CVE-2026-92073 Mozilla CVE debrief

Who should care

Defenders responsible for Mozilla product deployments, particularly those using Enterprise Policies, should assess exposure and apply patches to prevent potential privilege escalation attacks.

Why it matters

CVE-2026-92073 is a high-severity privilege escalation vulnerability in the Enterprise Policies component of Mozilla products. Defenders should prioritize verifying and applying patches to prevent potential attacks.

• Defenders should verify and apply patches to prevent potential privilege escalation attacks.
• Review and update Enterprise Policies configurations to ensure secure settings.
• Monitor for any suspicious activity related to the Enterprise Policies component.

Technical summary

The vulnerability, CVE-2026-92073, is a high-severity privilege escalation issue in the Enterprise Policies component of Mozilla products. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. The CVSS score is 8.8, indicating a high severity level. The vulnerability affects the Enterprise Policies component, which could allow attackers to escalate privileges if not patched. Defenders should prioritize verifying and applying the provided patches to prevent potential privilege escalation attacks.

Defensive priority

Defenders should prioritize verifying and applying the provided patches to prevent potential privilege escalation attacks.

Recommended defensive actions

• Verify and apply patches for Firefox, Firefox ESR, Thunderbird, and Thunderbird to prevent potential privilege escalation attacks.
• Review and update Enterprise Policies configurations to ensure secure settings.
• Monitor for any suspicious activity related to the Enterprise Policies component.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.8 and severity of HIGH. Vendor advisories are available for Mozilla products. The CVE record was published on 2026-09-15T13:17:02.153Z and has not been modified since then. The NVD entry provides additional information on the vulnerability. Defenders should verify the information and apply patches accordingly. The vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.