Serial number: AV26-975
Date: September 29, 2026

As of September 29, 2026, Hitachi is affected by vulnerabilities in the following product:

• RTU500 series CMU firmware
  • Prior to 12.7.8, 13.9.1 or later

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerabilities in Hitachi Energy RTU500 End-of-Life versions (PDF)
• Hitachi Vulnerability Information

Serial number: AV26-977
Date: September 29, 2026

As of September 29, 2026, TeamViewer is affected by vulnerabilities in the following products:

• TeamViewer Full Client (Windows/Linux/MacOS)
  • Multiple versions and Platforms
• TeamViewer Host (Windows/Linux/MacOS)
  • Multiple versions and Platforms

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Update for Multiple Vulnerabilities in TeamViewer Clients and Related Services
• Security bulletins | TeamViewer

Serial number: AV26-976
Date: September 29, 2026

As of September 29, 2026, Mozilla is affected by vulnerabilities in the following products:

• Firefox ESR
  • Versions prior to 153.4
  • Versions prior to 140.17
  • Versions prior to 115.42
• Firefox
  • Versions prior to 157

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Vulnerabilities fixed in Firefox 157
• Security Vulnerabilities fixed in Firefox ESR 153.4
• Security Vulnerabilities fixed in Firefox ESR 115.42
• Security Vulnerabilities fixed in Firefox ESR 140.17
• Mozilla Foundation Security Advisories — Mozilla

Serial number: AV26-974
Date: September 29, 2026

As of September 28, 2026, SUSE is affected by vulnerabilities in the following product:

• Rancher
  • Prior to 0.12.19
  • Prior to 0.13.15
  • Prior to 0.13.16
  • Prior to 0.14.10
  • Prior to 0.14.10
  • Prior to 0.15.6
  • Prior to 0.15.7
  • Prior to 0.16.1
  • Prior to 0.16.2
  • Prior to 2.11.18
  • Prior to 2.12.14
  • Prior to 2.13.10
  • Prior to 2.14.6
  • Prior to 2.15.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
• Session Not Revoked Server-Side on Logout in Rancher
• Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
• Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
• SUSE:Update Advisories | SUSE

Serial number: AV26-973
Date: September 29, 2026

As of September 28, 2026, FreePBX is affected by vulnerabilities in the following products:

• music
  • Prior to 16.0.4
  • Prior to 17.0.6
• ucp
  • Prior to 16.0.39
  • Prior to 17.0.6
• soundlang
  • Prior to 17.0.5
  • Prior to 16.0.10
• backup
  • Prior to 16.0.72
  • Prior to 17.0.7
• superfecta
  • Prior to 16.0.40
  • Prior to 17.0.7
• api
  • Prior to 17.0.9

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• FreePBX Security Advisories

Serial number: AV26-972
Date: September 29, 2026

As of September 28, 2026, WatchGuard is affected by vulnerabilities in the following product:

• WatchGuard AP
  • Prior to 3.4.8

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-101891 — WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
• CVE-2026-86102 — WatchGuard AP Command Injection in Internal Management API Allows Command Execution
• CVE-2026-87969 — WatchGuard AP Authenticated Command Injection in Diagnostic CLI
• WatchGuard Security Advisories

Serial number: AV26-971
Date: September 29, 2026

As of September 28, 2026, Apple is affected by a vulnerability in the following products:

• iOS and iPadOS
  • Prior to 27.0.1
  • Prior to 26.7.1
• macOS Golden Gate
  • Prior to 27.0.1
• macOS Tahoe
  • Prior to 26.7.1
• macOS Sequoia
  • Prior to 15.8.1
• watchOS
  • Prior to 27.0.1
• visionOS 27
  • Prior to 27.0.1

Apple has indicated that CVE-2026-86950 may have been exploited.

On September 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86950 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Apple security releases - Apple Support
• CISA KEV: CVE-2026-86950

Serial Number: AV26-970
Date: September 28, 2026

Linux security advisory (AV26-970)

As of September 25, 2026, Linux is affected by a vulnerability in the following product:

• Linux Kernel
  • Version prior to 4.7
  • Version 5.10 prior to 5.10.270
  • Version 5.15 prior to 5.15.221
  • Version 6.1 prior to 6.1.188
  • Version 6.12 prior to 6.12.110
  • Version 6.18 prior to 6.18.52
  • Version 6.6 prior to 6.6.157
  • Version 7.2 prior to 7.2.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Kernel/git/stable/linux.git _ 1
• Kernel/git/stable/linux.git _ 2
• Kernel/git/stable/linux.git _ 3
• Linux Kernel Stable Tree

Serial Number: AV26-969
Date: September 28, 2026

As of September 25, 2026, wolfSSL is affected by vulnerabilities in the following product:

• wolfSSL
  • Prior to or equal to 5.9.4

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• wolfSSL Release 5.9.4 (September 25, 2026)

Serial Number: AV26-968
Date: September 28, 2026

As of September 28, 2026, SUSE is affected by a vulnerability in the following product:

• NeuVector
  • Prior to 5.4.11
  • Prior to 5.5.4
  • Prior to 5.6.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
• SUSE Update Advisories

Serial Number: AV26-967
Date: September 28, 2026

As of September 25, 2026, IBM is affected by vulnerabilities in the following products:

• IBM Big Replicate LiveData Migrator
  • Prior to or equal to 3.3
• IBM App Connect Enterprise
  • Prior to or equal to version 13.0.1.0 to 13.0.8.2
• DataStage on Cloud Pak for Data
  • Prior to or equal to 5.4.0.0
• Analyst Workflow
  • Prior to or equal to version 1.0.0 - 3.1.0
• IBM QRadar Deployment Intelligence App
  • Prior to or equal to version 1.0.0 - 3.0.19
• IBM Rhapsody Systems Engineering
  • Prior to or equal to version 1.6.0-1.8.0
• IBM Concert
  • Prior to or equal to version 1.0.0 to 3.0.0

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• IBM Product Security Incident Response

Serial Number: AV26-966
Date: September 28, 2026

As of September 24, 2026, Dell is affected by vulnerabilities in the following products:

• Rugged Control Center (RCC)
  • Prior to 5.2.206
• Secure Connect Gateway (SCG) Policy Manager
  • Prior to 5.36.00.16
• ThinOS 10
  • Prior to SecurityAddon_2605.10.2766_T10
• Dell Trusted Device Client
  • Prior to 8.1.359.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• DSA-2026-410: Security Update for Dell Rugged Control Center (RCC) Multiple Vulnerabilities
• DSA-2026-385: Security Update for Dell Secure Connect Gateway Policy Manager Multiple Vulnerabilities
• DSA-2026-404: Security Update for Dell ThinOS 10 for Multiple Vulnerabilities
• DSA-2026-408: Security Update for Dell Trusted Device Client for an Incorrect Permission Assignment for Critical Resource Vulnerability
• Security Advisories, Notices and Resources

Serial number: AV26-965
Date: September 28, 2026

As of September 27, 2026, Citrix is affected by vulnerabilities in the following products:

• NetScaler ADC and NetScaler Gateway 14.1
  • Prior to 14.1-73.37
• NetScaler ADC and NetScaler Gateway 13.1
  • Prior to 13.1-64.23
• NetScaler ADC FIPS
  • Prior to 14.1-73.37 FIPS
• NetScaler ADC FIPS and NDcPP
  • Prior to 13.1-37.279

On September 27, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-88771 and CVE-2026-88772 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Citrix NetScaler ADC and Citrix NetScaler Gateway Security Bulletin for CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775, CVE-2026-88776, CVE-2026-88777, and CVE-2026-88778
• Citrix Security Advisories
• CISA KEV: CVE-2026-88771
• CISA KEV: CVE-2026-88772

Number: AL26-024
Date: September 27, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances. In response to the vendor security bulletin ^{Footnote 1} and blog ^{Footnote 2} released on September 27, 2026, the Cyber Centre is issuing this alert to raise awareness of the vulnerabilities and associated reports of active exploitation.

Tracked as CVE-2026-88771 ^{Footnote 3}, this vulnerability is an Improper Input Validation vulnerability (CWE-20) ^{Footnote 4}. The vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable NetScaler appliance. Successful exploitation could result in complete compromise of the appliance, unauthorized access to applications and services, credential theft, lateral movement, and further compromise of internal systems.

Tracked as CVE-2026-88772 ^{Footnote 5}, this vulnerability is a Buffer Overflow vulnerability (CWE-119) ^{Footnote 6}. Successful exploitation may allow arbitrary code execution, memory corruption, denial of service conditions, or other unintended behaviour on affected appliances.

Reports indicate that these vulnerabilities are being exploited and have been observed across multiple Citrix customer environments worldwide, although the full extent of this activity remains unknown at this time.

Suggested actions

Organizations should review the Citrix security bulletin ^{Footnote 1} to determine whether their deployments are affected, prioritize remediation of Internet-facing systems, and investigate for signs of compromise, particularly where evidence of suspicious activity predates the release of vendor fixes

The Cyber Centre also recommends that organizations:

• contact Citrix or their authorized support provider as soon as possible to obtain the latest security guidance and patch availability information
• Preserve forensic evidence before shutting down, rebooting, patching, rebuilding, or otherwise modifying affected appliances, where feasible.
• Preserve appliance logs, remote syslog records, and NetScaler Console logs.
• Collect support bundles and other diagnostic information that may assist future investigations.
• Review running processes and active network connections for suspicious or unexplained activity.
• Examine startup scripts, scheduled tasks, web application directories, and crash dump locations for unauthorized modifications or indicators of persistence.
• Preserve suspicious files and configurations before changing or removing them.
• Correlate findings with firewall, DNS, authentication, endpoint, and other supporting telemetry sources.
• Investigate unexpected outbound connections, unusual administrative access, and suspicious activity on connected systems.
• Review the attached list of indicators of compromise and investigate to find matching patterns.
• Follow Citrix guidance for suspected compromises, including isolation of affected appliances and assessment of credential exposure ^{Footnote 7}.
• Conduct an organization-specific risk assessment based on the criticality of affected NetScaler deployments, any suspicious findings, and the limited information currently available.
• Where operationally feasible and justified by the organization's risk assessment, consider temporarily disabling or shutting down Internet-facing NetScaler appliances until vendor guidance and security updates become available; organizations should carefully weigh the cybersecurity risks of continued operation against the operational and business impacts of service disruption before taking this action.
• Prepare to reset credentials, invalidate active sessions, and replace certificates if compromise is suspected
• Be prepared to rebuild or replace compromised appliances from trusted software and known-good configurations.

Note: Organizations operating Common Criteria ^{Footnote 8} evaluated configurations should review Citrix's advisory ^{Footnote 1} and apply the recommended updates in accordance with their change management and certification requirements.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions ^{Footnote 9}.

• Consolidate, monitor, and defend Internet gateways
• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial number: AV26-952
Date: September 23, 2026
Updated: September 25, 2026

As of September 22, 2026, WordPress is affected by a vulnerability in the following product:

• WordPress
  • Prior to 7.1.2

Open-source reporting indicates that CVE-2026-87902 is being exploited in the wild.

Update 1

On September 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87902 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Unauthenticated path traversal in page-template resolution leading to conditional RCE · Advisory · WordPress/wordpress-develop
• WordPress Releases
• CISA KEV: CVE-2026-87902

Serial Number: AV26-964
Date: September 25, 2026

As of September 25, 2026, Zimbra is affected by vulnerabilities in the following product:

• Zimbra Collaboration Suite (ZCS) (Daffodil)
  • Prior to 10.1.21

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• What’s New in Zimbra 10.1.21 (Daffodil)
• Zimbra Blog - All Things Zimbra

Serial Number: AV26-804
Date: August 11, 2026
Updated:September 25, 2026

As of August 11, 2026, Microsoft is affected by vulnerabilities in the following products:

• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 8.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 9.0 installed on Windows
• App Installer
• Application Insights Profiler
• Azure Active Directory
• Azure Confidential Ledger
• Azure CycleCloud
• Azure Kubernetes Service
• Azure Logic Apps
• Azure Monitor Agent Linux Extension
• Azure SQL Database
• Azure SQL Managed Instance
• Azure SRE Agent
• Azure Service Bus
• Azure Storage Explorer
• Microsoft .NET Framework 3.5
• Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
• Microsoft .NET Framework 3.5 AND 4.7.2
• Microsoft .NET Framework 3.5 AND 4.8
• Microsoft .NET Framework 3.5 AND 4.8.1
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
• Microsoft .NET Framework 4.8
• Microsoft .NET Framework 4.8.1
• Microsoft 365 Admin Center
• Microsoft 365 Apps for Enterprise
• Microsoft Access 2016
• Microsoft Defender for Endpoint for Mac
• Microsoft Dynamics 365 (on-premises)
• Microsoft Dynamics 365 Business Central 2024
• Microsoft Dynamics 365 Business Central 2026
• Microsoft Dynamics 365 Business Central Release Wave 1 2025
• Microsoft Dynamics 365 Business Central Release Wave 2 2025
• Microsoft Entra Connect
• Microsoft Entra ID
• Microsoft Entra Provisioning Service
• Microsoft Excel 2016
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019
• Microsoft Exchange Server Subscription Edition RTM
• Microsoft Office 2016
• Microsoft Office 2019
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Microsoft Outlook 2016
• Microsoft Planetary Computer Pro (GeoCatalog)
• Microsoft Power Apps
• Microsoft PowerPoint 2016
• Microsoft Purview eDiscovery
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Online
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Microsoft Teams
• Microsoft Teams for Android
• Microsoft Teams for iOS
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• Microsoft Visual Studio Code CoPilot Chat Extension
• Microsoft Word 2016
• OneDrive for MacOS
• Power BI Report Server
• PowerShell 7.4
• PowerShell 7.5
• PowerShell 7.6
• Python extension for Visual Studio Code
• Visual Studio Code
• Windows 10
• Windows 11
• Windows App Client for Windows Desktop
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations, and apply the necessary updates.

Update 1

On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33824 and CVE-2026-55040 to their Known Exploited Vulnerabilities (KEV) Database.

Update 2

Open-source reporting indicates that CVE-2026-63520 related to Microsoft SharePoint Server is being exploited in the wild.

Update 3

Open-source reporting indicates that CVE-2026-65660 related to Microsoft SharePoint Server is being exploited in the wild.

Update 4

On September 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-65660 to their Known Exploited Vulnerabilities (KEV) Database.

• August 2026 Security Updates
• CISA KEV: CVE-2026-33824
• CISA KEV: CVE-2026-55040
• CISA KEV: CVE-2026-65660

Serial Number: AV26-887
Date: September 8, 2026
Updated: September 25, 2026

As of September 3, 2026, Mikrotik is affected by vulnerabilities in the following product:

• RouterOS
  • Prior to 6.49.21
  • Prior to 7.23.4
  • Prior to 7.24.2
  • Prior to 7.25 beta 3

Open-source reporting indicates that CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 related to MikroTik are being exploited in the wild.

Update 1

On September 10, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-CVE-2026-67277 and CVE-2026-86060 to their Known Exploited Vulnerabilities (KEV) Database.

Update 2

On September 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-67279 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerabilities in Mikrotik RouterOS software
• September 2026 vulnerability
• CISA KEV: CVE-2026-67277
• CISA KEV: CVE-2026-86060
• CISA KEV: CVE-2026-67279

Serial number: AV26-963
Date: September 25, 2026

As of September 24, 2026, ServiceNow is affected by vulnerabilities in the following product:

• ServiceNow AI Platform
  • Versions prior to Australia Patch 2 Hot Fix 4b W32
  • Versions prior to Australia Patch 4 Hot Fix 3
  • Versions prior to Australia Patch 5
  • Versions prior to Yokohama Patch 13 Hot Fix 5a
  • Versions prior to Zurich Patch 10 Hot Fix 3b
  • Versions prior to Zurich Patch 10 Hot Fix 4a W32
  • Versions prior to Zurich Patch 11 Hot Fix 3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• September 2026 CVE Advisory Notification
• ServiceNow security advisories

Serial number: AV26-962
Date: September 25, 2026

As of September 23, 2026, GitLab is affected by vulnerabilities in the following product:

• GitLab
  • Prior to 19.2.7
  • Prior to 19.3.3
  • Prior to 19.4.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
• GitLab release notes | GitLab Docs

Serial number: AV26-808
Date: August 12, 2026
Updated: September 24, 2026

As of August 11, 2026, Adobe is affected by vulnerabilities in the following products:

• Adobe Campaign Classic
  • Prior to or equal to ACC v7: 7.4.3 build 9399
• Adobe Commerce
  • Prior to or equal to 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug and 2.4.4-2026-aug
• Adobe Commerce B2B
  • Prior to or equal to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul and 1.3.3-2026-jul
• ColdFusion 2023
  • Prior to or equal to 2023.0.22
• ColdFusion 2025
  • Prior to or equal to 2025.0.11
• Content Credentials Command-Line Tool
  • Prior to or equal to c2patool-v0.27.5
• Content Credentials JS SDK
  • Prior to or equal to @contentauth/c2pa-web@0.12.0
• Content Credentials Rust SDK
  • Prior to or equal to c2pa-v0.90.5
• Lightroom Classic
  • Prior to or equal to 15.4, 15.4.1, 15.3, 15.3.1, 15.2, 15.2.1
• Magento Open Source
  • Prior to or equal to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul

Update 1

Open-source reporting indicates that CVE-2026-71362 is being exploited in the wild.

Update 2

On September 24, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-71362 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security update available for Adobe Commerce | APSB26-92
• Adobe Product Security Incident Response Team
• CISA KEV: CVE-2026-71362

Number: AL26-023
Date: September 24, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation of a vulnerability affecting Microsoft SharePoint Server^{Footnote 1}. In response to the Microsoft security advisory, released on August 11, 2026^{Footnote 2}, the Cyber Centre issued AV26-804 Update 3^{Footnote 3} on September 24, 2026.

