Security updatesMozilla

Thunderbird fixes password transmission during Exchange setup: email clients need updates too

Mozilla published Thunderbird 153.5.1 security fixes, including credentials potentially being sent through unencrypted AutoDiscover requests during Exchange account setup, plus XMPP and NTLM issues. Assess risks separately for different account features.

Anti-Ransomware · Compiled with SI agent assistanceOfficial security advisory date:Checked 2026.10.26
Original scenario illustration of colleagues checking enterprise email account settings and an Exchange connection list
Illustration · Source ↗ · About this image ↗

Source Facts

Mozilla released MFSA 2026-115 on 20 October, listing security issues addressed in Thunderbird 153.5.1. CVE-2026-113866 concerns Exchange account setup: AutoDiscover queries in older versions may include user-entered credentials in unencrypted HTTP requests.

The same advisory also lists XMPP chat-message handling and NTLM authentication issues in POP3/SMTP. Mozilla explains that each vulnerability depends on different features. For example, the XMPP issue concerns chat only; it does not imply that every email can trigger the same effect.

Next Steps for Businesses / Editorial Observations

Email security extends beyond cloud platforms to desktop clients and new-account setup. Check relevant exposure according to the functions in use.

Next steps you can take

  • Check the Thunderbird branch and version actually in use, and obtain the appropriate fixed release using its advisory.
  • If an Exchange account was configured using an affected version, ask an administrator to assess credential exposure and any required resets, and check for unusual sign-ins.

Original sources

Security Vulnerabilities fixed in Thunderbird 153.5.1 — MFSA 2026-115

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxOriginal scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NETIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42