Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.

debian_linux dsa-6573: Debian dsa-6573 : firefox-esr - security update

oracle_linux ELSA-2026-500450: ELSA-2026-500450: ca-certificates security update (IMPORTANT)

oracle_linux ELSA-2026-500451: ELSA-2026-500451: ca-certificates security update (IMPORTANT)

oracle_linux ELSA-2026-500449: ELSA-2026-500449: ca-certificates security update (IMPORTANT)

mozilla mfsa2026-115: Security Vulnerabilities fixed in Thunderbird 153.5.1

mozilla mfsa2026-114: Security Vulnerabilities fixed in Thunderbird 158.0.1

The version of Firefox ESR installed on the remote Windows host is prior to 153.5.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-112 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.43.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-113 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-112 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.43.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-113 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
367830	Mozilla Firefox ESR < 153.5.1	Nessus	Windows	Local	high
367829	Mozilla Firefox ESR < 115.43.1	Nessus	MacOS X Local Security Checks	Local	high
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	Local	high
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	Local	high
367826	Mozilla Firefox ESR < 153.5.1	Nessus	MacOS X Local Security Checks	Local	high
367825	Mozilla Firefox ESR < 115.43.1	Nessus	Windows	Local	high

Detections

Analytics

CVE-2026-113470

medium

Tenable Plugins

Coming Soon

high

high

high

high

high

high