Changeflow GovPing Data Privacy & Cybersecurity Multiple Vulnerabilities in Microsoft Azure Lin...
Priority review Guidance Added Final

Multiple Vulnerabilities in Microsoft Azure Linux, 6 CVEs

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

ANSSI's CERT-FR issued an alert covering 6 CVEs in Microsoft Azure Linux components affecting azl3 kernel (versions prior to 6.6.130.1-1), azl3 libsoup (prior to 3.4.4-15), and azl3 xz (prior to 5.4.4-3). The vulnerabilities could allow an attacker to cause unspecified security issues. No specific risk severity was stated by the vendor. French organizations using Azure Linux are advised to apply vendor patches immediately via Microsoft Security Response Center.

View original document View source feed page

What changed

ANSSI's CERT-FR published advisory CERTFR-2026-AVI-0420 disclosing 6 CVEs affecting Microsoft Azure Linux components including the azl3 kernel, libsoup library, and xz utility package. The affected azl3 kernel versions span 0.0.0-1 and 6.6.0.0-1 branches prior to 6.6.130.1-1; azl3 libsoup versions before 3.4.4-15; and azl3 xz versions before 5.4.4-3. The risk level was not specified by Microsoft.

Organizations running Azure Linux in France should immediately consult the Microsoft Security Response Center update guides linked in the advisory and apply the vendor-issued patches to all affected systems. Given the unspecified nature of the security impact, treating these vulnerabilities as high-risk until patched is recommended. As a French national cybersecurity authority advisory, this serves as official guidance for government and private sector entities to prioritize remediation.

What to do next

  1. Apply Microsoft security patches for all 6 listed CVEs (CVE-2026-2436, CVE-2026-34743, CVE-2026-23403 through CVE-2026-23411) to affected azl3 systems immediately
  2. Update azl3 kernel to version 6.6.130.1-1 or later; azl3 libsoup to 3.4.4-15 or later; azl3 xz to 5.4.4-3 or later
  3. Monitor Microsoft MSRC update guide for further patches if immediate patching is not feasible

Archived snapshot

Apr 10, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 10 avril 2026 N° CERTFR-2026-AVI-0420 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Microsoft

Gestion du document

| Référence | CERTFR-2026-AVI-0420 |
| Titre | Multiples vulnérabilités dans les produits Microsoft |
| Date de la première version | 10 avril 2026 |
| Date de la dernière version | 10 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft CVE-2026-2436 du 02 avril 2026
Bulletin de sécurité Microsoft CVE-2026-34743 du 04 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23403 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23404 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23405 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23406 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23407 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23408 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23409 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23410 du 10 avril 2026
Bulletin de sécurité Microsoft CVE-2026-23411 du 10 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • azl3 kernel 0.0.0-1 versions antérieures à 6.6.130.1-1
  • azl3 kernel 6.6.0.0-1 versions antérieures à 6.6.130.1-1
  • azl3 libsoup 3.4.4-14 versions antérieures à 3.4.4-15
  • azl3 xz 5.4.4-2 versions antérieures à 5.4.4-3

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 10 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Ubuntu Linux Kernel Vulnerabilities Allow Arbitrary Code Execution
Priority review Apr 03, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Product Vulnerabilities Advisory
Priority review Mar 30, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple vulnerabilities in GLPI - RCE, SQL injection, XSS
Priority review Apr 08, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from ANSSI.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
ANSSI
Published
April 10th, 2026
Instrument
Guidance
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0420

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Patch management Vulnerability remediation Cloud infrastructure security
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Information Security

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 291 Consumer Protection 44 Courts & Legal 361 Data Privacy & Cybersecurity 73 Defense & National Security 51 Education 19 Energy 100 Environment 86 Environmental Regulation 8 Financial Regulation 2 Government & Legislation 279 Healthcare 136 Housing 16 Immigration 8 Insurance 58 Labor & Employment 113 Pharma & Drug Safety 104 Public Health 2 Securities & Markets 103 Securities Regulation 6 Tax 65 Telecom & Technology 47 Trade & Sanctions 135 Transportation 57

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!