Vulnerabilities
Mozilla Products Hit by 20+ Critical Vulnerabilities
The French CERT released an alert on September 16, 2026, detailing a suite of 22 CVEs affecting older releases of Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The flaws enable attackers to elevate privileges, launch remote denial‑of‑service attacks, and exfiltrate sensitive data. Patches are available through Mozilla’s MFSA 2026‑90 to 2026‑95 advisories. All affected users should update immediately.
RootPwn’s latest bulletin comes from the French Computer Emergency Response Team (CERT‑FR), which identified a wave of critical bugs across Mozilla’s flagship browsers and email client. The vulnerabilities, numbered CVE‑2026‑92005 through CVE‑2026‑92026, expose users to privilege escalation, remote denial‑of‑service, and data confidentiality breaches.
What’s at stake?
- Privilege escalation – attackers can gain higher OS permissions.
- Remote DoS – a single exploit can crash the application from afar.
- Data leakage – sensitive information may be read or transmitted.
Affected Software
- Firefox ESR versions <115.41, <140.16, <153.3, and <156.
- Firefox versions <156.
- Thunderbird ESR versions <140.16 and <156.
- Thunderbird versions <156.
Patch status
- Mozilla Security Advisories MFSA 2026‑90 through MFSA 2026‑95 contain the fixes.
- All patches are bundled in the next release of each product line.
"Users running any of the listed versions should update immediately to eliminate the risk," the alert states.
For a full list of CVEs and detailed technical notes, consult the Mozilla Security Advisories and the CVE database. Stay patched, stay safe.
Related vulnerabilities
Google Chrome Faces 20+ CVEs – Update Now to Patch Critical Vulnerabilities
The French CERT has issued an urgent alert after discovering a bundle of 20+ CVEs in Google Chrome that can be exploited to trigger unspecified security failures. Affected are all Chrome releases older than 153.0.8010.47 on Linux and Windows, and 153.0.8010.48 on macOS. The vulnerabilities were disclosed in a Google release on 15 September 2026. Immediate upgrade to the latest stable channel is mandatory to close the gaps.
Read briefing
Citrix NetScaler ADC & Gateway Hit by Dual Critical Flaws – Patch Urgently
Citrix has disclosed two critical security issues in its NetScaler ADC and Gateway appliances. CVE‑2026‑19489 (memory overflow) can trigger DoS when SIP ALG is active on a Large‑Scale NAT group, while CVE‑2026‑19490 (auth bypass) targets Gateway or AAA virtual servers with SAML actions. Affected builds span 13.1 and 14.1 releases, including FIPS variants. CERT‑EU urges all users to apply the latest updates immediately and verify configuration strings to assess risk.
Read briefing
Cisco IOS XE Hardening Release Addresses 7 Critical CVEs – August 2026
Cisco’s IOS XE team rolled out a hardening update in August 2026 that patches seven critical vulnerabilities discovered during internal testing. No workarounds exist; customers should apply the latest firmware to mitigate the risks. The CVEs span multiple CWE categories and carry a Critical impact rating.
Read briefing
Cisco Crosswork Hardening Release: Critical CVEs Uncovered in August 2026
Cisco’s Crosswork team has rolled out a hardening update after an internal security audit revealed several critical weaknesses. Four CVEs—CVE‑2026‑20030, CVE‑2026‑20357, CVE‑2026‑20358, and CVE‑2026‑20359—were patched in the new firmware, with no workarounds available. The vulnerabilities were not known to be actively exploited, but the critical rating urges immediate action. Update your Crosswork devices now to stay protected.
Read briefing