Serial number: AV26-706
Date: July 15, 2026

On July 15, 2026, Cisco published security advisories to address vulnerabilities in the following products:

• Cisco RoomOS Release 11 and earlier On-Premises Operation – versions prior to 11.32.6.0
• Cisco RoomOS Release 11 and earlier Cloud-Aware Operation – versions prior to RoomOS 11.39.1.1
• Cisco RoomOS Release 26 On-Premises Operation – versions prior to 26.5.2.2
• Cisco RoomOS Release 26 Cloud-Aware Operation – versions prior to RoomOS June 2026 (26.7.1.7)

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.

• Cisco RoomOS Security Hardening Release: July 2026
• Cisco Security Advisories

Serial number: AV26-526
Date: May 29, 2026
Updated: July 15, 2026

On May 28, 2026, Oracle published a security advisory to address critical vulnerabilities in the following products:

• Oracle Communications Unified Assurance - versions 6.1.1 to 7.0.0
• Oracle Database Server - versions 23.4.0 to 23.26.2
• Oracle E-Business Suite - versions 12.2.3 to 12.2.15
• Oracle Hospitality OPERA 5 Property Services - versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 and 5.6.28
• Oracle REST Data Services - versions 24.2.0 to 26.1.0

Update 1

Open-source reporting indicates that CVE-2026-46817 is being exploited.

Update 2

On July 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46817 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Oracle Critical Security Patch Update Advisory - May 2026
• Oracle Critical Patch Updates, Security Alerts and Bulletins
• CISA KEV: CVE-2026-46817

Number: AL26-017
Date: July 15, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security (Cyber Centre) is also available to provide additional assistance regarding the content of this Alert upon request.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting Microsoft SharePoint Server. In response to the Microsoft security advisory, released on July 14, 2026^{Footnote 1}, the Cyber Centre issued AV26-698^{Footnote 2} on July 14, 2026.

Tracked as CVE-2026-55164^{Footnote 3}, this vulnerability is a Missing Authentication for Critical Function (CWE-306)^{Footnote 4} vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to elevate privileges over a network.

Tracked as CVE-2026-55040^{Footnote 5Footnote 6}, this vulnerability is a Weak Authentication (CWE-1390)^{Footnote 7} vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to bypass a security feature over a network.

Tracked as CVE-2026-58644^{Footnote 8}, this vulnerability is a Deserialization of Untrusted Data (CWE-502)^{Footnote 9} vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to execute code over a network.

Microsoft is aware of exploitation of CVE-2026-56164 and other previously released SharePoint related vulnerabilities. CVE-2026-56164 was added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog^{Footnote 10} on July 14, 2026.

Suggested actions

The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:

The Cyber Centre recommends organizations:

• Identify all on-premises SharePoint Server instances, particularly those exposed to the internet
• Use or upgrade to supported versions of on-premises Microsoft SharePoint Server
• Apply the latest security updates from Microsoft to all affected SharePoint Servers including (Subscription Edition, 2019, and 2016)
• Monitor SharePoint servers for suspicious activity, including unusual requests, web shells, malicious processes, unauthorized access attempts, and machine key theft indicators
• Harden SharePoint Deployments:
  • Enable Antimalware Scan Interface (AMSI) integration for SharePoint web applications
  • Configure AMSI Request Body Scan Mode to Full Mode where operationally feasible
  • Restrict or eliminate direct Internet exposure of SharePoint servers whenever possible
  • Limit access to SharePoint Central Administration and management interfaces
• Monitor for Indicators of Compromise:
  • Organizations should closely monitor SharePoint environments for:
    • Unexpected privilege escalation activity
    • Unauthorized authentication attempts
    • Suspicious IIS machine key access
    • Evidence of deserialization attacks or web shell deployment
    • Microsoft Defender and AMSI detections related to SharePoint exploitation activity

Important note: Microsoft SharePoint Enterprise Server 2016^{Footnote 11} and Server 2019^{Footnote 12} are end of life as of July 14, 2026. Organizations are urged to migrate to a supported version.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topics^{Footnote 13}.

• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.

References

Serial number: AV26-705
Date: July 15, 2026

On July 14, 2026, Tenable published a security advisory to address a critical vulnerability in the following product:

• Nessus Agent – versions 11.2.0 and prior
• Nessus Agent – versions 11.1.3 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• [R1] Tenable Agent Versions 11.2.1 and 11.1.4 Fix a Path Traversal Vulnerability
• Tenable Product Security Advisories

Serial number: AV26-704
Date: July 15, 2026

On July 15, 2026, F5 published a security advisory to address vulnerabilities in the following products:

• NGINX Agent – versions 2.37.0 to 2.46.5
• NGINX Instance Manager – versions 2.17.1 to 2.22.1
• NGINX Plus – versions 37.0.0.1 to 37.0.2.1
• NGINX Plus – versions R33 to R36
• NGINX Open Source – multiple versions
• NGINX Instance Manager – versions 2.17.0 to 2.22.1
• F5 WAF for NGINX – versions 5.9.0 to 5.13.3
• NGINX App Protect WAF – versions 5.2.0 to 5.8.0
• NGINX App Protect WAF – versions 4.11.0 to 4.16.0
• NGINX Gateway Fabric – versions 2.0.0 to 2.6.6
• NGINX Gateway Fabric – versions 1.3.0 to 1.6.2
• NGINX Ingress Controller – multiple versions
• BIG-IP Next SPK – multiple versions
• BIG-IP Next CNF – multiple versions
• BIG-IP Next for Kubernetes – versions 2.0.0 to 2.3.1
• BIG-IP (all modules) – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• K000161837: Out-of-band Security Notification (July 15, 2026)
• MyF5

Serial number: AV26-703
Date: July 15, 2026

On July 14, 2026, Notepad++ published a security advisory to address vulnerabilities in the following product:

• Notepad++ – version prior to 9.7

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Notepad++ v8.9.7 release
• Notepad++ community

Serial number: AV26-702
Date: July 15, 2026

On July 14, 2026, Citrix published security advisories to address vulnerabilities in the following products:

• Citrix Secure Access Client for Windows – versions prior to 26.6.1.20
• Citrix Endpoint Analysis Client for Windows – versions prior to 26.5.1.7

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows Security Bulletin for CVE-2026-53565 and CVE-2026-53566
• Citrix Security Advisories

Serial number: AV26-701
Date: July 14, 2026

On July 14, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop – versions prior to0.7871.124/125 (Windows/Mac), and 150.0.7871.124 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number: AV26-700
Date: July 15, 2026

On July 14, 2026, HPE published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:

• HPE Telco Intelligent Assurance (FAS and PDO) – versions 4.2.15 and prior
• HPE Unified OSS Console (UOC) – versions 3.1.21 and prior
• HPE Unified OSS Console Assurance Monitoring (UOCAM) – versions 3.1.21 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBNW05076 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities
• HPESBNW05080 rev.1 - HPE Unified OSS Console (UOC) and HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities
• HPE Security Bulletin Library

Serial number: AV26-699
Date: July 14, 2026

On July 14, 2026, SonicWall published a security advisory to address critical vulnerabilities in the following products:

• SMA1000 Models (6210, 7210 & 8200v) - version 12.4.3-03245, 12.4.3-03387 and 12.4.3-03434 (platform-hotfix)
• SMA1000 Models (6210, 7210 & 8200v) - version 12.5.0-02283, 12.5.0-02624 and 12.5.0-02800 (platform-hotfix)

SonicWall indicates that CVE-2026-15409 and CVE-2026-15410 are being exploited.

Update 1

On July 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-15409 and CVE-2026-15410 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• SonicWall SMA1000 Series Appliances Affected By Multiple Vulnerabilities
• SonicWall Security Advisories
• CISA KEV: CVE-2026-15409
• CISA KEV: CVE-2026-15410

Serial number: AV26–698
Date: July 14, 2026

On July 14, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:

• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 8.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 9.0 installed on Windows
• Age of Empires II: Definitive Edition Game
• Azure Active Directory
• Azure CycleCloud 8.9.1
• Azure Monitor Agent Metrics Extension
• Azure Open AI
• Azure Spring Apps
• Azure Synapse
• Fabric Data Warehouse
• GitHub Copilot Plugin for JetBrains IDEs
• Microsoft .NET Framework
• Microsoft .NET Framework 3.5
• Microsoft .NET Framework 4.8.1
• Microsoft 365 Apps
• Microsoft 365 Apps for Enterprise
• Microsoft 365 Copilot
• Microsoft 365 Copilot for Android
• Microsoft 365 Copilot for iOS
• Microsoft Bing Search for iOS
• Microsoft Defender for Endpoint for Mac
• Microsoft Dynamics NAV 2018
• Microsoft Edge (Chromium-based)
• Microsoft Entra Provisioning Service
• Microsoft Excel 2016
• Microsoft Exchange Online
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019
• Microsoft Exchange Server Subscription Edition RTM
• Microsoft Malware Protection Engine
• Microsoft Office 2016
• Microsoft Office 2019
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024
• Microsoft Office LTSC for Mac 2021
• Microsoft Office LTSC for Mac 2024
• Microsoft Office for Android
• Microsoft PC Manager
• Microsoft PowerPoint 2016
• Microsoft SQL Server 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022
• Microsoft SQL Server 2025
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Microsoft Surface Go 2
• Microsoft Surface Go 3
• Microsoft Surface Hub
• Microsoft Surface Hub 2S
• Microsoft Surface Hub 3
• Microsoft Surface Laptop Go
• Microsoft Surface Laptop Go 2
• Microsoft Surface Laptop Go 3
• Microsoft Surface Pro 7+
• Microsoft Surface Pro 8
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• Microsoft Word 2016
• AspNet.OData
• AspNetCore.OData
• Minecraft Bedrock Dedicated Server
• Office Online Server
• Power BI Report Server
• Surface Laptop 4 with AMD Processor
• Surface Laptop 4 with Intel Processor
• Surface Windows Dev Kit
• Visual Studio Code
• Windows 10
• Windows 11
• Windows 11 Version
• Windows Admin Center
• Windows Remote Help
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows Subsystem for Linux (WSL2)
• Windows Terminal for Windows 10
• Windows Terminal for Windows 11

Microsoft has indicated that CVE-2026-56164 and CVE-2026-56155 are being exploited.

On July 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-56164 and CVE-2026-56155 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• July 2026 Security Updates
• Security Update Guide
• CISA KEV: CVE-2026-56164
• CISA KEV: CVE-2026-56155

Serial number: AV26–697
Date: July 14, 2026

On July 14, 2026, Adobe published security advisories to address critical vulnerabilities in the following products:

• Adobe After Effects - version 25.6.5 and prior
• Adobe After Effects - version 26.2.1 and prior
• Adobe Animate 2023 - version 23.0.15 and prior
• Adobe Animate 2024 - version 24.0.13 and prior
• Adobe Audition - version 25.6.4 and prior
• Adobe Audition - version 26.0 and prior
• Adobe Bridge - version 15.1.5 (LTS) and prior
• Adobe Bridge - version 16.0.3 and prior
• Adobe Commerce B2B - multiple versions
• Adobe Commerce - multiple versions
• Adobe Commerce Events - version 1.6.0 to 1.20.0
• Adobe Experience Manager (AEM) - version AEM Cloud Service (CS) Release 2026.5.0 and prior
• Adobe Experience Manager (AEM) - version 6.5 LTS Service Pack 1 and prior
• Adobe Experience Manager (AEM) - version 6.5 Service Pack 24 and prior
• Adobe Media Encoder - version 25.6.5 and prior
• Adobe Media Encoder - version 26.2.2 and prior
• Adobe Premiere - version 26.2.2 and prior
• Adobe Premiere Pro - version 25.6.5 and prior
• ColdFusion 2025 Update 10 and earlier versions
• ColdFusion 2023 Update 21 and earlier versions
• ColdFusion 2021 - version 2021.0.0.323925 and prior
• ColdFusion 2023 - version 2023.0.0.330468 and prior
• ColdFusion 2025 - version 2023.0.0.331385 and prior
• Content Credentials Command-Line Tool - version c2patool-v0.17.0 and prior
• Content Credentials JS SDK - version @contentauth/c2pa-web@0.7.0 and prior
• Content Credentials Rust SDK - version c2pa-v0.84.0 and prior
• Creative Cloud Desktop Application - version 6.9.1.1 and prior
• Illustrator 2025 - version 29.8.7 and prior
• Illustrator 2026 - version 30.5 and prior
• Magento Open Source - multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Adobe Security Advisories

Serial number: AV26-696
Date: July 14, 2026

On July 14, 2026, Ivanti published a security advisory to address vulnerabilities in the following product:

• Ivanti Xtraction – version 2026.2 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security Advisory Ivanti Xtraction (CVE-2026-14902, CVE-2026-14903)
• Ivanti Security Advisories

Serial number: AV26-695
Date: July 14, 2026

On July 14, 2026, Fortinet published security advisories to address vulnerabilities in multiple products:

• FortiAuthenticator 6.6 - versions 6.6.0 to 6.6.2
• FortiAuthenticator 6.5 - versions 6.5.0 to 6.5.7
• FortiSandbox 5.0 - versions 5.0.0 to 5.0.2
• FortiSandbox 4.4 - versions 4.4.3 to 4.4.8

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Out of bounds read in GUI
• Unauthenticated VNC access exposed on all interfaces
• Fortinet PSIRT Advisories

Serial number: AV26-694
Date: July 14, 2026

On July 14, 2026, Veeam published a security advisor to address a critical vulnerability in the following product:

• Veeam Software Appliance Updater Component – versions prior to 12.3.0.65

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Veeam Software Appliance - Updater Component Vulnerability
• Veeam Knowledge Base

Serial number: AV26-693
Date: July 14, 2026

On July 13, 2026, ServiceNow published a security advisory to address a critical vulnerability in the following products:

• Brazil - versions prior to Brazil EA and Brazil GA
• Australia - versions prior to Australia Patch 2
• Zurich - versions prior to Zurich Patch 7b and Zurich Patch 9
• Yokohama - versions prior to Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• [Security Advisory] CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform
• ServiceNow security advisories

Serial number: AV26-692
Date: July 14, 2026

On July 14, 2026, Mozilla published a security advisory to address vulnerabilities in the following product. Included was a critical update for the following:

• Firefox – versions prior to 152.0.6

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mozilla Foundation Security Advisory 2026-67
• Mozilla Security Advisories

Serial number: AV26-691
Date: July 14, 2026 

On July 14, 2026, HPE published a security advisory to address vulnerabilities in the following products:

• HPE Compute Scale-up Server 3200 - versions prior to v1.76.44
• HPE Compute Scale-up Server 3250 - versions prior to v1.02.48

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBHF05079 rev.1 - HPE Compute Scale-up Server 3200 and 3250 platforms, Multiple Vulnerabilities
• HPE Security Bulletin Library

Serial number: AV26-690
Date: July 14, 2026

On July 14, 2026, SAP published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:

• SAP Approuter node.js package - versions prior to 20.10.0
• SAP Approuter node.js package - versions prior to 21.2.0
• SAP Change and Transport System Attach Tool (ctsattach) - version CTS_UPLOAD_CLT 1
• SAP Commerce Cloud - versions HY_COM 2205, COM_CLOUD 2211 and 2211-JDK21
• SAP CRM (WebClient UI) - versions S4FND 104, 105 and 106
• SAP Fiori (launchpad) - versions SAP_UI 754, 755, 756, 757, 758 and 816
• SAP Integration Suite (Edge Integration Cell) - versions prior to 8.43.11
• SAP HANA Extended Application Services classic model (User Self Service) - version HDB 2.00
• SAP NetWeaver Application Server ABAP - versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, KERNEL 7.22, 7.53. 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19 and 9.20
• SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) - multiple versions
• SAP NetWeaver Application Server Java (Configuration Wizard) - version ENGINEAPI 7.50
• SAP NetWeaver Application Server Java (Web Container) - version LMCTC 7.50
• SAP NetWeaver AS Java - versions SERVERCORE 7.50, CORE-TOOLS 7.50 and J2EE-APPS 7.50
• SAP NetWeaver Enterprise Portal - version EP-RUNTIME 7.50
• SAProuter on Microsoft Windows - versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, SAP_ROUTER 7.53, 7.54, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.17 and 9.18
• SAP S/4 HANA (Create Single Payment) - versions S4CORE 102, 103, 104, 105, 106, 107, 108 and 109
• SAP S/4HANA (Draft operation) - version S4CORE 108
• SAP S/4HANA Project Management (PPM-PRO) - multiple versions

The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations, and apply the necessary updates.

• SAP Security Patch Day - July 2026

Serial number: AV26-689
Date: July 14, 2026

On July 14, 2026, Siemens published security advisories to address vulnerabilities in the following products. Included were updates for the following products:

• CADRA - versions prior to V2511
• Desigo CC family V7/V8 - all versions
• Desigo CC family V9 - versions prior to V9.0 QU1
• IAM Client - multiple versions and models
• Mendix Runtime - all versions
• Opcenter X - versions prior to V2604
• Palo Alto Networks PAN-OS on RUGGEDCOM APE1808 - all versions
• SIDIS Secured SmartPlug - versions prior to V7.26.0310
• SIMATIC S7-1500 CPU family - versions prior to V3.1.6
• SIMATIC S7-PLCSIM Advanced - all versions
• Simcenter STAR-CCM+ - all versions

The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations and apply the necessary updates.

• Siemens Security Advisories

Serial number: AV26-688
Date: July 13, 2026

Between July 6 and 12, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:

• Red Hat CodeReady Linux Builder – multiple versions and platforms
• Red Hat Enterprise Linux – multiple versions and platforms
• Red Hat Enterprise Linux Server – multiple versions and platforms
• Red Hat Enterprise Linux for Real Time – multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Red Hat Security Advisories

Serial number: AV26–687
Date: July 13, 2026

Between July 6 and 12, 2026, CISA published ICS advisories to address vulnerabilities in the following products:

• Digi International PortServer TS – multiple versions
• Digi One SP IA – multiple versions
• Hydro-Québec Le Circuit Electrique charging station backend – versions prior to June_2026
• Hitachi Energy e-mesh EMS – versions 4.1.6, 4.4.2 and 4.7.0
• Hitachi Energy PROMOD V – versions 1.0.10 and prior
• Labcenter Proteus 9 – version Proteus 9.1_SP4_Build_42914
• OpenPLC v3 – version OpenPLC v3
• Schneider Electric Easergy MiCOM Px40 Series – multiple versions
• Schneider Electric PowerChute Serial Shutdown – versions 1.4 and prior
• Siemens Mendix Studio Pro – multiple versions
• Siemens SINEC OS – version RUGGEDCOM RST2428P (6GK6242-6PA00) – versions prior to 4.0

The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations, and apply the necessary updates if available.

• CISA ICS Advisories

Serial number: AV26-686
Date: July 13, 2026

Between July 6 and 12, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:

• Ubuntu 18.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 24.04 LTS
• Ubuntu 25.10
• Ubuntu 26.04 LTS

The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.

• Ubuntu Security Notices

Serial number: AV26-685
Date: July 13, 2026

Between July 6 and 12, 2026, Dell published security advisories to address vulnerabilities in multiple products:

• Dell Data Lakehouse – versions prior to 1.8.0.1
• Dell Enterprise SONiC Distribution – versions prior to 4.6.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• DSA-2026-291: Security Update for Dell Data Lakehouse Third-Party Component Vulnerabilities
• DSA-2026-290: Security Update for Dell Enterprise SONiC Distribution Vulnerabilities
• Dell Security advisories and notices

Serial number: AV26-684
Date: July 13, 2026

Between July 6 and 12, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• IBM Aspera Enterprise WebApps – versions 1.0.0 to 1.0.3
• IBM Cloud Pak System – versions prior to 2.3.5.0
• IBM Cloud Pak for Data System (CPDS) – versions 1.0.0.0 to 1.0.10.0
• IBM Guardium Data Protection – versions prior to 12.2
• IBM Library Support for Spring – versions 3.2 to 3.2.26 and 3.4 to 3.4.18
• IBM Maximo Application Suite – Monitor Component – versions prior to 9.1 and 9.0
• IBM Operational Decision Manager – multiple versions
• IBM Planning Analytics Local – versions 2.1.0 to 2.1.21
• IBM RDi – version 9.9
• IBM SPSS Modeler – versions prior to 19.0.0.0
• IBM Software Support App (iOS) / (Android) – versions 4.0.1 to 4.1.0
• IBM Storage Protect Snapshot For Windows – versions 8.1.0.0 to 8.2.1.0
• IBM Tivoli Network Manager IP Edition – versions 4.2 GA to 4.2.0.24

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• IBM Product Security Incident Response

Serial number: AV26-683
Date: July 10, 2026

On July 8, 2026, BitWarden published security advisories to address a vulnerability in the following product:

• Bitwarden Server – versions prior to 2026.6.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• BitWarden Server
• BitWarden Home

Number: AL25-007
Date: June 11, 2025
Updated: July 10, 2026

Audience

This Alert is intended for IT professionals and managers of notified organizations.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

On June 1, 2025, Roundcube released a security bulletin for a critical vulnerability affecting Webmail. The issue is described as a Post-Auth RCE via PHP Object Deserialization vulnerability (CVE-2025-49113)^{Footnote 1}. The versions of Roundcube products affected are^{Footnote 2}:

• Webmail – versions prior to 1.5.10
• Webmail – versions prior to 1.6.11

In response to this vulnerability, the Cyber Centre released AV25-309 on June 2, 2025^{Footnote 3}.

While the Cyber Centre has not received any reports of exploitation, the existence of a proof of concept (POC) significantly raises the likeness of abuse by malicious actors. The existence of a published POC makes it imperative to take action to assess and mitigate this vulnerability.

The Cyber Centre is aware that exploitation of CVE-2024-42009 has been used to obtain valid credentials, which could lead to exploitation of CVE-2025-49113. CISA added CVE-2024-42009 to their Known Exploited Vulnerabilities (KEV) catalog^{Footnote 4Footnote 5}on June 9, 2025.

Update 1

The Cyber Centre is aware of open-source reporting indicating ongoing exploitation^{Footnote 7} of CVE-2024-42009^{Footnote 8} and CVE-2025-49113^{Footnote 1} related to Roundcube Webmail.

