9.8
Critical
CVE-2026-74985 Privilege escalation in the Enterprise Policies component
Description
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 154 | earliest → < 154 | 154 |
| Firefox 153.1 | earliest → < 153.1 | 153.1 |
| Thunderbird 154 | earliest → < 154 | 154 |
| Thunderbird 153.1 | earliest → < 153.1 | 153.1 |