Tracked as CVE-2026-65660^{Footnote 4}, this vulnerability is an Improper Control of Generation of Code ('Code Injection') (CWE-94)^{Footnote 5} vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an authenticated attacker to execute arbitrary code on vulnerable SharePoint servers.

Chained with other SharePoint vulnerabilities, this vulnerability can achieve pre-authentication remote code execution on SharePoint servers configured to permit anonymous access. Organizations that have not fully applied prior SharePoint security updates may therefore face an elevated risk of compromise.

Suggested actions

The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:

Important note: Microsoft SharePoint Enterprise Server 2016^{Footnote 6} and Server 2019^{Footnote 7} are end of life as of July 15, 2026. Organizations are urged to migrate to a supported version.

The Cyber Centre also recommends organizations to:

• Identify all on-premises SharePoint Server instances, particularly those exposed to the Internet, and ensure they are running supported versions of Microsoft SharePoint Server.
• Apply the latest Microsoft security updates to all affected SharePoint Server deployments, including SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016.
• Reduce the attack surface by restricting or eliminating direct internet exposure of SharePoint servers where possible, limiting access to SharePoint Central Administration and other management interfaces.
• Strengthen access controls by reviewing SharePoint environments for unnecessary or inactive accounts, removing unused accounts, and enforcing multi-factor authentication (MFA) for administrators and other privileged users.
• Harden SharePoint deployments by enabling Antimalware Scan Interface (AMSI) integration for SharePoint web applications and configuring AMSI Request Body Scan Mode to Full Mode where operationally feasible.
• Monitor for indicators of compromise and exploitation activity, including:
  • unusual administrative activity or suspicious authenticated access attempts
  • unexpected web part modifications or unauthorized configuration changes
  • unauthorized authentication attempts and privilege escalation activity
  • suspicious access to IIS machine keys
  • evidence of deserialization attacks, web shell deployment, or malicious process execution
  • unusual requests targeting SharePoint services
  • Microsoft Defender or AMSI detections related to SharePoint exploitation activity
• Conduct ongoing log and security monitoring of SharePoint, IIS, endpoint security, and authentication logs to detect and investigate suspicious activity.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics^{Footnote 8}:

• patch operating systems and applications
• harden operating systems and applications
• isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial number: AV26-961
Date: September 24, 2026

As of September 23, 2026, WebPros is affected by vulnerabilities in the following products:

• Plesk
  • Versions 18.0.34 to 18.0.80.7
  • Version 18.0.81.0
• Plesk extension "Plesk RESTful API"
  • Versions 2.4.2 to 2.4.6
• Plesk extension "Site Import"
  • Prior to or equal to 1.12.1
• WP Toolkit for cPanel
  • Prior to or equal to 6.11.2-10794
• cPanel/WHM
  • Prior to 11.134.0.57
  • Prior to 11.136.0.41
  • Prior to 11.138.0.8

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerability CVE-2026-68492: Arbitrary code execution as root in Plesk via the Plesk RESTful API extension
• Vulnerability CVE-2026-87898: Arbitrary code execution as root in Plesk's Site Import extension
• Security: CVE-2026-87899 Vulnerability in cPanel's CalDAV/CardDAV - September 22, 2026 – cPanel
• Security: CVE-2026-87900 Vulnerability in WP Toolkit Database Creation - September 22, 2026 – cPanel

Serial Number: AV26-960
Date: September 23, 2026

As of September 23, 2026, Forcepoint is affected by a vulnerability in the following product:

• Forcepoint Security Engine (NGFW)
  • Versions 7.1.0 to 7.1.13
  • Versions 7.3.0 to 7.3.1
  • Version 7.33
  • Version 7.4.0 to 7.4.1
  • Version 7.5.0

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Forcepoint Hub
• Forcepoint Help and Resource Center

Serial number: AV26-959
Date: September 23, 2026

As of September 21, 2026, Dell is affected by vulnerabilities in the following products:

• Dell Command Powershell Provider (DCPP)
  • Prior to 2.10.2
• Dell Command Monitor (DCM)
  • Prior to 10.13.2
• Dell Inventory Collector Client
  • Prior to 15.0.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• DSA-2026-379: Security Update for Dell Command | PowerShell Provider (DCPP) for a Credential Theft via PowerShell Event Log Vulnerability
• DSA-2026-380: Security Update for Dell Command | Monitor (DCM) for an Incorrect Permission Assignment for Critical Resource Vulnerability
• DSA-2026-381: Security Update for Dell SupportAssist for PCs (Home and Business), Dell Optimizer, Dell Trusted Device, Dell Command | Update for an Unquoted Search Path or Element Vulnerability
• Security Advisories, Notices and Resources

Serial number: AV26-958
Date: September 23, 2026

As of September 22, 2026, MikroTik is affected by a vulnerability in the following product:

• RouterOS
  • Prior to 7.25beta5

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• 7.25beta [development] is released!

