Canadian Centre for Cyber Security Alerts & Advisories

<article data-history-node-id="8398" about="/en/alerts-advisories/siemens-security-advisory-av26-1063" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="content-area"> <p><strong>Serial Number: </strong>AV26-1063<br /><strong>Date: </strong>October 19, 2026</p> <p>As of October 15, 2026, Siemens is affected by a vulnerability in the following product:</p> <ul><li>Siemens Software Center <ul><li>Prior to V4.0.9.8</li> </ul></li> </ul><p>Siemens has reported that CVE-2026-110936 is being exploited in the wild.</p> <p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://productcert.siemens.com/productcert/html/ssa-580366.html">SSA-580366: DLL Sideloading Vulnerability in Siemens Software Center</a></li> <li><a href="https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/">Active Exploitation of CVE-2026-110936 in Siemens Software Center</a></li> <li><a href="https://productcert.siemens.com/">Siemens Product CERT</a></li> </ul></div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="8397" about="/en/alerts-advisories/eptura-security-advisory-av26-1062" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><div class="content-area"> <p><strong>Serial Number: </strong>AV26-1062<br /><strong>Date: </strong>October 19, 2026</p> <p>As of October 19, 2026, Eptura is affected by a vulnerability in the following product:</p> <ul><li>Archibus <ul><li>Prior to 2025.02</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://eptura.com/our-platform/archibus/">Eptura Archibus</a></li> <li><a href="https://knowledge.eptura.com/Archibus/Product_Information/Archived_Archibus_Release_Notes">Archived Archibus Release Notes</a></li> </ul></div> </div> </div> </div> </div> </div> </article>

<article data-history-node-id="8396" about="/en/alerts-advisories/red-hat-security-advisory-av26-1061" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial Number: </strong>AV26-1061<br /><strong>Date: </strong>October 19, 2026</p> <p>As of October 19, 2026, Red Hat is affected by vulnerabilities in the following products:</p> <ul><li>Fast Datapath for RHEL 10/8/9 <ul><li>All versions</li> </ul></li> <li>ManageIQ <ul><li>All versions</li> </ul></li> <li>Migration Toolkit for Applications 8 <ul><li>All versions</li> </ul></li> <li>Migration Toolkit for Virtualization <ul><li>All versions</li> </ul></li> <li>OpenShift Service Mesh 3 <ul><li>All versions</li> </ul></li> <li>Red Hat Advanced Cluster Management for Kubernetes 2 <ul><li>All versions</li> </ul></li> <li>Red Hat Ansible Automation Platform 2 <ul><li>All versions</li> </ul></li> <li>Red Hat Ansible Automation Platform Ansible Core 2 <ul><li>All versions</li> </ul></li> <li>Red Hat Certification Program for Red Hat Enterprise Linux 9 <ul><li>All versions</li> </ul></li> <li>Red Hat CloudForms <ul><li>All versions</li> </ul></li> <li>Red Hat Discovery 2 <ul><li>All versions</li> </ul></li> <li>Red Hat Enterprise Linux 6/7/8/9/10 <ul><li>All versions</li> </ul></li> <li>Red Hat Hardened Images <ul><li>All versions</li> </ul></li> <li>Red Hat OpenShift Container Platform 4 <ul><li>All versions</li> </ul></li> <li>Red Hat OpenStack Platform 13 (Queens) <ul><li>All versions</li> </ul></li> <li>Red Hat OpenStack Platform 17.1 <ul><li>All versions</li> </ul></li> <li>Red Hat OpenStack Platform 18.0 <ul><li>All versions</li> </ul></li> <li>Red Hat Satellite 6 <ul><li>All versions</li> </ul></li> <li>Red Hat Update Infrastructure 5 <ul><li>All versions</li> </ul></li> <li>Self-service automation portal 2 <ul><li>All versions</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://access.redhat.com/security/security-updates/security-advisories">Red Hat Security Advisories</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="7649" about="/en/alerts-advisories/redis-security-advisory-av26-423" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-423<br /><strong>Date:</strong> May 5, 2026<br /><strong>Updated:</strong> October 19, 2026</p> <p>On May 5, 2026, Redis published a security advisory to address vulnerabilities in the following products:</p> <ul><li>Redis Software – multiple versions</li> <li>Redis OSS/CE releases – multiple versions</li> </ul><h2 class="h3">Update 1</h2> <p>Open-source reporting indicates that CVE-2026-25243 is being exploited in the wild.</p> <p>The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.</p> <ul class="list-unstyled"><li><a href="https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/">Redis Security advisory: [CVE‑2026‑23479] [CVE‑2026‑25243] [CVE-2026-25588] [CVE‑2026‑25589] [CVE-2026-23631]</a></li> <li><a href="https://redis.io/blog/">Redis Security Advisories</a></li> </ul><!–CUT & PASTE the French version info –></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8394" about="/en/alerts-advisories/google-security-advisory-av26-1060" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1060<br /><strong>Date: </strong>October 16, 2026</p> <p>As of October 15, 2026, Google is affected by vulnerabilities in the following product:</p> <ul><li>Chrome <ul><li>Versions prior to 155.0.8059.84/.85 (Windows/Mac) and 155.0.8059.84 (Linux)</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html">Chrome Releases: Stable Channel Update for Desktop</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8393" about="/en/alerts-advisories/bmc-helix-security-advisory-av26-1059" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial Number:</strong> AV26-1059<br /><strong>Date:</strong> October 16, 2026</p> <p>As of October 15, 2026, BMC Helix is affected by a vulnerability in the following product:</p> <ul><li>BMC Helix Network Management <ul><li>Prior to 26.3.01</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/">BMC Helix Network Management 26.3.01 On-prem Release Notes</a></li> <li><a href="https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/">BMC Helix On-prem Release Notes</a></li> </ul><!–CUT & PASTE the French version info –></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8387" about="/en/alerts-advisories/beyondtrust-security-advisory-av26-1054" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1054<br /><strong>Date: </strong>October 16, 2026<br /><strong>Updated:</strong> October 16, 2026</p> <p>As of October 15, 2026, BeyondTrust is affected by a vulnerability in the following product:</p> <ul><li>Remote Support <ul><li>Prior to or equal to 26.2.3</li> </ul></li> </ul><p>Open-source reporting indicates that CVE-2026-102764 is being exploited in the wild.</p> <h2 class="h3">Update 1</h2> <p>On October 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102764 to their Known Exploited Vulnerabilities (KEV) Database.</p> <p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://www.beyondtrust.com/blog/entry/bt26-05">ARMORY CASTLE and BT26-05: What Security Teams Need to Know | BeyondTrust</a></li> <li><a href="https://www.beyondtrust.com/trust-center/security-advisories">Security Advisories | BeyondTrust</a></li> <li><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764">CISA KEV: CVE-2026-102764</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8392" about="/en/alerts-advisories/progress-security-advisory-av26-1058" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial Number:</strong> AV26-1058<br /><strong>Date:</strong> October 16, 2026</p> <p>As of October 14, 2026, Progress is affected by vulnerabilities in the following product:</p> <ul><li>MOVEit Transfer <ul><li>Prior to 2025.1.6</li> <li>Prior to 2026.0.4</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://community.progress.com/s/article/MOVEit-Transfer-Critical-Security-Bulletin—September-2026">MOVEit Transfer Critical Security Bulletin – September 2026</a></li> <li><a href="https://www.progress.com/trust-center">Progress Trust Center</a></li> </ul><!–CUT & PASTE the French version info –></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8391" about="/en/alerts-advisories/al26-025-critical-vulnerability-impacting-beyondtrust-remote-support-cve-2026-102764" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Number:</strong> AL26-025<br /><strong>Date:</strong> October 16, 2026</p> <h2>Audience</h2> <p>This Alert is intended for <abbr title="information technology">IT</abbr> professionals and managers.</p> <h2>Purpose</h2> <p>An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.</p> <h2>Details</h2> <p>The Canadian Centre for Cyber Security (Cyber Centre) is aware of a critical vulnerability affecting BeyondTrust Remote <span class="nowrap">Support (RS)<sup id="fn1-rf"><a class="fn-lnk" href="#fn1"><span class="wb-inv">Footnote </span>1</a></sup><sup id="fn2-rf"><a class="fn-lnk" href="#fn2"><span class="wb-inv">Footnote </span>2</a></sup>.</span> In response to the vendor advisory released on October 15, 2026, the Cyber Centre released AV26-1054 on <span class="nowrap">October 16, 2026<sup id="fn3-rf"><a class="fn-lnk" href="#fn3"><span class="wb-inv">Footnote </span>3</a></sup>.</span></p> <p>Tracked as <span class="nowrap">CVE-2026-102764<sup id="fn4-rf"><a class="fn-lnk" href="#fn4"><span class="wb-inv">Footnote </span>4</a></sup>,</span> this vulnerability is an Authentication Bypass by Spoofing vulnerability <span class="nowrap">(CWE-290)<sup id="fn5-rf"><a class="fn-lnk" href="#fn5"><span class="wb-inv">Footnote </span>5</a></sup></span> that affects all versions of BeyondTrust Remote Support.</p> <p>Successful exploitation of this vulnerability may allow a remote, unauthenticated attacker to exploit insufficient origin validation in internal BeyondTrust Remote Support messaging components to perform unauthorized file operations on an affected appliance without user interaction. The vulnerability requires no credentials or user action and can enable arbitrary file uploads, potentially resulting in full compromise of the appliance.</p> <p>The Cyber Centre has observed open-source reporting indicating that the vulnerability is being exploited in the <span class="nowrap">wild<sup id="fn6-rf"><a class="fn-lnk" href="#fn6"><span class="wb-inv">Footnote </span>6</a></sup>.</span></p> <h2>Suggested actions</h2> <p>The Cyber Centre strongly recommends that organizations running affected BeyondTrust Remote Support deployments upgrade to the following fixed version:</p> <div class="table-responsive"> <table class="table"><thead><tr><th scope="col">Affected product</th> <th scope="col">Affected versions</th> <th scope="col">Fixed versions</th> </tr></thead><tbody><tr><td>BeyondTrust Remote Support</td> <td>Versions 26.2.3 and prior</td> <td>BT26-05-RS patch for versions 24.3.1 to v26.2.3</td> </tr></tbody><thead></thead></table></div> <p>BeyondTrust has confirmed that a patch addressing this vulnerability was applied to all Remote Support <abbr title="software as a service">SaaS</abbr> and Privileged Remote Access <abbr title="software as a service">SaaS</abbr> customers as of 9 October 2026. Organizations using these <abbr title="software as a service">SaaS</abbr> offerings do not need to take any additional action to remediate this issue.</p> <p>The Cyber Centre also recommends organizations to:</p> <ul><li>identify BeyondTrust Remote Support deployments within their environments and determine whether they are SaaS-hosted or self-hosted</li> <li>verify the installed Remote Support version. Systems running 26.2.3 or earlier are identified as affected by BeyondTrust</li> <li>upgrade Remote Support installations older than 24.3.1 to a newer supported version before applying the remediation patch</li> <li>apply the BT26-05-RS patch to affected self-hosted Remote Support deployments running versions 24.3.1 through 26.2.3</li> <li>confirm automatic updates are enabled, where appropriate. BeyondTrust specifically advises manual patching for self-hosted instances that are not subscribed to automatic updates</li> <li>as an additional defensive measure, review affected appliances for unexpected or unauthorized file activity, particularly when an appliance was exposed while vulnerable</li> </ul><p>In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 <abbr title="information technology">IT</abbr> Security <span class="nowrap">Actions<sup id="fn7-rf"><a class="fn-lnk" href="#fn7"><span class="wb-inv">Footnote </span>7</a></sup></span> with an emphasis on the following topics:</p> <ul><li>consolidating, monitoring, and defending Internet gateways</li> <li>patch operating systems and applications</li> <li>harden operating systems and applications</li> <li>isolate web-facing applications</li> </ul><p>Should activity matching the content of this alert be discovered, recipients are encouraged to report via <a href="/en/incident-management">My Cyber Portal</a>, or email <a href="mailto:contact@cyber.gc.ca">contact@cyber.gc.ca</a>.