Microsoft Edge versions below 149.0.4022.69 patched
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR advisory on multiple unspecified vulnerabilities in Microsoft Edge requiring immediate update to 149.0.4022.69 or later.
CERT-FR has published an advisory detailing multiple vulnerabilities affecting Microsoft Edge versions prior to 149.0.4022.69. The advisory lists 92 distinct CVEs across two ranges (CVE-2026-11628 through CVE-2026-11701, and CVE-2026-12007 through CVE-2026-12019), all dated 15 June 2026. Microsoft has not publicly disclosed the specific impact of each vulnerability; the advisory notes only that attackers could exploit them to cause unspecified security issues.
The primary mitigation is immediate update to Microsoft Edge version 149.0.4022.69 or later. Defenders should prioritize patching all affected Edge installations across their environment. The large number of CVEs in a single release suggests a routine security update addressing multiple classes of vulnerability rather than a targeted exploit campaign, though without individual CVE descriptions the specific attack surface remains opaque. Consult Microsoft's MSRC bulletins for detailed impact assessment of particular CVEs affecting your deployment.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0757
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs