CVE-2026-92038

No known exploitation. EPSS puts it in the 40th percentile. No fix published yet.

CVSS 3.19.1Critical EPSS percentile40th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the installed version of firefox and Thunderbird on all business devices.
Update firefox ESR to 153.3 or later, or firefox to 156 or later.
Update Thunderbird ESR to 153.3 or later, or Thunderbird to 156 or later.
Confirm updates completed successfully and remove older installations where practical.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

In plain language

Written by AI from the record

This is a critical flaw in firefox and Thunderbird that can let an internet attacker bypass built-in safety checks, so small businesses using either should update promptly.

Unauthenticated network-accessible mitigation bypass in the Remote Settings Client component (CWE-693) may allow remote evasion of security controls with high confidentiality and integrity impact.

If you're affected

Sensitive data exposure
Unauthorized settings changes
Reduced security protections
Business workflow disruption

What is it

The affected software uses a settings-updater system that is meant to enforce safety checks. This flaw is like a locked staff-only door whose safety check can be bypassed, potentially letting an outsider see private information or alter how the program operates.

Who is affected

This matters to you if your business uses firefox or Thunderbird on employee devices. It is a risk in the default configuration because the affected component is reachable over the internet, and an attacker does not need a login or employee action.

How urgent is it

An attacker can attempt this remotely without needing an account or a person to click anything, which makes this a red-priority update. No confirmed real-world exploitation, public exploit code, or CISA Known Exploited Vulnerabilities listing has been reported for CVE-2026-92038, but the severity and default reachability warrant prompt action.

What to do — in detail

Confirm installed versions across managed endpoints, including ESR channels. Upgrade Firefox ESR to 153.3 or later, Firefox to 156 or later, Thunderbird ESR to 153.3 or later, and Thunderbird to 156 or later; validate the appropriate channel rather than treating an ESR version as equivalent to a regular-release version.

Use the normal enterprise deployment or vendor update process, then verify the reported application version after installation. The findings do not identify breaking changes or a specific temporary workaround; if updates must be delayed, restrict unnecessary internet access from affected endpoints where operationally possible and prioritize systems that browse untrusted sites or handle sensitive business information.

CISA has not listed this CVE in KEV, so there is no CISA remediation due date. Monitor endpoint-management reports for devices that remain below the target version and investigate unexpected configuration or security-setting changes.

Technical context

CVSS 3.1: 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The issue is CWE-693, Protection Mechanism Failure, in the Remote Settings Client component: an unauthenticated remote attacker can bypass safety mechanisms over the network, with no user interaction required and default reachability reported. It is not in CISA KEV; no confirmed exploitation or public exploit code is on record. EPSS is 0.2% (6th percentile) with a flat trend, indicating low predicted near-term exploitation likelihood; this is predictive only, not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS40th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 40th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 6 days, from the signal feeds we watch.

2026-09-21Record updated
2026-09-18OpenVAS check added
2026-09-16Record updatedrecord updated
2026-09-15Publishedweakness classified, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact