Search CVEs, research… / diras.sa

CVE-2026-74985: privilege escalation in Mozilla Firefox

An attacker can elevate privileges in Firefox via a flaw in the Enterprise Policies component (CVE-2026-74985). The available facts identify the vulnerability in Firefox's policies functionality but do not list specific affected product versions or describe the required attacker conditions. No vendor patch is recorded in the provided data, and the issue is tracked as a high-severity privilege escalation (CWE-269) that could allow unauthorized privilege gains if exploited.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00527
CWE
CWE-269
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Treat this as urgent: the issue is rated critical (CVSS 9.8) and no patch is recorded in the supplied facts, so immediately reduce exposure and follow vendor guidance when published.

What is CVE-2026-74985?

An attacker can elevate privileges in Firefox via a flaw in the Enterprise Policies component (CVE-2026-74985). The available facts identify the vulnerability in Firefox's policies functionality but do not list specific affected product versions or describe the required attacker conditions. No vendor patch is recorded in the provided data, and the issue is tracked as a high-severity privilege escalation (CWE-269) that could allow unauthorized privilege gains if exploited. The weakness is classified as CWE-269 (Improper Privilege Management).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-74985 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-74985

  1. Restrict access to systems that manage or apply Enterprise Policies and limit administrative privileges.
  2. Monitor endpoint and application logs for unexpected privilege changes related to Firefox policy processing.
  3. Follow Mozilla security advisories and apply official updates as soon as the vendor publishes a patch.
  4. Isolate high-risk hosts from untrusted networks until a vendor fix is applied.

Frequently asked questions

Is CVE-2026-74985 being actively exploited?

No public reports show active exploitation as of 2026-09-29.

Which Firefox versions are affected by CVE-2026-74985?

The provided facts identify the Enterprise Policies component in Firefox but do not list specific affected versions.

Is there a patch for CVE-2026-74985?

According to the supplied data, no patch is recorded as available.

Does CVE-2026-74985 require authentication?

The facts do not specify whether authentication or prior access is required for exploitation.

References