoft security bulletins dated 15 October 2026 for four CVEs. It does not provide CVSS scores, exploitation status, IOCs or attribution, and does not map individual CVEs to specific products.

Technical Details

  • Affected: Microsoft Identity Client for NodeJS versions prior to 7.1.0.
  • Affected: Microsoft SharePoint Server Subscription Edition versions prior to 16.0.20326.20190.
  • Affected: Microsoft Visual Studio 2022 17.14 prior to 17.14.42.
  • Affected: Microsoft Visual Studio 2026 18.10 prior to 18.10.4.
  • Affected: microsoft-identity-web versions prior to 3.16.0.
  • Affected: System.Formats.Cbor versions prior to 10.0.13, 8.0.1 and 9.0.21.
  • CVEs: CVE-2026-108452, CVE-2026-109461, CVE-2026-109468, CVE-2026-80092.

Remediation

  • Consult the Microsoft MSRC bulletins for each CVE and apply the fixed versions listed above.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 15/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Microsoft vulnerabilities (SharePoint, Visual Studio, Identity libraries, System.Formats.Cbor) allow RCE, DoS

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1332, published 16 October 2026, reports multiple vulnerabilities in Microsoft products that may allow remote arbitrary code execution, privilege escalation, remote denial of service and breach of data confidentiality. The advisory is based on Microsoft security bulletins dated 15 October 2026 for four CVEs. It does not provide CVSS scores, exploitation status, IOCs or attribution, and does not map individual CVEs to specific products.

    Technical Details

    • Affected: Microsoft Identity Client for NodeJS versions prior to 7.1.0.
    • Affected: Microsoft SharePoint Server Subscription Edition versions prior to 16.0.20326.20190.
    • Affected: Microsoft Visual Studio 2022 17.14 prior to 17.14.42.
    • Affected: Microsoft Visual Studio 2026 18.10 prior to 18.10.4.
    • Affected: microsoft-identity-web versions prior to 3.16.0.
    • Affected: System.Formats.Cbor versions prior to 10.0.13, 8.0.1 and 9.0.21.
    • CVEs: CVE-2026-108452, CVE-2026-109461, CVE-2026-109468, CVE-2026-80092.

    Remediation

    • Consult the Microsoft MSRC bulletins for each CVE and apply the fixed versions listed above.