Serial number: AV26-957
Date: September 23, 2026

As of September 22, 2026, NVIDIA is affected by vulnerabilities in the following products:

• Infrastructure Controller
  • Versions 0 to 1.9
• NeMo Speech
  • Versions 0.0 to 2.9

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Bulletin: NVIDIA Infrastructure Controller - September 2026
• Security Bulletin: NVIDIA NeMo Speech - September 2026
• NVIDIA Product Security

Serial Number: AV26-956
Date: September 23, 2026

As of September 22, 2026, GitHub is affected by vulnerabilities in the following product:

• Enterprise Server
  • 3.17.0 Prior to 3.17.21
  • 3.18.0 Prior to 3.18.15
  • 3.19.0 Prior to 3.19.12
  • 3.20.0 Prior to 3.20.8
  • 3.21.0 Prior to 3.21.6
  • 3.22.0 Prior to 3.22.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release notes - GitHub Enterprise Server 3.17 Docs 
• Release notes - GitHub Enterprise Server 3.18 Docs
• Release notes - GitHub Enterprise Server 3.19 Docs
• Release notes - GitHub Enterprise Server 3.20 Docs
• Release notes - GitHub Enterprise Server 3.21 Docs
• Release notes - GitHub Enterprise Server 3.22 Docs
• GitHub Enterprise Server releases - GitHub Enterprise Server 3.19 Docs

Serial number: AV26-955
Date: September 23, 2026

As of September 22, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop
  • Versions prior to 154.0.8037.57/.58 (Windows/Mac), and 54.0.8037.57 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Google Chrome Security Advisory

Serial number: AV26-954
Date: September 23, 2026

As of September 22, 2026, Ubiquiti Inc is affected by vulnerabilities in the following products:

• Cloud Gateways
  • Prior to 5.1.31
• Dream Machines
  • Prior to 5.1.31
• Dream Routers
  • Prior to 5.1.31
• Dream Wall
  • Prior to 5.1.31
• Enterprise Firewalls
  • Prior to 5.1.31
• Express
  • Prior to 4.0.21
• Express 7
  • Prior to 5.1.31
• UniFi Gateways
  • Prior to 5.1.26

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Security Advisory Bulletin 069

Serial number: AV26-953
Date: September 23, 2026

As of September 22, 2026, Adobe is affected by vulnerabilities in the following products:

• AEM 6.5 Forms JEE
  • Prior to or equal to 6.5.25
• AEM 6.5 LTS Forms JEE
  • Prior to or equal to 6.5 LTS SP2
• Adobe Bridge
  • Prior to or equal to 15.1.7 (LTS)
  • Prior to or equal to 16.0.6
• Adobe Connect
  • Prior to or equal to 12.11
• Adobe Connect Android Mobile App
  • Prior to or equal to 4.4
• C2PA Tool
  • Prior to or equal to c2patool-v0.26.70
• Content Credentials Rust SDK
  • Prior to or equal to c2pa-v0.89.2
• InDesign Desktop
  • Prior to or equal to ID20.5.4
  • Prior to or equal to ID21.5
• Premiere
  • Prior to or equal to 25.6.5
  • Prior to or equal to 26.3.2
• Substance3D - Modeler
  • Prior to or equal to 1.22.6

• Adobe Product Security Incident Response Team

Serial number: AV26-951
Date: September 23, 2026

As of September 22, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products:

• Analytics and Location Engine (ALE)
  • Prior to or equal to 5.0.0.0
• HPE Telco Service Orchestrator
  • Prior to or equal to 5.6.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• HPESBNW05137 rev.1 - Multiple Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)
• HPESBNW05151 rev.1 - Remote DoS in remote Telco service Orchestrator
• HPE Security Bulletin Library

Serial number: AV26-950
Date: September 23, 2026

As of September 22, 2026, SolarWinds is affected by vulnerabilities in the following product:

• SolarWinds Observability Self-Hosted
  • Prior to 2026.2.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28325)
• SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVE-2026-28324)
• SolarWinds Security Vulnerabilities

Serial Number: AV26-902
Date: September 9, 2026
Updated: September 22, 2026

As of September 9, 2026, Check Point is affected by vulnerabilities in the following products:

• Security Gateway
  • Multiple versions
• Check Point Spark Firewall using Site to Site VPN or Remote Access VPN
  • Multiple versions
• Security Management Server
  • Multiple versions
• Check Point Spark Firewall
  • Multiple versions

Update 1

Check Point has reported that CVE-2026-85102 and CVE-2026-93616 are being exploited in the wild.

