CVE-2026-8957CWE-269privilege-escalation

CVE-2026-8957

High · published May 19, 2026

CVSS v3.1

8.8

EPSS

Percentile

34.7

In the wild

Unconfirmed

What it is

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00415 · 34.7th percentile
Weakness: CWE-269 · Improper Privilege Management
Published: 2026-05-19T18:16Z

Affected products (4)

Product	Versions	Fixed in
mozilla/firefox	< 140.11.0	140.11.0
mozilla/firefox	< 151.0.0	151.0.0
mozilla/thunderbird	< 140.11	140.11
mozilla/thunderbird	< 151.0.0	151.0.0

References (5)

https://bugzilla.mozilla.org/show_bug.cgi?id=2033850 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-46/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-48/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-50/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-51/ · [email protected]

EPSS history

Timeline

19 MAY 12:29Z
Privilege escalation in the Enterprise Policies component
cvelistv5