The Cyber Centre strongly recommends that organizations upgrade to the latest Roundcube Webmail versions as per AV26-657^{Footnote 9}:

• Webmail – version 1.6.17
• Webmail – version 1.7.2

On June 9, 2025, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-42009 to their Known Exploited Vulnerabilities (KEV) Database^{Footnote 10}.

Also, on February 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-49113 to their Known Exploited Vulnerabilities (KEV) Database^{Footnote 11}.

End of Update 1

Suggested actions

The Cyber Centre strongly recommends that organizations update to Roundcube Webmail versions 1.5.10+ or 1.6.11+^{Footnote 2}, which would mitigate issues reported by both CVEs mentioned here (CVE-2024-42009 and CVE-2025-49113).

The Cyber Centre recommends that organizations:

• Assess the installation of Roundcube Webmail.
• Apply updates to Roundcube Webmail without delay.
• Monitor affected systems for signs of exploitation.
• Monitor for brute-force attempts and if possible, implement rate limitation techniques.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions^{Footnote 6} with an emphasis on the following strategies:

If activity matching the content of this alert is discovered, recipients are encouraged to report via the My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial number: AV26-682
Date: July 10, 2026

On July 9, 2026, Microsoft published a security update to address vulnerabilities in the following product:

• Microsoft Edge Stable Channel – versions prior to 150.0.4078.65

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• Microsoft Edge Stable Channel Release Notes

Serial number: AV26-681
Date: July 10, 2026

Between July 8 and 10, 2026, Broadcom published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• Open Source RabbitMQ - multiple versions
• VMware Tanzu Greenplum Command Center - multiple versions
• VMware Tanzu Greenplum Data Copy Utility - versions prior to 2.9.5
• VMware Tanzu Greenplum on Kubernetes - versions prior to 1.1.2
• VMware Tanzu Greenplum MCP Server - version prior to 1.0.2
• VMware Tanzu Greenplum Streaming Server - multiple versions
• VMware Tanzu Greenplum Text - versions prior to 4.0.2
• VMware Tanzu RabbitMQ - multiple versions
• VMware Tanzu RabbitMQ on Kubernetes - multiple versions
• VMware Tanzu RabbitMQ on Tanzu Platform - multiple versions

The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.

 

• Security Advisories - VMware Cloud Foundation

Serial number: AV26-084
Date: February 4, 2026
Updated: July 9, 2026

On February 3, 2026, Django published a security advisory to address vulnerabilities in the following products:

• Django 4.2 – versions prior to 4.2.28
• Django 5.2 – versions prior to 5.2.11
• Django 6.0 – versions prior to 6.0.2

Update 1

Open-source reporting indicates that CVE-2026-1207 is being exploited.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Django Security Advisory

Serial number: AV26-680
Date: July 9, 2026

On July 9, 2026, FreePBX published security advisories to address vulnerabilities in the following products:

• FreePBX API (FreePBX 17) – versions prior to 17.0.9
• FreePBX Backup (FreePBX 17) – versions prior to 17.0.11

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• Authenticated API generatedocs Host Command Injection
• Authenticated Arbitrary SSH Key Injection via Backup Module
• FreePBX Security Advisories

Serial number: AV26-679
Date: July 9, 2026

On July 8, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop – versions prior to 150.0.7871.114/115 (Windows/Mac), and 150.0.7871.114 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number: AV26-678
Date: July 8, 2026

On July 8, 2026, Progress published security advisories to address vulnerabilities in the following product:

• MOVEit Transfer – version 2024.1.8 and prior
• MOVEit Transfer – version 2025.0.0 to 2025.0.7
• MOVEit Transfer – version 2025.1.0 to 2025.1.3
• MOVEit Transfer – version 2026.0.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• MOVEit Transfer Critical Security Bulletin – June 2026 – (CVE-2026-10699, CVE-2026-10698, CVE-2026-11903)
• Progress Trust Center

Serial number: AV26-677
Date: July 8, 2026

On July 8, 2026, GitLab published a security advisory to address vulnerabilities in the following products:

• GitLab Community Edition (CE) – versions prior to 19.1.2, 19.0.4 and 18.11.7
• GitLab Enterprise Edition (EE) – versions prior to 19.1.2, 19.0.4 and 18.11.7

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• GitLab Patch Release: 19.1.2, 19.0.4, 18.11.7
• GitLab Releases

Serial number: AV26-676
Date: July 8, 2026

On July 8, 2026, Drupal published security updates for multiple products. Included was a critical update for the following:

• Location Selector – versions prior to 1.3.0

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.

• Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
• Drupal Security Advisories

Serial number: AV26-675
Date: July 8, 2026

On July 8, 2026, Juniper Networks published security advisories to address vulnerabilities in the following products:

• Juniper cRPD – all versions
• Juniper CTPView – all versions
• Juniper Network Director – versions prior to 7.1R3
• Junos OS – multiple versions
• Junos OS Evolved – all versions
• Junos OS on MX Series with SPC3 and SRX Series – multiple versions
• Junos Space – all versions

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• 2026-07 Security Bulletin: CTPView: Multiple vulnerabilities resolved in 9.3R2-3 Release
• 2026-07 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 26.1R1 Patch V1 Release
• 2026-07 Security Bulletin: Junos OS Evolved: URL handling vulnerability in libfetch results in heap buffer overflow (CVE-2020-7450)
• 2026-07 Security Bulletin: Junos OS and Junos OS Evolved: Receipt of a specific SNMPv3 request results in memory leak and eventual snmpd crash (CVE-2026-33799)
• Juniper Support Portal

Serial number: AV26-674
Date: July 8, 2026

On July 8, 2026, Palo Alto Networks published security advisories to address vulnerabilities in the following products:

• PAN-OS 12.1 – versions prior to 12.1.4-h8
• PAN-OS 12.1 – versions prior to 12.1.7-h2
• PAN-OS 12.1 – versions prior to 12.1.8
• PAN-OS 11.2 – versions prior to 11.2.4-h20
• PAN-OS 11.2 – versions prior to 11.2.7-h18
• PAN-OS 11.2 – versions prior to 11.2.10-h12
• PAN-OS 11.2 – versions prior to 11.2.13
• PAN-OS 11.1 – versions prior to 11.1.4-h35
• PAN-OS 11.1 – versions prior to 11.1.6-h35
• PAN-OS 11.1 – versions prior to 11.1.7.h8
• PAN-OS 11.1 – versions prior to 11.1.10-h30
• PAN-OS 11.1 – versions prior to 11.1.13-h9
• PAN-OS 11.1 – versions prior to 11.1.16
• PAN-OS 10.2 – versions prior to 10.2.7-h36
• PAN-OS 10.2 – versions prior to 10.2.10-h39
• PAN-OS 10.2 – versions prior to 10.2.13-h23
• PAN-OS 10.2 – versions prior to 10.2.16-h9
• PAN-OS 10.2 – versions prior to 10.2.18-h8
• Prisma Access 11.20.0 – versions prior to 11.2.7-h18
• Prisma Access 10.2.0 – versions prior to 10.2.10-h39
• Prisma Browser – versions prior to 149.10.3.53

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations, and apply the necessary updates.

• PAN-SA-2026-0010 Chromium: Monthly Vulnerability Update (July 2026)
• CVE-2026-0288 PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
• Palo Alto Network Security Advisories

Serial number: AV26-673
Date: July 8, 2026

On July 7, 2026, Tanium published a security advisory to address a vulnerability in the following products:

• Tanium Server 2025H1 Release – versions prior to Update MR21 (v7.7.3.8298)
• Tanium Server 2025H2 Release – versions prior to Update MR11 (v7.8.2.1198)
• Tanium Server 2026H1 Release – versions prior to Update MR3 (v7.8.4.1327)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Tanium Security Advisories - TAN-2026-016
• Tanium Security Advisories

Serial number: AV26-672
Date: July 8, 2026

On July 8, 2026, n8n published security advisories to address vulnerabilities in the following product:

• n8n – versions prior to 1.123.64
• n8n – versions prior to 2.30.1
• n8n – versions prior to 2.29.8

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• n8n Security

Serial number: AV26-671
Date: July 8, 2026

On July 2, 2026, Ubiquiti published a security advisory to address critical vulnerabilities in the following products:

