The version of Firefox ESR installed on the remote Windows host is prior to 140.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-15 advisory.

  - Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147     and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2026-2793)

  - Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability     affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird <     140.8. (CVE-2026-2778)

  - Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox <     148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
    (CVE-2026-2757)

  - Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR <     115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. (CVE-2026-2758)

  - Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox <     148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
    (CVE-2026-2759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Mozilla Firefox ESR < 140.8

critical Nessus Plugin ID 299869

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.6 Mar 3, 2026, 6:06 AM Plugin metadata Plugin Feed: 202603030606
Version 1.5 Mar 2, 2026, 12:44 PM CVSSv2 score source (changed from "CVE-2026-2790" to "CVE-2026-2793") Plugin Feed: 202603021244
Version 1.4 Feb 28, 2026, 12:53 AM New Plugin Feed: 202602280053
Version 1.3 Feb 26, 2026, 8:51 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 10.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2026-2793" to "CVE-2026-2790") CVSSv2 severity (based on CVE-2026-2790, severity increased from "Medium" to "High") CVSSv3 score source (changed from "CVE-2026-2769" to "CVE-2026-2778") Plugin Feed: 202602260851
Version 1.2 Feb 25, 2026, 9:03 AM CVSSv3 score source (set to "CVE-2026-2769") Plugin Feed: 202602250903
Version 1.1 Feb 25, 2026, 1:08 AM New Plugin Feed: 202602250108