The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using     STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would     process these responses after the handshake, as if they had been received from the server over the     encrypted connection. This could be used to make Thunderbird report a different outcome for sending or     fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was     not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not     affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. (CVE-2026-126135)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote Windows host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-129 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 160.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-128 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, and Thunderbird 160. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 153.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-129 advisory.

  - Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in     Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124948)

  - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox     160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. (CVE-2026-124917)

  - When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a     specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was     replaced with the content of the file or URL it pointed to when the message was saved or sent. This could     disclose local files, or content from the user's network, to the message recipients or to the mail     provider.  This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.
    (CVE-2026-126132)

  - When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication,     Thunderbird could answer the proxy with the calendar server's username and password. This affected both     setting up a new calendar and syncing existing calendars, where a saved password could be sent without any     user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even     for calendars served over HTTPS. (CVE-2026-126133)

  - Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked     into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed.
    Windows then sent the user's NTLM credentials to that server.  This bug only affects Thunderbird on     Windows. Other operating systems are unaffected. (CVE-2026-126134)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4898 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4898-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     November 12, 2026                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:153.7.0esr-1~deb12u1     CVE ID         : CVE-2026-118007 CVE-2026-118019 CVE-2026-118021 CVE-2026-118024                      CVE-2026-124853 CVE-2026-124854 CVE-2026-124855 CVE-2026-124856                      CVE-2026-124857 CVE-2026-124858 CVE-2026-124859 CVE-2026-124860                      CVE-2026-124861 CVE-2026-124862 CVE-2026-124863 CVE-2026-124864                      CVE-2026-124865 CVE-2026-124866 CVE-2026-124868 CVE-2026-124869                      CVE-2026-124870 CVE-2026-124872 CVE-2026-124873 CVE-2026-124874                      CVE-2026-124875 CVE-2026-124876 CVE-2026-124877 CVE-2026-124879                      CVE-2026-124880 CVE-2026-124881 CVE-2026-124882 CVE-2026-124883                      CVE-2026-124884 CVE-2026-124885 CVE-2026-124886 CVE-2026-124887                      CVE-2026-124888 CVE-2026-124889 CVE-2026-124890 CVE-2026-124891                      CVE-2026-124892 CVE-2026-124893 CVE-2026-124894 CVE-2026-124895                      CVE-2026-124896 CVE-2026-124897 CVE-2026-124898 CVE-2026-124899                      CVE-2026-124901 CVE-2026-124902 CVE-2026-124903 CVE-2026-124905                      CVE-2026-124906 CVE-2026-124907 CVE-2026-124909 CVE-2026-124910                      CVE-2026-124912 CVE-2026-124913 CVE-2026-124914 CVE-2026-124915                      CVE-2026-124917 CVE-2026-124918 CVE-2026-124919 CVE-2026-124922                      CVE-2026-124924 CVE-2026-124926 CVE-2026-124927 CVE-2026-124929                      CVE-2026-124930 CVE-2026-124931 CVE-2026-124932 CVE-2026-124933                      CVE-2026-124934 CVE-2026-124935 CVE-2026-124938 CVE-2026-124939                      CVE-2026-124940 CVE-2026-124941 CVE-2026-124942 CVE-2026-124948                      CVE-2026-124951 CVE-2026-126132 CVE-2026-126133 CVE-2026-126134                      CVE-2026-126135 CVE-2026-126136

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code or information disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     1:153.7.0esr-1~deb12u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
378756	Linux Distros Unpatched Vulnerability : CVE-2026-126135	Nessus	Misc.	11/11/2026	11/12/2026	medium
378427	Mozilla Thunderbird < 160.0	Nessus	Windows	11/10/2026	11/10/2026	critical
378657	Mozilla Thunderbird < 153.7	Nessus	MacOS X Local Security Checks	11/11/2026	11/11/2026	critical
378428	Mozilla Thunderbird < 160.0	Nessus	MacOS X Local Security Checks	11/10/2026	11/10/2026	critical
378656	Mozilla Thunderbird < 153.7	Nessus	Windows	11/11/2026	11/11/2026	critical
379743	Debian dla-4898 : thunderbird - security update	Nessus	Debian Local Security Checks	11/12/2026	11/12/2026	critical

Detections

Analytics

Plugins Search

medium

critical

critical

critical

critical

critical