CVE-2026-113866 Mozilla CVE debrief

Who should care

Thunderbird users, particularly those using versions prior to 153.5.1 and 158.0.1, should assess exposure and prioritize verification. Defenders should verify affected versions, inventory vulnerable systems, and apply vendor remediation. Users should review their current versions and update if necessary. Security teams should prioritize verifying Thunderbird versions and apply updates to prevent password exposure.

Why it matters

Defenders should assess exposure and prioritize verification due to a vulnerability allowing network attackers to obtain account passwords during Exchange account setup.

• Verify affected Thunderbird versions to prevent password exposure
• Inventory vulnerable systems for remediation priority
• Implement compensating controls to monitor suspicious activity

Technical summary

Thunderbird's Exchange AutoDiscover lookup sent account credentials unencrypted over HTTP, allowing network attackers to obtain passwords during Exchange account setup. This vulnerability was caused by a bug and was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1. Defenders should prioritize verifying Thunderbird versions and apply updates to prevent password exposure. The vulnerability affects Thunderbird users, particularly those using versions prior to 153.5.1 and 158.0.1. Affected users should assess exposure and prioritize verification.

Defensive priority

Defenders should prioritize verifying Thunderbird versions, especially those prior to 153.5.1 and 158.0.1, and apply updates to prevent password exposure.

Recommended defensive actions

• Verify Thunderbird versions and apply updates to prevent password exposure
• Inventory vulnerable systems and prioritize remediation
• Monitor for suspicious activity and implement compensating controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item detail a vulnerability in Thunderbird's Exchange AutoDiscover lookup, which sent account credentials unencrypted over HTTP, allowing network attackers to obtain passwords. The source item provides limited detail, so defenders should verify affected versions and apply vendor remediation. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.