CERT-FR flags dozens of Edge CVEs
CERT-FR advisory lists over 50 unspecified vulnerabilities in Microsoft Edge versions before 153.0.4234.46 and 156.0.4314.56, urging patching.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory covering more than 50 vulnerabilities affecting Microsoft Edge versions prior to 153.0.4234.46 and 156.0.4314.56. The advisory references individual Microsoft Security Response Center (MSRC) bulletins for each CVE, dated 31 October 2026, but does not detail the technical nature, exploitability, or impact of each flaw — the risk level is marked as unspecified by the vendor in the original French-language bulletin.
As a standard CERT-FR vulnerability roundup, the advisory aggregates Microsoft's own disclosures rather than providing independent analysis. Defenders should consult the linked MSRC bulletins for per-CVE severity, CVSS scores, and exploitability assessments, and apply the vendor-supplied updates to bring Edge to the fixed versions. No in-the-wild exploitation is mentioned in this advisory.
Given the volume of CVEs bundled into a single release and the lack of detail on exploitability or active exploitation, this should be treated as routine browser patch management rather than an urgent incident-response matter, though organizations should prioritize patching given Edge's widespread deployment.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1440
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs