# CERT-FR Flags Mass Microsoft Edge Vulnerabilities

Published: 2026-10-19 · Severity: elevated
Canonical: https://vorant.io/reports/62461737-a92d-582b-8ee3-c0d8ea990371/cert-fr-flags-mass-microsoft-edge-vulnerabilities

> CERT-FR advisory lists numerous Microsoft Edge vulnerabilities enabling remote code execution; patch to versions 155.0.4283.60 or 154.0.4258.37 or later.

CERT-FR published an advisory summarizing multiple vulnerabilities affecting Microsoft Edge, consolidating numerous CVEs disclosed by Microsoft on 16 October 2026. The advisory states that successful exploitation could allow an attacker to achieve remote code execution, along with at least one unspecified security issue not detailed by the vendor. No information is provided regarding active exploitation in the wild, proof-of-concept code, or specific attack vectors beyond the general risk categories.

Affected versions are Microsoft Edge builds in the 155.0.4283.XX line prior to 155.0.4283.60, and versions prior to 154.0.4258.37. CERT-FR directs readers to the individual Microsoft Security Response Center (MSRC) bulletins for each CVE for technical details and remediation guidance. Given the volume of CVEs bundled into this single advisory (well over 150 individual identifiers), this represents a routine, large-batch Patch Tuesday-style update rollup from Microsoft for its Edge browser, redistributed by the French national CERT as is standard practice.

Defenders should prioritize updating Microsoft Edge across their estate to the fixed versions noted above as soon as feasible, given the remote code execution risk profile typical of browser vulnerabilities. No indicators of compromise, threat actor attribution, or malware association were provided in this advisory; it is purely a vulnerability notification requiring patch management action rather than incident response.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102322, CVE-2026-106179, CVE-2026-106180, CVE-2026-106181, CVE-2026-106182, CVE-2026-106183, CVE-2026-106184, CVE-2026-106185, CVE-2026-106186, CVE-2026-106187, CVE-2026-106188, CVE-2026-106189, CVE-2026-106190, CVE-2026-106191, CVE-2026-106193, CVE-2026-106194, CVE-2026-106195, CVE-2026-106196, CVE-2026-106197, CVE-2026-106198, CVE-2026-106199, CVE-2026-106200, CVE-2026-106201, CVE-2026-106202, CVE-2026-106203, CVE-2026-106204, CVE-2026-106205, CVE-2026-106207, CVE-2026-106208, CVE-2026-106210, CVE-2026-106211, CVE-2026-106212, CVE-2026-106213, CVE-2026-106214, CVE-2026-106215, CVE-2026-106216, CVE-2026-106217, CVE-2026-106220, CVE-2026-106222, CVE-2026-106224

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1342

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/62461737-a92d-582b-8ee3-c0d8ea990371/cert-fr-flags-mass-microsoft-edge-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup