Serial number: AV26-517
Date: May 27, 2026
On May 27, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-516
Date: May 27, 2026
On May 27, 2026, GitLab published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-515
Date: May 27, 2026
On May 27, 2026, Jenkins published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-514
Date: May 27, 2026
On May 27, 2026, Phoenix Contact published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, once available.
Serial number: AV26-513
Date: May 27, 2026
On May 27, 2026, Veeam published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-456
Date: May 12, 2026
Updated: May 27, 2026
On May 12, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
On May 21, 2026, Microsoft published an out-of-band (OOB) security update to address CVE-2026-45659, an additional vulnerability impacting Microsoft SharePoint Enterprise Server 2019, Microsoft SharePoint Server 2016 and Microsoft SharePoint Server Subscription Edition. The CVE was inadvertently omitted from the May 2026 Security Updates.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-512
Date: May 27, 2026
On May 26, 2026, GitHub published security advisories to address vulnerabilities in the following products:
GitHub has stated that future patches and releases will be signed with a new public key, and customers will need to rotate to the new key before those patches and releases can be installed.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-511
Date: May 27, 2026
On May 26, 2026, Hitachi published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-510
Date: May 26, 2026
On May 26, 2026, ABB published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-509
Date: May 26, 2026
On May 26, 2026, Moxa published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-508
Date: May 25, 2026
On May 22, 2026, cPanel published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-507
Date: May 25, 2026
Between May 18 and 24, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–506
Date: May 25, 2026
[Control systems] CISA ICS security advisories (AV26–506)
Between May 18 and 24, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-505
Date: May 25, 2026
Between May 18 and 24, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.
Serial number: AV26-504
Date: May 25, 2026
Between May 18 and 24, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-503
Date: May 25, 2026
On May 24, 2026, Roundcube published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-502
Date: May 25, 2026
Between May 18 and 24, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-492
Date: May 20, 2026
Updated: May 22, 2026
On May 20, 2026, Drupal published a security advisory to address a critical vulnerability in the following product:
Drupal has indicated that exploit attempts for CVE-2026-9082 are now being detected in the wild.
On May 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9082 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.
Serial number: AV26-501
Date: May 22, 2026
On May 22, 2026, F5 published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-500
Date: May 22, 2026
On May 22, 2026, HPE published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-499
Date: May 22, 2026
On May 21, 2026, cPanel published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-498
Date: May 22, 2026
On May 21, 2026, Ubiquiti published a security advisory to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-497
Date: May 22, 2026
On May 21, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-494
Date: May 21, 2026
On May 21, 2026, Trend Micro published a security advisory to address vulnerabilities in the following products:
On May 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-34926 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-496
Date: May 21, 2026
On May 21, 2026, ConnectWise published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-495
Date: May 21, 2026
On May 20, 2026, FreeBSD published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-493
Date: May 20, 2026
On May 20, 2026, Splunk published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-491
Date: May 20, 2026
On May 20, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-490
Date: May 20, 2026
On May 20, 2026, ISC published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-489
Date: May 20, 2026
On May 18 and 19, 2026, Microsoft published security advisories to address vulnerabilities, including some critical ones, in the following products:
On May 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41091 and CVE-2026-45498 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Serial number: AV26-488
Date: May 20, 2026
On May 19, 2026, cPanel published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-487
Date: May 20, 2026
On May 19, 2026, HPE published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-486
Date: May 20, 2026
On May 19, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-485
Date: May 20, 2026
On May 19, 2026, F5 published a security advisory to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-484
Date: May 20, 2026
On May 19, 2026, FreePBX published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.
Serial number: AV26-483
Date: May 19, 2026
On May 19, 2026, Atlassian published a security advisory to address vulnerabilities, including some critical ones, in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-482
Date: May 19, 2026
Between May 11 and 17, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-481
Date: May 19, 2026
Between May 11 and 17, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-480
Date: May 19, 2026
Between May 11 and 17, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-479
Date: May 19, 2026
Between May 11 and 17, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-478
Date: May 19, 2026
On May 19, 2026, Mozilla published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-477
Date: May 19, 2026
HPE security advisory (AV26-477) On May 18, 2026, HPE published a security advisory to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-476
Date: May 19, 2026
On May 15, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-475
Date: May 19, 2026
Between May 11 and 17, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26–474
Date: May 15, 2026
On May 15, 2026, FreePBX published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.
Serial number: AV26-473
Date: May 15, 2026
On May 14, 2026, Microsoft published a security advisory to address a critical vulnerability in the following products:
Microsoft is aware of limited exploitation of CVE-2026-42897.
On May 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42897 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Number: AL26-012
Date: May 15, 2026
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation1Footnote 2 of Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) devices Footnote 3. In response to the Cisco security advisory released on May 14, 2026Footnote 4, the Cyber Centre issued AV26-471Footnote 5 on May 14, 2026.
Tracked as CVE-2026-20182 Footnote 6, this vulnerability is a critical Improper authentication vulnerability (CWE-287)Footnote 7 affecting the peering authentication process of Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). It could allow an unauthenticated, remote attacker to bypass authentication, elevate privileges, and obtain administrative privileges on affected systems.
Cisco Catalyst SD-WAN Controller systems accessible from the internet, particularly those with exposed network ports, are at risk of exposure to compromise.
This vulnerability affects Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, regardless of device configuration. The vulnerability affects all deployment types, including:
The Cyber Centre is aware of incidents involving CVE-2026-20182; with reported attempts of SSH keys being added, NETCONF configurations being modified and escalation to root privileges. This allowed multiple follow-up actions including administrative access, persistence and long-term access to SD-WAN networks.
Cisco has also noted the continued exploitation of Cisco Catalyst SD-WAN vulnerabilities CVE-2026-20133, CVE-2026-20128 and CVE-2026-20122 previously reported in February 2026 Footnote 8. The Cyber Centre released AL26-004 Footnote 9 at that time highlighting the issue.
The Cyber Centre recommends that organizations upgrade affected Cisco Catalyst SD-WAN instances to a fixed version:
| Affected product | Affected version | Solution |
|---|---|---|
| Cisco Catalyst SD-WAN | Earlier than 20.9* | Migrate to a fixed release. |
| Cisco Catalyst SD-WAN | 20.9 | 20.9.9.1 |
| Cisco Catalyst SD-WAN | 20.10 | 20.12.7.1 |
| Cisco Catalyst SD-WAN | 20.11* | 20.12.7.1 |
| Cisco Catalyst SD-WAN | 20.12 | 20.12.5.4 20.12.6.2 20.12.7.1 |
| Cisco Catalyst SD-WAN | 20.13* | 20.15.5.2 |
| Cisco Catalyst SD-WAN | 20.14* | 20.15.5.2 |
| Cisco Catalyst SD-WAN | 20.15 | 20.15.4.4 20.15.5.2 |
| Cisco Catalyst SD-WAN | 20.16* | 20.18.2.2 |
| Cisco Catalyst SD-WAN | 20.18* | 20.18.2.2 |
| Cisco Catalyst SD-WAN | 26.1 | 26.1.1.1 |
Cisco has also addressed this vulnerability in Cisco SD-WAN Cloud (Cisco Managed) Release 20.15.506, which is cloud based. No user action is required. Customers can determine the current remediation status or software version by using the Help function in the service GUIFootnote 4.
The Cyber Centre also recommends organizations to:
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote 12.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.
Serial number: AV26-472
Date: May 14, 2026
On May 14, 2026, Tenable published a security advisory to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-471
Date: May 14, 2026
On May 14, 2026, Cisco published security advisories to address critical vulnerabilities in the following products:
Cisco is aware of limited exploitation of CVE-2026-20182.
On May 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20182 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-470
Date: May 14, 2026
On May 14, 2026, PostgreSQL published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.