CVE-2026-109704

CVSS: 8.8v3.1HighDeferred

AliasesDEBIAN-CVE-2026-109704

Published 2026-10-13Last modified 2026-10-14

Open JSON

Vulnerability summary

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.33%

0%100%

Low · Change unavailable

KEVNot listed0 of 3 catalogs

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2026:12116-1

Timeline

2026-10-13
PublishedVulnerability first disclosed.
2026-10-14
Last modifiedVulnerability information updated.

Description

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

CVSS metrics

2 scores · 2 sources · 1 version

v3.18.8

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

Change unavailable

2026-10-142026-10-15

EPSS score

0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected systems

Debian1 product

firefox-esrAll versions (No fix recorded)

1 vendor · 1 product

References

6 links