Changeflow GovPing Data Privacy & Cybersecurity Multiples vulnérabilités dans les produits Micr...
Priority review Guidance Added Final

Multiples vulnérabilités dans les produits Microsoft

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued advisory CERTFR-2026-AVI-0486 disclosing four Microsoft vulnerabilities affecting azl3 packages (gh, haproxy, ntfs-3g, openssl, telegraf). The CVEs (CVE-2026-28387, CVE-2026-33555, CVE-2026-5160, CVE-2026-40706) were published by Microsoft between April 9-23, 2026. Organizations using affected package versions should consult Microsoft security bulletins and apply available patches.

“De multiples vulnérabilités ont été découvertes dans les produits Microsoft.”

— CERT-FR , verbatim from source
Why this matters

Organizations running Alpine Linux systems with azl3 gh (prior to 2.62.0-15), haproxy (prior to 2.9.11-5), ntfs-3g (prior to 2022.10.3-3), openssl (prior to 3.3.7-1), or telegraf (prior to 1.31.0-19) should inventory these packages immediately and monitor Microsoft's update guide for patches addressing CVE-2026-28387, CVE-2026-33555, CVE-2026-5160, and CVE-2026-40706.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

CERT-FR is the French government's national cybersecurity incident response team, run by the ANSSI. Their advisory feed publishes vulnerability disclosures, active exploitation warnings, and emergency patching guidance for software in widespread enterprise use: browsers, hypervisors, ERP systems, network equipment, file transfer products. Around 180 advisories a month. The advisories are written in French but cover the same vulnerability universe as CISA, NCSC-UK, BSI's CERT-Bund, and JPCERT, often hours earlier on European-headquartered vendors. Watch this if you patch enterprise software, run a SOC, write detection content, or track Schneider, Dassault, OVH, Atos, or any French-vendor advisory faster than English-language sources will surface it. GovPing publishes each advisory with the affected vendor, severity, and CERT-FR link.

View original document View source feed page

What changed

CERT-FR issued an advisory documenting four Microsoft security vulnerabilities affecting azl3 package versions. Specific affected versions include gh prior to 2.62.0-15, haproxy prior to 2.9.11-5, ntfs-3g prior to 2022.10.3-3, openssl prior to 3.3.7-1, and telegraf prior to 1.31.0-19. Organizations using these packages should reference Microsoft security bulletins for available patches and apply updates as necessary.

Affected parties include organizations running azl3-based systems with older package versions. The advisory recommends consulting Microsoft's security bulletins for patch availability, with links to four specific CVE advisories spanning April 9-23, 2026.

What to do next

  1. Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs

Archived snapshot

Apr 23, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 23 avril 2026 N° CERTFR-2026-AVI-0486 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Microsoft

Gestion du document

| Référence | CERTFR-2026-AVI-0486 |
| Titre | Multiples vulnérabilités dans les produits Microsoft |
| Date de la première version | 23 avril 2026 |
| Date de la dernière version | 23 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft CVE-2026-28387 du 09 avril 2026
Bulletin de sécurité Microsoft CVE-2026-33555 du 15 avril 2026
Bulletin de sécurité Microsoft CVE-2026-5160 du 19 avril 2026
Bulletin de sécurité Microsoft CVE-2026-40706 du 23 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • azl3 gh 2.62.0-13 versions antérieures à 2.62.0-15
  • azl3 haproxy 2.9.11-4 versions antérieures à 2.9.11-5
  • azl3 ntfs-3g 2022.10.3-2 versions antérieures à 2022.10.3-3
  • azl3 openssl 3.3.5-4 versions antérieures à 3.3.7-1
  • azl3 telegraf 1.31.0-17 versions antérieures à 1.31.0-19

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 23 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans les produits Microsoft
Priority review Apr 21, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans GitLab versions 18.9.6 à 18.11.1
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiples vulnérabilités dans Oracle Weblogic Server
Urgent Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 23rd, 2026
Instrument
Guidance
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Minor

Who this affects

Applies to
Government agencies Technology companies
Industry sector
5112 Software & Technology
Activity scope
Software vulnerability management Patch management Cybersecurity advisory response
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Telecommunications

Browse Categories

Agriculture & Food Safety 79 AI Regulation 3 Banking & Finance 483 Consumer Protection 127 Courts & Legal 462 Data Privacy & Cybersecurity 144 Defense & National Security 53 Education 64 Energy 113 Environment 168 Gaming 2 Government & Legislation 499 Healthcare 15 Healthcare & Life Sciences 387 Immigration 11 Insurance 87 Labor & Employment 185 Pharma & Drug Safety 21 Professional Licensing 6 Real Estate & Housing 74 Securities & Markets 174 Tax 106 Telecom & Technology 54 Trade & Sanctions 160 Transportation 116

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!