Update 2

On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) CVE-2026-85102 and CVE-2026-93616 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
• CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution
• Check Point Security
• Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616
• CISA KEV: CVE-2026-85102
• CISA KEV: CVE-2026-93616

Serial number: AV26-949
Date: September 22, 2026

As of September 22, 2026, F5 is affected by a vulnerability in the following product:

• BIG-IP APM
  • Versions 21.1.0 prior to Hotfix-BIGIP-21.1.0.2.0.30.22-ENG
  • Versions 17.5.0 prior to Hotfix-BIGIP-17.5.1.9.0.160.12-ENG
  • Versions 17.1.0 prior to Hotfix-BIGIP-17.1.3.5.0.41.14-ENG

F5 has reported that CVE-2026-94127 is being exploited in the wild.

Update 1
On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-94127 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• K000162605: BIG-IP APM vulnerability CVE-2026-94127
• 2026 security notifications
• CISA KEV: CVE-2026-94127

Serial number: AV26-947
Date: September 22, 2026

As of September 22, 2026, Arista Networks is affected by a vulnerability in the following product:

• VeloCloud Orchestrator (VCO) On-Prem
  • Versions 5.2.0 to 5.2.3.15
  • Versions 6.1.0 to 6.1.3.7
  • Versions 6.4.0 to 6.4.2.7
  • Versions 7.0.0 to 7.0.0.2

Update 1

On September 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-93952 to their Known Exploited Vulnerabilities (KEV) Database.

Open-source reporting indicates that CVE-2026-93952 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory 0183
• Arista Networks Advisories & Notices
• CISA KEV: CVE-2026-93952

Number: AL26-022
Date: September 22, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting F5 BIG IP Access Policy Manager (APM)^{Footnote 1}.

In response to the vendor advisory released on September 22, 2026, the Cyber Centre released AV26-949 on September 22, 2026^{Footnote 2}.

Tracked as CVE-2026-94127^{Footnote 3}, this vulnerability is a Heap-based Buffer Overflow (CWE-122)^{Footnote 4} and it affects F5 BIG-IP systems where an APM access policy and an OAuth profile are configured on the same virtual server. Under these conditions, specially crafted malicious traffic may allow an unauthenticated attacker to execute arbitrary code on the affected device, potentially resulting in remote code execution and full system compromise.

F5 has indicated that CVE-2026-94127 is being exploited in the wild.

Suggested actions

The Cyber Centre strongly recommends that organizations running affected F5 BIG‑IP APM deployments upgrade to the following vendor-supported fixed hotfix releases:

The Cyber Centre also recommends organizations to:

• Identify vulnerable BIG IP systems that have both an APM access policy and an OAuth profile configured on a virtual server.
• Apply the vendor-provided iRule (contact F5 Support to obtain the iRule)^{Footnote 1}.
• Review access logs for indicators of compromise (IoC), particularly OAuth authentication failures especially in rapid succession or large volume^{Footnote 1}. Also review administrative accounts, access policies for any signs of suspicious activity.
• Upgrade to a vendor-supported fixed software version as soon as possible.
• Ensure management interfaces are restricted to trusted administrative networks.
• Follow F5 guidance for vulnerability remediation and validation following patch deployment.

Note: Organizations operating Common Criteria^{Footnote 5} evaluated configurations should review F5's advisory^{Footnote 1} and apply the recommended updates in accordance with their change management and certification requirements.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions^{Footnote 6} with an emphasis on the following topics:

• Consolidating, monitoring, and defending Internet gateways
• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial Number: AV26-948
Date: September 22, 2026

As of September 22, 2026, Erlang is affected by vulnerabilities in the following product:

• OTP
  • 17.0 Prior to 27.3.4.18
  • 21b8a1b Prior to afec515, 98c66c8 and fd1d9d0
  • 22.2 Prior to 27.3.4.18, 28.5.0.7 and 29.1.1
  • 4.1.1 Prior to 5.2.11.13, 5.5.2.6 and 6.0.6
  • 9.5 Prior to 11.2.12.13, 11.6.0.6 and 11.7.7
  • Versions Prior to 84adefa

