Security readout for executives and security teams
Plain-English summary
CVE-2026-2791 is a critical Mozilla vulnerability described as a mitigation bypass in the Networking: Cache component. Mozilla states it was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS 9.8 rating means remote compromise is considered possible without authentication or user interaction, based on the published scoring.
Executive priority
Treat this as an urgent browser and email-client update. Prioritize managed endpoints, shared systems, and environments where browsers or Thunderbird process untrusted network content. Lack of KEV evidence reduces certainty of active attacks, not the need to patch.
Technical view
The CVE describes CWE-288, a mitigation bypass, in Mozilla’s Networking: Cache component. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Public details are limited; the referenced Bugzilla entry and Mozilla advisories should be treated as authoritative for product-specific context and update guidance.
Likely exposure
Organizations using Mozilla Firefox, Firefox ESR, Thunderbird, or Thunderbird ESR before the fixed releases may be exposed. The bundle names Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8 as fixed versions.
Exploitation context
No active exploitation is stated in the provided sources, and the CVE is not marked as KEV. The high score reflects ease of remote attack in the CVSS model, but public technical exploitation details are limited in the provided bundle.
Researcher notes
The public description is brief and does not explain the bypass mechanics. Avoid assuming exploitability details beyond the CVSS vector and Mozilla wording. The source bundle lists fixed releases, but deeper triage should verify exact affected ranges against Mozilla advisories and the CVE record.
Mitigation direction
- Update Firefox to the fixed Mozilla release identified in the advisory.
- Update Firefox ESR to version 140.8 or later as applicable.
- Update Thunderbird to the fixed Mozilla release identified in the advisory.
- Update Thunderbird ESR to version 140.8 or later as applicable.
- Review Mozilla advisories for platform-specific deployment guidance.
Validation and detection
- Inventory Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR installations.
- Confirm deployed versions meet or exceed the fixed releases.
- Check enterprise software management reports for unmanaged Mozilla installations.
- Review Mozilla advisory pages for any updated affected-version statements.
- Monitor CVE and Mozilla pages for newly published technical details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-2791 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=2015220CVE reference
- https://www.mozilla.org/security/advisories/mfsa2026-13/CVE reference
- https://www.mozilla.org/security/advisories/mfsa2026-15/CVE reference
- https://www.mozilla.org/security/advisories/mfsa2026-16/CVE reference
- https://www.mozilla.org/security/advisories/mfsa2026-17/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.