Is CVE-2026-113866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113866 being exploited in the wild.

How severe is CVE-2026-113866?

Medium severity, with a CVSS score of 5.9, published 20 October 2026.

Which products and versions are affected?

Mozilla Thunderbird before 158.0.1 and before 153.5.1.

Is there a fix for CVE-2026-113866?

Yes: fixed in Thunderbird 158.0.1, Thunderbird 153.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113866 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-113866?

Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113866: Mozilla Thunderbird account password disclosure in Exchange AutoDiscover

CVE-2026-113866 · Severity: medium · CVSS 5.9 · Published 2026-10-20

Thunderbird, an email client used by millions to manage corporate and personal email accounts, transmitted user passwords over unencrypted HTTP during Exchange account setup. A network attacker positioned on the user's connection could intercept these credentials and gain full access to the user's email account and any systems it protects.

Technologies: Mozilla Thunderbird. Vendors: Mozilla.

Quick answers

Is CVE-2026-113866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113866 being exploited in the wild.
How severe is CVE-2026-113866?: Medium severity, with a CVSS score of 5.9, published 20 October 2026.
Which products and versions are affected?: Mozilla Thunderbird before 158.0.1 and before 153.5.1.
Is there a fix for CVE-2026-113866?: Yes: fixed in Thunderbird 158.0.1, Thunderbird 153.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113866 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-113866?: Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Thunderbird 158.0.1, Thunderbird 153.5.1

Technical details

During Exchange AutoDiscover account configuration, Thunderbird queries the domain's AutoDiscover service over HTTP without encryption. Due to a bug, user-supplied credentials were sent in plaintext within this unencrypted request, allowing network-based attackers to obtain passwords. The vulnerability requires no user interaction beyond initial account setup and affects all users configuring Exchange accounts on vulnerable Thunderbird versions.

Affected products

Mozilla Thunderbird before 158.0.1 and before 153.5.1

Timeline

2026-10-20: disclosed
2026-10-20: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.