Information disclosure in the Networking component

published 2026-09-29 40 d ago modified 2026-10-05 34 d ago also EUVD-2026-88947

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

Patch / fix

fixed in 2 distros 5

mozilla firefox 140.17.0, 153.4.0, 157.0.0
mozilla thunderbird 140.17.0, 153.4.0, 157.0

debian suse opensuse almalinux rocky linux

firefox-esr Debian 12 153.4.0esr-1~deb12u1
firefox-esr Debian 13 153.4.0esr-1~deb13u1
firefox-esr Debian 14 153.4.0esr-1
thunderbird Debian 12 1:140.17.0esr-1~deb12u1
thunderbird Debian 13 1:140.17.0esr-1~deb13u1
thunderbird Debian 14 1:153.4.0esr-1

debian advisories DEBIAN-CVE-2026-96869

MozillaThunderbird SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 153.4.0-150400.13.6.1
MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153.4.0-150400.157.11.1
MozillaFirefox SLES for SAP applications 16.0, SLES 16.0 153.4.0-160000.1.1
MozillaFirefox SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 153.4.0-118.11.1

suse advisories SUSE-SU-2026:4627-1 SUSE-SU-2026:4545-1 SUSE-SU-2026:4543-1 SUSE-SU-2026:23981-1

MozillaFirefox openSUSE Tumbleweed 157.0.1-1.1
MozillaThunderbird openSUSE Tumbleweed 153.4.0-1.1
MozillaFirefox openSUSE Leap 16.0 153.4.0-160000.1.1
firefox-esr openSUSE Tumbleweed 153.4.0-1.1

opensuse advisories openSUSE-SU-2026:12097-1 openSUSE-SU-2026:12098-1 openSUSE-SU-2026:21980-1 openSUSE-SU-2026:11917-1

thunderbird AlmaLinux 8 140.17.0-1.el8_10.alma.1
thunderbird AlmaLinux 10 140.17.0-1.el10_2.alma.1
thunderbird AlmaLinux 9 140.17.0-1.el9_8.alma.1
firefox AlmaLinux 9 140.17.0-1.el9_8.alma.1
firefox-x11 AlmaLinux 9 140.17.0-1.el9_8.alma.1
firefox AlmaLinux 10 140.17.0-1.el10_2
firefox AlmaLinux 8 140.17.0-1.el8_10.alma.1

almalinux advisories ALSA-2026:90913 ALSA-2026:80674 ALSA-2026:80694 ALSA-2026:76761 ALSA-2026:76764 ALSA-2026:76850

thunderbird Rocky Linux 8 140.17.0-1.el8_10
firefox Rocky Linux 10 140.17.0-1.el10_2
thunderbird Rocky Linux 10 140.17.0-1.el10_2
firefox Rocky Linux 9 140.17.0-1.el9_8
thunderbird Rocky Linux 9 140.17.0-1.el9_8
firefox Rocky Linux 8 140.17.0-1.el8_10

rocky linux advisories RLSA-2026:90913 RLSA-2026:76764 RLSA-2026:80674 RLSA-2026:76761 RLSA-2026:80694 RLSA-2026:76850

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-96869 updated 2026-11-06 cvss 6.1

firefox: thunderbird: Information disclosure in the Networking component

Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 10 rhel10/firefox-flatpak, rhel10/thunderbird-flatpak
affected: no fix available
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.17.0-1.el8_10, thunderbird 140.17.0-1.el8_10
fixed: vendor fix RHSA-2026:76850
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.17.0-1.el9_8, firefox-x11 140.17.0-1.el9_8, thunderbird 140.17.0-1.el9_8
fixed: vendor fix RHSA-2026:76761
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.17.0-1.el10_2, thunderbird 140.17.0-1.el10_2
fixed: vendor fix RHSA-2026:76764
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.17.0-1.el8_4, thunderbird 140.17.0-1.el8_4
fixed: vendor fix RHSA-2026:92011
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.17.0-1.el8_6, thunderbird 140.17.0-1.el8_6
fixed: vendor fix RHSA-2026:92228
Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.17.0-1.el8_8, thunderbird 140.17.0-1.el8_8
fixed: vendor fix RHSA-2026:92327

show 8 more

Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.17.0-1.el9_2, firefox-x11 140.17.0-1.el9_2, thunderbird 140.17.0-1.el9_2
fixed: vendor fix RHSA-2026:92226
Red Hat Enterprise Linux AppStream E4S (v.9.4) firefox 140.17.0-1.el9_4, firefox-x11 140.17.0-1.el9_4, thunderbird 140.17.0-1.el9_4
fixed: vendor fix RHSA-2026:92012
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.17.0-1.el10_0, thunderbird 140.17.0-1.el10_0
fixed: vendor fix RHSA-2026:92227
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.17.0-1.el9_6, firefox-x11 140.17.0-1.el9_6, thunderbird 140.17.0-1.el9_6
fixed: vendor fix RHSA-2026:92335
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.17.0-1.el8_4, thunderbird 140.17.0-1.el8_4
fixed: vendor fix RHSA-2026:92011
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) firefox 140.17.0-1.el8_6, thunderbird 140.17.0-1.el8_6
fixed: vendor fix RHSA-2026:92228
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.17.0-1.el8_8, thunderbird 140.17.0-1.el8_8
fixed: vendor fix RHSA-2026:92327
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.17.0-1.el7_9
fixed: vendor fix RHSA-2026:92363

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 40 d ago (2026-09-29)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

Mozilla Thunderbird
Mozilla Firefox

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

mozilla.org /security/advisories/mfsa2026-100/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-101/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-102/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-103/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-97/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-99/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2041248
permissions-required

Sources

CVE List CVE-2026-96869
NVD CVE-2026-96869

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary