The advisories were issued on October 28, 2026, and cover Mozilla's Firefox browser and Thunderbird email application, along with Zoom's video conferencing and workplace software. According to a Times Now report, the vulnerabilities could be exploited by attackers to gain unauthorised access to sensitive information, obtain higher privileges on targeted devices or execute malicious code, potentially compromising entire systems.
The warnings do not mean that all Mozilla and Zoom users are at risk. The security concerns primarily affect users running vulnerable software versions. However, devices that have not received the necessary security fixes could remain exposed if attackers exploit these weaknesses.
The affected versions include Mozilla Firefox releases earlier than 158.0.1, Firefox ESR releases earlier than 153.5.1, and Firefox ESR versions earlier than 115.43.1. For Thunderbird, the affected versions are releases earlier than 158.0.1 and versions earlier than 153.5.1.
Zoom Workplace users are also covered by the advisories. On Android, versions earlier than 7.2.1 are affected. On Windows, macOS and Linux, versions earlier than 7.2.0 are vulnerable, including the 7.1.9 branch. Zoom Workplace for iOS versions earlier than 7.2.0 are also affected.
The advisory further identifies Zoom Workplace VDI Client versions 7.0.11 through 7.0.13 for Windows as affected. For Zoom Rooms on Windows, versions ranging from 7.0.0 through 7.1.7 are included in the warning.
Users do not need to stop using Zoom, Firefox or Thunderbird, but they should ensure that their applications are running versions containing the required security fixes. The first step is to check for available updates and install the latest compatible version for their device.
Users should also verify their installed software versions through the application's About section or version information page. This can help them determine whether they are using a version listed in the advisories.
To avoid downloading potentially unsafe software, users should obtain updates through the application's built-in update section, the official website or the relevant official app store. Downloading software from unfamiliar websites should be avoided, as doing so could expose devices to additional risks.
After installing an update, users should follow any on-screen instructions and restart the application if required. Those using company-issued laptops or phones who cannot update the software themselves should contact their organisation's IT team for assistance.
CERT-In's advisories highlight the importance of keeping commonly used communication, browsing and workplace applications updated. Users running the affected versions should verify their software and install the appropriate security fixes to reduce the risk of their devices and sensitive information being compromised.
About The Author
Comment List