# CERT-FR Flags Multiple Microsoft Edge Flaws

Published: 2026-10-27 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/eb2c79f5-3932-5ce1-af74-17db2b14a00b/cert-fr-flags-multiple-microsoft-edge-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory lists numerous vulnerabilities in Microsoft Edge versions before 155.0.4283.62 and 154.0.4258.62, including RCE and privilege escalation risks.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1395

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT-FR published an advisory consolidating a large batch of Microsoft Edge vulnerabilities disclosed via Microsoft Security Response Center (MSRC) bulletins dated 16 and 26 October 2026. The advisory covers Microsoft Edge versions 155.x prior to 155.0.4283.62 and versions prior to 154.0.4258.62. Collectively, the vulnerabilities could allow an attacker to achieve remote code execution, privilege escalation, security policy bypass, and disclosure of confidential information. No specific exploitation in the wild is mentioned in this advisory, and no technical details of individual flaws are provided beyond the risk categories.

Defenders should prioritize updating affected Microsoft Edge installations to the fixed versions referenced in the advisory (155.0.4283.62 or later, 154.0.4258.62 or later) as per Microsoft's official guidance. Given the volume of CVEs bundled into a single routine patch cycle and the absence of confirmed in-the-wild exploitation, this is treated as a standard browser patch advisory requiring timely but non-emergency remediation across the affected fleet.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102299, CVE-2026-102300, CVE-2026-102301, CVE-2026-102302, CVE-2026-102303, CVE-2026-102304, CVE-2026-102305, CVE-2026-102306, CVE-2026-102307, CVE-2026-102308, CVE-2026-102309, CVE-2026-102310, CVE-2026-102311, CVE-2026-102312, CVE-2026-102313, CVE-2026-102314, CVE-2026-102315, CVE-2026-102316, CVE-2026-102317, CVE-2026-102318, CVE-2026-102319, CVE-2026-102320, CVE-2026-102321, CVE-2026-102323, CVE-2026-102324, CVE-2026-102325, CVE-2026-102326, CVE-2026-102327, CVE-2026-102328, CVE-2026-102329, CVE-2026-102330, CVE-2026-102331, CVE-2026-103621, CVE-2026-103622, CVE-2026-103623, CVE-2026-103624, CVE-2026-103625, CVE-2026-103626, CVE-2026-83831, CVE-2026-85898

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1395

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eb2c79f5-3932-5ce1-af74-17db2b14a00b/cert-fr-flags-multiple-microsoft-edge-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup