Serial Number: AV26-844
Date: August 24, 2026
As of August 20, 2026, Google is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial number: AV26-042
Date: January 21, 2026
Updated: August 24, 2026
On January 20, 2026, Oracle published a security advisory to address vulnerabilities in multiple products.
On January 21, 2026, a proof of concept (PoC) for the vulnerability CVE-2026-21962 became publicly available.
CVE-2026-21962 is a vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware which may allow a remote attacker to obtain unauthorized access.
On August 24, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21962 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial Number: AV26-843
Date: August 24, 2026
As of August 17, 2026, Dell is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-827
Date: August 18, 2026
Updated: August 21, 2026
As of August 17, 2026, GitLab is affected by vulnerabilities in the following product:
Open-source reporting indicates that CVE-2026-19478 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-842
Date: August 21, 2026
As of August 20, 2026, Spring is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-841
Date: August 21, 2026
As of August 18, 2026, Malcolm is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-816
Date: August 14, 2026
Updated: August 21, 2026
As of August 13, 2026, Zimbra is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
On August 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-73570 to their Known Exploited Vulnerabilities (KEV) Database.
Serial Number: AV26-840
Date: August 21, 2026
As of August 18, 2026, Mozilla is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-839
Date: August 21, 2026
As of August 18, 2026, Apple is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-838
Date: August 21, 2026
As of August 19, 2026, Splunk is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-837
Date: August 19, 2026
As of August 13, 2026, Johnson Controls is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-836
Date: August 20, 2026
As of August 20, 2026, n8n is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-835
Date: August 20, 2026
As of August 19, 2026, TrueConf is affected by a vulnerability in the following product:
On August 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72529 and CVE-2026-72530 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-834
Date: August 20, 2026
As of August 19, 2026, Cisco is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-833
Date: August 19, 2026
As of August 19, 2026, Citrix is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-832
Date: August 19, 2026
As of August 17, 2026, MLflow is affected by vulnerabilities in the following product:
On August 19, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-64849 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-831
Date: August 19, 2026
As of August 18, 2026, Oracle Corporation is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-830
Date: August 19, 2026
As of August 18, 2026, NVIDIA is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-829
Date: August 19, 2026
As of August 18, 2026, Atlassian is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-823
Date: August 17, 2026
Updated: August 18, 2026
As of August 6, 2026, Apple is affected by vulnerabilities in the following products:
Open-source reporting indicates that CVE-2026-65400 is being exploited in the wild.
On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-65400 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-763
Date: July 30, 2026
Updated: August 18, 2026
As of July 30, 2026, VMware is affected by vulnerabilities in the following products:
On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-59310 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-804
Date: August 11, 2026
Updated: August 18, 2026
As of August 11, 2026, Microsoft is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the web link provided, perform the suggested mitigations, and apply the necessary updates.
On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33824 and CVE-2026-55040 to their Known Exploited Vulnerabilities (KEV) Database.
Serial Number: AV26-828
Date: August 18, 2026
As of August 17, 2026, Mattermost is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-826
Date: August 18, 2026
As of August 17, 2026, BeyondTrust is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-825
Date: August 18, 2026
As of August 17, 2026, JetBrains is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial number: AV26-824
Date: August 17, 2026
As of August 17, 2026, Progress is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-798
Date: August 11, 2026
Updated: August 17, 2026
As of August 11, 2026, SAP is affected by vulnerabilities in the following products:
Open-source reporting indicates that CVE-2026-58231 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-645
Date: June 30, 2026
Updated: August 17, 2026
On June 30, 2026, Citrix published a security advisory to address critical vulnerabilities in the following products:
Open-source reporting indicates that CVE-2026-8451 is being exploited.
Open-source reporting indicates that CVE-2026-8452 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial Number: AV26-822
Date: August 17, 2026
As of August 14, 2026, Microsoft is affected by a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-821
Date: August 17, 2026
As of August 14, 2026, Dell is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-820
Date: August 17, 2026
As of August 14, 2026, Tenable, Inc. is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-819
Date: August 17, 2026
As of August 14, 2026, IBM is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-818
Date: August 14, 2026
As of August 13, 2026, FreePBX is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-817
Date: August 14, 2026
As of August 13, 2026, HashiCorp is affected by a vulnerability in the following product
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-815
Date: August 13, 2026
As of August 12, 2026, WebPros is affected by a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-814
Date: August 13, 2026
As of August 12, 2026, GitLab is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-813
Date: August 13, 2026
As of August 11, 2026, AMD is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Number: AL26-018
Date: August 13, 2026
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.
The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitationFootnote 1 of a high-severity vulnerability affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) SoftwareFootnote 2. Cisco disclosed this vulnerability on August 11, 2026, and has confirmed active exploitation in the wild.
In response to the Cisco security advisory released on August 11, 2026, the Cyber Centre issued AV26-807Footnote 3 on August 12, 2026.
Tracked as CVE-2026-20349Footnote 4, this vulnerability is an Improper Clearing of Heap Memory Before Release ('Heap Inspection') (CWE-244)Footnote 5 vulnerability that may allow a remote attacker to cause a denial-of-service (DoS) condition. The vulnerability is caused by insufficient error checking when processing HTTP requests. An unauthenticated remote attacker could exploit the issue by sending a specially crafted HTTP request to an affected SSL VPN service. Successful exploitation could cause the firewall to reload unexpectedly, resulting in a denial of service (DoS) condition.
Cisco Secure Firewall ASA and Secure Firewall Threat Defense SSL VPN Services that are accessible from the internet, particularly those with the vulnerable SSL VPN-Related services enabled, are at risk of being impacted.
This vulnerability affects Cisco devices if they are running affected ASA or FTD software releases and have one or more of the following features enabled, which expose SSL listen sockets:
Cisco has confirmed that Cisco Secure Firewall Management Center (FMC) Software is not affected by this vulnerability.
The Cyber Centre recommends that organizations:
Upgrade affected Cisco ASA instances to a fixed version:
| Affected product | Affected versions | Fixed versions |
|---|---|---|
| Cisco ASA | 9.16.x | 89.16.4.50 |
| Cisco ASA | 9.18.x | 89.18.4.50 |
| Cisco ASA | 9.20.x | 9.20.4.235 |
| Cisco ASA | 9.22.x | 9.22.3.191 |
| Cisco ASA | 9.23.x | 9.23.1.211 |
| Cisco ASA | 9.24.x | 9.24.1.221 |
| Cisco Secure Firewall FTD Software | 7.0.x | 7.0.9.1 Hotfix |
| Cisco Secure Firewall FTD Software | 7.2.x | 7.2.11.1 Hotfix |
| Cisco Secure Firewall FTD Software | 7.4.x | 7.4.7.1 Hotfix |
| Cisco Secure Firewall FTD Software | 7.6.x | 7.6.4.1 Hotfix |
| Cisco Secure Firewall FTD Software | 7.7.x | 7.7.11.1 Hotfix |
| Cisco Secure Firewall FTD Software | 10.0.x | 10.0.0.1 Hotfix |
The Cyber Centre recommends organizations:
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topicsFootnote 6Footnote 7.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.
Serial number: AV26-812
Date: August 12, 2026
As of August 12, 2026, Fortinet is affected by a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-811
Date: August 12, 2026
As of August 12, 2026, Phoenix Contact is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-810
Date: August 12, 2026
As of August 11, 2026, MongoDB is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-809
Date: August 12, 2026
As of August 11, 2026, SonicWall is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial number: AV26-808
Date: August 12, 2026
As of August 11, 2026, Adobe is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial number: AV26-807
Date: August 12, 2026
As of August 11, 2026, Cisco is affected by a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
On August 11, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20349 to their Known Exploited Vulnerabilities (KEV) Database.
Serial number: AV26-806
Date: August 12, 2026
As of August 11, 2026, Google is affected by a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-805
Date: August 11, 2026
As of August 11, 2026, Ivanti is affected by vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-803
Date: August 11, 2026
As of August 5, 2026, Red Hat is affected by a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Serial Number: AV26-802
Date: August 11, 2026
As of August 11, 2026, Siemens is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available
Serial Number: AV26-801
Date: August 11, 2026
As of August 11, 2026, Rapid7 is affected by a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Serial Number: AV26-800
Date: August 11, 2026
As of August 10, 2026, AMD is affected by vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.