Changeflow GovPing Data Privacy & Cybersecurity Microsoft Multiples vulnérabilités - 6 CVEs ide...
Priority review Guidance Added Final

Microsoft Multiples vulnérabilités - 6 CVEs identifiées

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued an advisory on 6 Microsoft CVEs affecting azl3 nodejs24 (versions prior to 24.14.1-1), azl3 opensc (prior to 0.27.1-1), and azl3/cbl2 polkit packages. The vulnerabilities allow attackers to cause unspecified security issues. Affected organizations should apply vendor patches immediately.

View original document View source feed page

What changed

CERT-FR published advisory CERTFR-2026-AVI-0414 detailing 6 CVEs in Microsoft products affecting azl3 nodejs24, azl3 opensc, and azl3/cbl2 polkit packages. The vulnerabilities allow attackers to cause unspecified security issues per the vendor.

System administrators and security teams using these affected packages must refer to Microsoft security bulletins and apply patches immediately to mitigate potential exploitation risks.

What to do next

  1. Apply Microsoft security patches to affected azl3 nodejs24, opensc, and polkit versions
  2. Update azl3 nodejs24 to 24.14.1-1 or later
  3. Update azl3/cbl2 polkit to patched versions

Archived snapshot

Apr 9, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 09 avril 2026 N° CERTFR-2026-AVI-0414 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Microsoft

Gestion du document

| Référence | CERTFR-2026-AVI-0414 |
| Titre | Multiples vulnérabilités dans les produits Microsoft |
| Date de la première version | 09 avril 2026 |
| Date de la dernière version | 09 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft CVE-2026-21712 du 31 mars 2026
Bulletin de sécurité Microsoft CVE-2025-49010 du 01 avril 2026
Bulletin de sécurité Microsoft CVE-2025-66037 du 01 avril 2026
Bulletin de sécurité Microsoft CVE-2025-66038 du 01 avril 2026
Bulletin de sécurité Microsoft CVE-2025-66215 du 01 avril 2026
Bulletin de sécurité Microsoft CVE-2026-21717 du 01 avril 2026
Bulletin de sécurité Microsoft CVE-2026-4897 du 02 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • azl3 nodejs24 24.13.0-3 versions antérieures à 24.14.1-1
  • azl3 opensc 0.26.1-1 versions antérieures à 0.27.1-1
  • azl3 polkit 123-3 versions antérieures à 123-4
  • cbl2 polkit 0.119-4 versions antérieures à 0.119-5

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 09 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Edge Security Vulnerabilities Affecting Bypass and Remote Code Execution
Priority review Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Product Vulnerabilities, 4 CVEs
Priority review Apr 14, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans les produits Microsoft - 13 CVE
Routine Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from ANSSI.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
ANSSI
Published
April 9th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0414

Who this affects

Applies to
Government agencies Technology companies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability patching Security updates Software maintenance
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 65 AI Regulation 3 Banking & Finance 314 Consumer Protection 46 Courts & Legal 361 Data Privacy & Cybersecurity 76 Defense & National Security 51 Education 22 Energy 100 Environment 86 Environmental & Energy 13 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Government Operations 12 Healthcare 136 Healthcare & Life Sciences 6 Housing 16 Immigration 8 Immigration & Border Control 2 Insurance 58 Labor & Employment 115 Legal & Judicial 11 Pharma & Drug Safety 104 Public Health 2 Real Estate & Housing 4 Sanctions & Export Controls 1 Securities & Investments 14 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Commerce 3 Trade & Sanctions 135 Transportation 60

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!