• EF-Core – version 5.1.18 and prior
• EFG – version 5.1.15 and prior
• ENVR – version 5.1.15 and prior
• ENVR-Core – version 5.1.15 and prior
• Express 7 – version 5.1.15 and prior
• UCG-Fiber – version 5.1.15 and prior
• UCG-Industrial – version 5.1.15 and prior
• UCG-Max – version 5.1.15 and prior
• UCG-Ultra – version 5.1.15 and prior
• UCK – version 5.1.15 and prior
• UCK-Enterprise – version 5.1.15 and prior
• UCKP – version 5.1.15 and prior
• UDM – version 5.1.15 and prior
• UDM-Beast – version 5.1.15 and prior
• UDM-Pro – version 5.1.15 and prior
• UDM-Pro – version 5.1.15 and prior
• UDM-Pro-Max – version 5.1.15 and prior
• UDM-SE – version 5.1.15 and prior
• UDR – version 5.1.15 and prior
• UDR-5G – version 5.1.15 and prior
• UDR7 – version 5.1.15 and prior
• UDW – version 5.1.15 and prior
• UNAS-2 – version 5.1.16 and prior
• UNAS-4 – version 5.1.16 and prior
• UNAS-Pro – version 5.1.16 and prior
• UNAS-Pro-4 – version 5.1.16 and prior
• UNAS-Pro-8 – version 5.1.16 and prior
• UniFi Access Application – version 4.2.28 and prior
• UniFi Network Application – version 10.3.58 and prior
• UniFi OS Server – version 5.1.15 and prior
• UniFi Protect Application – version 7.1.77 and prior
• UniFi Protect Floodlight – version 1.13.4 and prior
• UniFi Talk Application – version 5.1.2 and prior
• UNVR – version 5.1.15 and prior
• UNVR-G2 – version 5.1.15 and prior
• UNVR-G2-Pro – version 5.1.15 and prior
• UNVR-Instant – version 5.1.15 and prior
• UNVR-Pro – version 5.1.15 and prior

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Ubiquiti UniFi - Security Advisory Bulletin 066

Serial number: AV26-670
Date: July 8, 2026

On July 7, 2026, Langflow updated a security advisory to address vulnerabilities in the following product:

• Langflow – versions prior to 1.9.1

On July 7, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-55255 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.

• CVE-2026-55255: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
• CISA KEV: CVE-2026-55255

Serial number: AV26–647
Date: July 2, 2026
Updated: July 7, 2026

On June 30, 2026, Adobe published security advisories to address critical vulnerabilities in the following products:

• Adobe ColdFusion 2025 – Update 9 and prior
• Adobe ColdFusion 2023 – Update 20 and prior
• Adobe Campaign Classic – version ACC v7: 7.4.3 build 9396 and prior

Update 1

Open-source reporting indicates that CVE-2026-48282 is being exploited.

Update 2

On July 7, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48282 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Security update available for Adobe ColdFusion | APSB26-68
• Security updates available for Adobe Campaign Classic | APSB26-69
• Adobe Security Advisories
• CISA KEV: CVE-2026-48282

Serial number: AV26-669
Date: July 7, 2026

On July 7, 2026, Google published a security advisory to address vulnerabilities in the following product:

• Stable Channel Chrome for Desktop – versions prior to0.7871.100/101 (Windows/Mac), and 150.0.7871.100 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.

• Google Chrome Security Advisory

Serial number: AV26-668
Date: July 7, 2026

On July 7, 2026, HPE published security advisories to address vulnerabilities in multiple products. Included were updates for the following:

• HPE Aruba Networking Private 5G Core – 1.26.1.0 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• HPESBNW05077 rev.1 - HPE Networking Private 5G Core, Multiple vulnerabilities
• HPE Security Bulletin Library

Serial number: AV26-667
Date: July 7, 2026

On July 7, 2026, Zimbra published a security advisory to address vulnerabilities in the following product:

• Zimbra Collaboration Suite (ZCS) Classic Web Client – versions prior to v10.1.19

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Patch Release Update: Zimbra 10.1.19
• Zimbra Patch Release Updates

Serial number: AV26-666
Date: July 7, 2026

On July 7, 2026, Django published a security advisory to address vulnerabilities in the following products:

• Django 5.2 – versions prior to 5.2.16
• Django 6.0 – versions prior to 6.0.7

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Django Security Advisory

Serial number: AV26-665
Date: July 7, 2026

On July 7, 2026, Samsung published a security update to address vulnerabilities in the following product:

• Samsung mobile devices – versions prior to SMR-JUL-2026 Release 1

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• Samsung Security Updates

Serial number: AV26-664
Date: July 7, 2026

On July 6, 2026, ABB published a security advisory to address vulnerabilities in the following product:

• ABB Ability zenon – all versions
• APROL – versions prior to R 4.4-01P5

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• ABB Ability zenon Remote Transport Vulnerability (PDF)
• Security Issues addressed in APROL R 4.4-01P5 (PDF)
• ABB Cyber security alerts and notifications

Serial number: AV26-633
Date: July 7, 2026

On July 6, 2026, Broadcom published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• VMware Tanzu for MySQL on Kubernetes – versions prior to 2.0.4

The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.

• Product Release Advisory - VMware Tanzu for MySQL on Kubernetes 2.0.4
• Security Advisories - VMware Cloud Foundation

Serial number: AV26-662
Date: July 7, 2026

On July 6, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Android Security Bulletin — July 2026