Serial number: AV26-551
Date: June 5, 2026
Updated: June 9, 2026
On June 4, 2026, Cisco published a security advisory to address a vulnerability in the following product:
On June 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20245 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Serial number: AV26-571
Date: June 9, 2026
On June 9, 2026, HPE published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-570
Date: June 9, 2026
On June 9, 2026, Adobe published security advisories to address critical vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-569
Date: June 9, 2026
On June 9, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
<
Serial number: AV26-561
Date: June 9, 2026
On June 8, 2026, Google published a security advisory to address vulnerabilities in the following product:
Google is aware that an exploit for CVE-2026-11645 exists in the wild.
On June 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-11645 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Serial number: AV26-568
Date: June 9, 2026
On June 9, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-567
Date: June 9, 2026
On June 9, 2026, Ivanti published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-566
Date: June 9, 2026
On June 9, 2026, Siemens published a security advisory to address vulnerabilities in the following products. Included were updates for the following products:
The Cyber Centre encourages users and administrators to review the web links provided, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-565
Date: June 9, 2026
On June 4, 2026, MISP published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-564
Date: June 9, 2026
On June 9, 2026, Veeam published a security advisor to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-563
Date: June 9, 2026
On June 8, 2026, Apache published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-562
Date: June 9, 2026
On June 9, 2026, SAP published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations, and apply the necessary updates.
Serial number: AV26-559
Date: June 8, 2026
Updated: June 9, 2026
On June 8, 2026, Check Point published a security advisory to address a critical vulnerability in the following products:
Check Point has observed active exploitation of this vulnerability.
On June 8, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-50751 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-560
Date: June 8, 2026
On June 8, 2026, Broadcom published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-558
Date: June 9, 2026
On June 8, 2026, Spring published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-557
Date: June 8, 2026
Between June 1 and 7, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–556
Date: June 8, 2026
Between June 1 and 7, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-555
Date: June 8, 2026
Between June 1 and 7, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.
Serial number: AV26-554
Date: June 8, 2026
Between June 1 and 7, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-553
Date: June 8, 2026
Between June 1 and 7, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-549
Date: June 4, 2026
Updated: June 5, 2026
Between June 2 and 3, 2026, SolarWinds published security advisories to address vulnerabilities in the following products:
On June 5, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-28318 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-552
Date: June 5, 2026
Between June 2 and 4, 2026, Progress published security advisories to address vulnerabilities in the following products. Included was a critical update for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–550
Date: June 4, 2026
On June 1, 2026, Docker published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-548
Date: June 3, 2026
On June 2, 2026, Broadcom published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-547
Date: June 3, 2026
On June 3, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following:
Cisco has indicated that a proof-of-concept exploit code is available for CVE-2026-20230.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Number: AV26-546
Date: June 3, 2026
On June 3, 2026, Phoenix Contact published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-545
Date: June 3, 2026
On June 3, 2026, ABB published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-544
Date: June 3, 2026
On June 2, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-543
Date: June 2, 2026
On June 2, 2026, HPE published security advisories to address vulnerabilities, including some critical ones, in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-542
Date: June 2, 2026
On June 2, 2026, Mozilla published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-541
Date: June 2, 2026
On May 29, 2026, JetBrains published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-540
Date: June 2, 2026
On June 2, 2026, Siemens published a security advisory to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the web links provided, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-538
Date: June 2, 2026
On June 1, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices.
The vendor indicates that CVE-2025-48595 may be under limited, targeted exploitation.
Update 1
On June 2, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-48595 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-539
Date: June 2, 2026
On June 1, 2026, HP published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, once available.
Serial number: AV26-537
Date: June 2, 2026
On June 2, 2026, Samsung published a security update to address vulnerabilities in the following product:
The most recent security update resolves multiple identified vulnerabilities.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-536
Date: June 1, 2026
On May 29, 2026, Broadcom published a security advisory to address vulnerabilities in the following product. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-535
Date: June 1, 2026
On June 1, 2026, Qualcomm published a security bulletin to address vulnerabilities affecting Qualcomm products.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV24-401
Date: July 17, 2024
Updated: June 1, 2026
On July 16, 2024, Oracle published a security advisory to address vulnerabilities in multiple products. Included were critical updates for the following:
On June 1, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21182 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-534
Date: June 1, 2026
On May 27, 2026, Plesk published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-533
Date: June 1, 2026
On June 1, 2026, Ivanti published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-532
Date: June 1, 2026
On June 1, 2026, Mozilla published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-531
Date: June 1, 2026
Between May 25 and 31, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–530
Date: June 1, 2026
Between May 25 and 31, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-529
Date: June 1, 2026
Between May 25 and 31, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-528
Date: June 1, 2026
Between May 25 and 31, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-527
Date: June 1, 2026
Between May 25 and 31, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-456
Date: May 12, 2026
Updated: June 1, 2026
On May 12, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
On May 21, 2026, Microsoft published an out-of-band (OOB) security update to address CVE-2026-45659, an additional vulnerability impacting Microsoft SharePoint Enterprise Server 2019, Microsoft SharePoint Server 2016 and Microsoft SharePoint Server Subscription Edition. The CVE was inadvertently omitted from the May 2026 Security Updates.
Open-source reporting indicates that CVE-2026-41089 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-462
Date: May 13, 2026
Updated: May 29, 2026
On May 13, 2026, Palo Alto Networks published security advisories to address vulnerabilities in the following products:
Update 1
On May 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to their Known Exploited Vulnerabilities (KEV) Database.
Impacted products for CVE-2026-0257:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.
Number: AL26-013
Date: May 29, 2026
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
On May 18, 2026, GitHub detected unauthorized access to its internal systems originating from a compromised employee deviceFootnote 1. The intrusion was facilitated by a maliciously modified version of the Nx Console Visual Studio Code extension (version 18.95.0)Footnote 2. The attacker successfully exfiltrated approximately 3,800 internal GitHub repositories, containing proprietary source code and internal configuration data. GitHub Enterprise Server customers are advised to follow vendors recommendations. No action is required for GitHub Enterprise Cloud clients.
In response to this security incident, and the release of the GitHub Security Notification, the Cyber Centre released AV26-512 on May 27, 2026Footnote 3.
The purpose of this alert is to increase awareness of the reported incident and to take necessary measures.
The Cyber Centre suggests the following actions:
~/.local/share/kitty/cat.py and related persistence (launch agents)In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote 4.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.
Serial number: AV26-526
Date: May 29, 2026
On May 28, 2026, Oracle published a security advisory to address critical vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.