Serial number: AV26-387
Date: April 23, 2026
On April 23, 2026, Tenable published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-386
Date: April 23, 2026
On April 23, 2026, Spring published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Number: AL25-012
Date: September 25, 2025
Updated: April 23, 2026
This Alert is intended for IT professionals and managers of notified organizations.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
The Canadian Centre for Cyber Security (Cyber Centre) is aware of exploitation targeting Cisco Adaptive Security Appliance (ASA) 5500-X Series devices that are running Cisco Secure Firewall ASA Software with VPN web services enabled.
On September 25, 2025, Cisco published security advisories for critical vulnerabilities, CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363, affecting the following ASA and Cisco Secure Firewall Threat Defense (FTD) software release products:
For further details on affected versions and available fixed releases, please refer to the following Cisco advisoriesFootnote 1Footnote 2Footnote 3.
CVE-2025-20333 is a vulnerability affecting the ASA and FTD software, that could allow an authenticated remote threat actor to execute arbitrary code on affected devicesFootnote 1.
CVE-2025-20362 is a vulnerability affecting the ASA and FTD software, that could allow an unauthenticated remote threat actor to access URL endpoints that should otherwise be inaccessible without authenticationFootnote 2.
CVE-2025-20363 is a vulnerability affecting the ASA, FTD, Cisco IOS, Cisco IOS XE and Cisco IOS XR software, that could allow an unauthenticated remote threat actor (ASA and FTD) or authenticated remote one (Cisco IOS, IOS XE and IOS XR) with low user privileges to execute arbitrary code on affected devicesFootnote 3.
All these vulnerabilities are due to improper validation of user supplied input in HTTP(S) requests.
In response to these vulnerabilities, the Cyber Centre released AV25-619 on September 25Footnote 4.
On April 23, 2026, Cisco Talos released a blog post Footnote 8 and Cisco published a security advisory Footnote 9 identifying a previously unknown persistence method that remains intact even after upgrading to a patched version released in September 2025. The persistence mechanism is embedded in the Cisco Firepower eXtensible Operating System (FXOS) Software base operating system for Cisco Secure Firewall ASA Software and Cisco Secure FTD Software installations on the affected hardware.
The Cybersecurity and Infrastructure Security Agency (CISA) created the Emergency Directive document V1: ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices Footnote 10 and along with the United Kingdom National Cyber Security Centre (NCSC), published a FIRESTARTER Backdoor Malware Analysis Report Footnote 11 on April 23, 2026.
The Cyber Centre recommends organizations review the Cisco advisory, identify if indicators of compromise are present on their devices, and apply the identified workarounds, including reimaging the device to a known fixed version.
Affected products and versions:
Secure Firewall ASA Software
Secure FTD Software
Firepower 4100 and 9300 Security Appliance
End of Update 1
The Cyber Centre strongly recommends that organizations running Cisco ASA and FTD products upgrading to a fixed release software versionFootnote 5.
Organizations upgrading an ASA 5500-X Series model to 9.12.4.72 or 9.14.4.28 should refer to Cisco’s Bootloader and/or ROMMON Verification Failure proceduresFootnote 6. If the “firmware-update.log” file is found on “disk0:” after upgrading to a fixed release, organizations are encouraged to preserve the log file and notify the Cyber Centre using the contact information below. Instructions regarding transfer of the log file will be provided as part of the follow-up engagement.
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security ActionsFootnote 7.
If activity matching the content of this alert is discovered, recipients are encouraged to report via the My Cyber Portal, or email contact@cyber.gc.ca.
Serial number: AV26-384
Date: April 23, 2026
CrowdStrike security advisory (AV26-384)
On April 21, 2026, CrowdStrike published a security advisory to address a critical vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-383
Date: April 23, 2026
On April 21, 2026, GitHub published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-382
Date: April 23, 2026
On April 22, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-352
Date: April 14, 2026
Updated: April 22, 2026
On April 14, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
Microsoft has received reports that CVE-2026-32201 has been exploited.
On April 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-32201 to their Known Exploited Vulnerabilities (KEV) Database.
Open-source reporting indicates that the CVE-2026-33825 vulnerability is being exploited in the wild.
On April 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-381
Date: April 22, 2026
On April 22, 2026, Apple published security updates to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-380
Date: April 22, 2026
On April 21, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-379
Date: April 22, 2026
On April 22, 2026, n8n published security advisories to address vulnerabilities, including some critical ones, in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Number: AV26-378
Date: April 22, 2026
On April 22, 2026, Phoenix Contact published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, once available.
Serial number: AV26-377
Date: April 22, 2026
On April 21, 2026, Microsoft published an out-of-band (OOB) security update to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary update.
Serial number: AV26-376
Date: April 22, 2026
On April 22, 2026, GitLab published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-375
Date: April 21, 2026
On April 21, 2026, Atlassian published a security advisory to address vulnerabilities, including some critical ones, in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-374
Date: April 21, 2026
On April 21, 2026, Fortra published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-373
Date: April 21, 2026
Between April 9 and 21, 2026, Spring published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-372
Date: April 21, 2026
On April 21, 2026, Mozilla published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-166
Date: February 25, 2026
Updated: April 20, 2026
On February 25, 2026, Cisco published security advisories to address critical vulnerabilities in the following products:
Cisco has indicated that CVE-2026-20127 has been exploited.
On February 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20127 to their Known Exploited Vulnerabilities (KEV) Database.
Cisco has indicated that CVE-2026-20128 and CVE-2026-20122 are being actively exploited.
On April 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20122, CVE-2026-20128, and CVE-2026-20133 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.
Serial number: AV26-366
Date: April 20, 2026
Between April 13 and 19, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-371
Date: April 20, 2026
On April 20, 2026, Progress published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-370
Date: April 20, 2026
On April 20, 2026, Moxa published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-369
Date: April 20, 2026
Between April 13 and 19, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-368
Date: April 20, 2026
Between April 13 and 19, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.
Serial number: AV26-367
Date: April 20, 2026
Between April 13 and 19, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.
Serial number: AV26-365
Date: April 20, 2026
Between April 13 and 19, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-364
Date: April 17, 2026
On April 17, 2026, JetBrains published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-363
Date: April 17, 2026
On April 16, 2026, HashiCorp published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-362
Date: April 17, 2026
On April 16, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-330
Date: April 8, 2026
Update: April 16, 2026
On April 8, 2026, Apache published a security advisory to address a vulnerability in the following products:
On April 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-34197 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-361
Date: April 16, 2026
On April 16, 2026, HPE published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-360
Date: April 16, 2026
On April 10, 2026, Nginx UI published a security advisory to address a critical vulnerability in the following product:
Open-source reporting indicates that the CVE-2026-33032 vulnerability is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Serial number: AV26-359
Date: April 16, 2026
On April 15, 2026, Drupal published a security advisory to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.
Serial number: AV26-358
Date: April 15, 2026
On April 15, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-357
Date: April 15, 2026
On April 15, 2026, Cisco published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.
Serial number: AV26-356
Date: April 15, 2026
On April 15, 2026, Splunk published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-355
Date: April 15, 2026
On April 14, 2026, AMD published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-354
Date: April 14, 2026
On April 14, 2026, Tenable published a security advisory to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-353
Date: April 14, 2026
On April 14, 2026, Adobe published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-351
Date: April 14, 2026
On April 14, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-350
Date: April 14, 2026
On April 14, 2026, Schneider Electric published advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-349
Date: April 14, 2026
On April 14, 2026, SAP published security advisories to address vulnerabilities in multiple products. Included were updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations, and apply the necessary updates.
Serial number: AV26-348
Date: April 14, 2026
On April 7, 2026, Samsung published a security update to address vulnerabilities in the following product:
The most recent security update resolves multiple identified vulnerabilities.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-347
Date: April 14, 2026
On April 14, 2026, Siemens published a security advisory to address vulnerabilities in the following products. Included were updates for the following products:
The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations and apply the necessary updates.
Serial number: AV26-346
Date: April 13, 2026
On April 13, 2026, ABB published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-345
Date: April 13, 2026
On April 10, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-340
Date: April 13, 2026
On April 12, 2026, Adobe published a security advisory to address a critical vulnerability in the following products:
Adobe is aware of CVE-2026-34621 being exploited in the wild.
On April 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-34621 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-096
Date: February 9, 2026
Updated: April 13, 2026
On February 6, 2026, Fortinet published a security advisory to address a critical vulnerability in the following product:
Open-source reporting indicates that CVE-2026-21643 is being exploited in the wild.
On April 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21643 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-336
Date: April 9, 2026
Updated: April 13, 2026
On April 9, 2026, Tenable published a security advisory to address vulnerabilities in the following product:
Update 1
On April 13, 2026, Tenable updated affected products reflected above.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-344
Date: April 13, 2026
On April 9, 2026, wolfSSL published a security advisory to address vulnerabilities in the following product:
CVE-2026-5194 is listed as critical with a CVSS score of 9.3.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-343
Date: April 13, 2026
Between April 6 and 12, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.