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-65634
• CVE-2026-89422
• Security Advisories · erlang/otp · GitHub

Serial number: AV26-503
Date: May 25, 2026
Updated: September 21, 2026

On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product: 

• Roundcube Webmail – versions prior to 1.6.16
• Roundcube Webmail – versions prior to 1.7.1

Update 1

Open-source reporting indicates that CVE-2026-48842 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Roundcube Webmail 1.6.16
• Roundcube Webmail 1.71
• Roundcube Open Source Webmail Software

Serial number: AV26-603
Date: June 16, 2026
Updated: September 21, 2026

On June 16, 2026, Zyxel published a security advisory to address vulnerabilities in the following products:

• GS1900 series switches – multiple versions and models

Update 1

On September 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-7273 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Zyxel security advisory for stack-based buffer overflow vulnerability in GS1900 series switches
• Zyxel Advisories
• CISA KEV: CVE-2026-7273

Serial number: AV26-513
Date: May 27, 2026
Updated: September 21, 2026

On May 27, 2026, Veeam published security advisories to address vulnerabilities in the following products:

• Veeam Backup & Replication – 13 versions prior to 13.0.2.29
• Veeam ONE – versions prior to 13.0.2.6723
• Veeam Service Provider Console – 9.2 versions prior to 9.2.1.33875

Update 1

Open-source reporting indicates that CVE-2026-32996 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Vulnerabilities Resolved in Veeam Backup & Replication 13.0.2
• List of Security Fixes and Improvements in Veeam Service Provider Console
• List of Security Fixes and Improvements in Veeam ONE
• Vulnerability Resolved in Veeam Service Provider Console 9.2.1
• Veeam Knowledge Base

Serial number: AV26-946
Date: September 21, 2026

As of September 21, 2026, MISP is affected by vulnerabilities in the following product:

• MISP
  • Prior to 2.5.47

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Strip the client id from module-result event reports
• Read only api keys can regain full role powers
• Refuse a MISP export upload whose content is a path or URL

Serial number: AV26-945
Date: September 21, 2026

As of September 17, 2026, MongoDB is affected by vulnerabilities in the following products:

• Mongoid
  • Multiple versions
• C Driver
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Security Related: Common Vulnerabilities and Exposures (CVEs)

Serial number: AV26-944
Date: September 21, 2026

As of September 18, 2026, Exim is affected by vulnerabilities in the following product:

• Exim
  • Prior to 4.100.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Exim Security Release - 4.100.1
• Exim Internet Mailer

Serial number: AV26-943
Date: September 21, 2026

As of September 18, 2026, IBM is affected by vulnerabilities in the following products:

• CICS TX Advanced
  • Version 10.1
• Guardium Data Protection
  • Version 12.2
• IBM MQ
  • Multiple versions
• IBM MQ for HPE NonStop
  • Versions 8.1.0 to 8.1.0.40
• Sterling File Gateway
  • Prior to or equal to 6.2.0.6_1, 6.2.1.0 to 6.2.1.2 and 6.2.2.0 to 6.2.2.1
• WebSphere Application Server
  • Versions 8.5 and 9.0
• IBM i
  • Versions 7.3, 7.4, 7.5 and 7.6
• spectrum-lsf IBM Platform RTM
  • Versions 10.2.0.15 and 10.2.0.16

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• IBM Product Security Incident Response

Serial number: AV26-942
Date: September 18, 2026

As of September 18, 2026, ABB published a security advisory to address vulnerabilities in the following product:

• Freelance Controller
  • Multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Freelance SECURITY - Missing Length Check CVE ID: CVE-2023-5778
• ABB Cyber security alerts and notifications

Serial number: AV26-941
Date: September 18, 2026

As of September 17, 2026, SolarWinds is affected by a vulnerability in the following product:

• SolarWinds Access Rights Manager
  • Prior to 2026.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28326)

Serial number: AV26-940
Date: September 18, 2026

As of September 9, 2026, Arista Networks is affected by vulnerabilities in the following product:

• EOS
  • Multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory 0174
• Arista Networks Advisories & Notices

Serial number: AV26-939
Date: September 18, 2026

As of September 17, 2026, Google is affected by vulnerabilities in the following product:

• Chrome
  • Prior to 153.0.8010.53

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Stable Channel Update for Desktop

Serial number: AV26-938
Date: September 18, 2026

As of September 18, 2026, Moxa is affected by a vulnerability in the following product:

• TN-4500B Series
  • Prior to or equal to v2.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-15579: Out-of-bounds Write Vulnerability in Ethernet Switch
• Moxa Security Advisory