The version of Firefox ESR installed on the remote Windows host is prior to 115.44. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-119 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
    (CVE-2026-109708)

  - Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the     Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158,     Thunderbird 153.5, and Firefox ESR 115.44. (CVE-2026-109705)

  - Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability     was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117862)

  - Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was     fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117863)

  - Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was     fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117866)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.44. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-119 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
    (CVE-2026-109708)

  - Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the     Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158,     Thunderbird 153.5, and Firefox ESR 115.44. (CVE-2026-109705)

  - Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability     was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117862)

  - Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was     fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117863)

  - Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was     fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
    (CVE-2026-117866)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
372630	Mozilla Firefox ESR < 115.44	Nessus	Windows	10/27/2026	10/27/2026	critical
372623	Mozilla Firefox ESR < 115.44	Nessus	MacOS X Local Security Checks	10/27/2026	10/27/2026	critical

Detections

Analytics

Plugins Search

critical

critical