</p> <h2>References</h2> <aside class="wb-fnote" role="note"><dl><dt>Footnote 1</dt> <dd id="fn1"> <p><a href="https://www.beyondtrust.com/trust-center/security-advisories/bt26-05">BeyondTrust Security Advisories BT26-05</a></p> <p class="fn-rtn"><a href="#fn1-rf"><span class="wb-inv">Return to footnote</span>1<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 2</dt> <dd id="fn2"> <p><a href="https://www.beyondtrust.com/blog/entry/bt26-05"><span class="text-uppercase">ARMORY CASTLE</span> and BT26-05: What Security Teams Need to Know</a></p> <p class="fn-rtn"><a href="#fn2-rf"><span class="wb-inv">Return to footnote</span>2<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 3</dt> <dd id="fn3"> <p><a href="/en/alerts-advisories/beyondtrust-security-advisory-av26-1054">BeyondTrust security advisory (AV26-1054)</a></p> <p class="fn-rtn"><a href="#fn3-rf"><span class="wb-inv">Return to footnote</span>3<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 4</dt> <dd id="fn4"> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-102764">CVE-2026-102764 Detail</a></p> <p class="fn-rtn"><a href="#fn4-rf"><span class="wb-inv">Return to footnote</span>4<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 5</dt> <dd id="fn5"> <p><a href="https://cwe.mitre.org/data/definitions/290.html">CWE-290: Authentication Bypass by Spoofing</a></p> <p class="fn-rtn"><a href="#fn5-rf"><span class="wb-inv">Return to footnote</span>5<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 6</dt> <dd id="fn6"> <p><a href="https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust"><span class="text-uppercase">ARMORY CASTLE</span> Exploits BeyondTrust</a></p> <p class="fn-rtn"><a href="#fn6-rf"><span class="wb-inv">Return to footnote</span>6<span class="wb-inv"> referrer</span></a></p> </dd> <dt>Footnote 7</dt> <dd id="fn7"> <p><a href="/en/guidance/top-10-it-security-actions-protect-internet-connected-networks-and-information-itsm10089">Top 10 <abbr title="information technology">IT</abbr> security actions to protect Internet connected networks and information (ITSM.10.089)</a></p> <p class="fn-rtn"><a href="#fn7-rf"><span class="wb-inv">Return to footnote</span>7<span class="wb-inv"> referrer</span></a></p> </dd> </dl></aside></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8367" about="/en/alerts-advisories/ivanti-security-advisory-av26-1035" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1035<br /><strong>Date: </strong>October 13, 2026<br /><strong>Updated: </strong>October 16, 2026</p> <p>As of October 13, 2026, Ivanti is affected by vulnerabilities in the following products:</p> <ul><li>Ivanti Connect Secure <ul><li>Version 25.1.1.1 and prior</li> <li>Version 25.2.2 and prior</li> <li>Version 22.8R2.4 and prior</li> </ul></li> <li>Ivanti Neurons Patch for Intune <ul><li>Versions prior to September 16, 2026</li> </ul></li> <li>Ivanti Xtraction <ul><li>Version 2026.2.1 and prior</li> </ul></li> </ul><p class="mrgn-bttm-md">On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to their Known Exploited Vulnerabilities (KEV) Database.</p> <p><strong>Update 1</strong></p> <p>Open-source reporting indicates that CVE-2026-111357 is being exploited in the wild.</p> <p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US">Security Advisory Ivanti Connect Secure (CVE-2026-104935)</a></li> <li><a href="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs?language=en_US">Security Advisory Ivanti Xtraction (Multiple CVEs)</a></li> <li><a href="https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-Patch-for-Intune-October-2026?language=en_US">Security Advisory Ivanti Neurons Patch for Intune October 2026 (CVE-2026-109412)</a></li> <li><a href="https://forums.ivanti.com/s/searchallcontent?language=en_US#tab=All&amp;sortCriteria=date%20descending&amp;f-sfkbknowledgearticletypec=Security%20Advisory">Ivanti Security Advisories</a></li> <li><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-104935">CISA KEV: CVE-2026-104935</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8390" about="/en/alerts-advisories/mozilla-security-advisory-av26-1057" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1057<br /><strong>Date: </strong>October 16, 2026</p> <p>As of October 13, 2026, Mozilla is affected by vulnerabilities in the following products:</p> <ul><li>Firefox ESR <ul><li>Prior to 153.5</li> <li>Prior to 115.43</li> </ul></li> <li>Firefox <ul><li>Prior to 158</li> </ul></li> <li>Thunderbird <ul><li>Prior to 153.5</li> <li>Prior to 158</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2026-106/">Security Vulnerabilities fixed in Firefox 158 – Mozilla</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2026-107/">Mozilla Foundation Security Advisory 2026-107</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/">Security Vulnerabilities fixed in Firefox ESR 153.5 – Mozilla</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2026-109/">Security Vulnerabilities fixed in Thunderbird 158 – Mozilla</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/mfsa2026-110/">Security Vulnerabilities fixed in Thunderbird 153.5 – Mozilla</a></li> <li><a href="https://www.mozilla.org/en-US/security/advisories/">Mozilla Foundation Security Advisories – Mozilla</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8389" about="/en/alerts-advisories/palo-alto-networks-security-advisory-av26-1056" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1056<br /><strong>Date: </strong>October 16, 2026</p> <p>As of October 15, 2026, Palo Alto Networks is affected by a vulnerability in the following product:</p> <ul><li>Idira Secrets Manager (Self-Hosted) <ul><li>Prior to v13.9.1</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.9.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3">Idira Secrets Manager – Version 13.9.1</a></li> <li><a href="https://security.paloaltonetworks.com/">Palo Alto Networks Security Advisories</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8388" about="/en/alerts-advisories/control-systems-moxa-security-advisory-av26-1055" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1055<br /><strong>Date: </strong>October 16, 2026</p> <p>As of October 16, 2026, Moxa is affected by vulnerabilities in the following product:</p> <ul><li>AIG-302 Series <ul><li>Prior to or equal to v1.4.1</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://www.moxa.com/en/support/product-support/security-advisory/mpsa-262560-cve-2026-109812,-cve-2026-109813-vulnerabilities-in-industrial-computing-products">CVE-2026-109812, CVE-2026-109813: Vulnerabilities in Industrial Computing Products</a></li> <li><a href="https://www.moxa.com/en/rss/moxa-security-advisory">Moxa Security Advisory</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8386" about="/en/alerts-advisories/suse-linux-security-advisory-av26-1053" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1053<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 15, 2026, SUSE is affected by vulnerabilities in the following products:</p> <ul><li>Rancher <ul><li>Prior to 2.10.5</li> <li>Prior to 2.11.1</li> <li>Prior to 2.9.9</li> </ul></li> <li>Steve <ul><li>Prior to 0.2.1</li> <li>Prior to 0.3.3</li> <li>Prior to 0.4.4</li> <li>Prior to 0.5.13</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://github.com/rancher/rancher/security/advisories/GHSA-8h6m-wv39-239m">Users who can create Projects can gain access to arbitrary projects</a></li> <li><a href="https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx">Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks</a></li> <li><a href="https://www.suse.com/support/update/">SUSE Update Advisories</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8385" about="/en/alerts-advisories/control-systems-johnson-controls-security-advisory-av26-1052" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1052<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 7, 2026, Johnson Controls is affected by a vulnerability in the following product:</p> <ul><li>ADVMS <ul><li>Prior to 3.10</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://tyco.widen.net/s/zwdfjrxcnw/jci-psa-2026-17">Vulnerability impacting American Dynamics VMS – JCI-PSA-2026-17</a></li> <li><a href="https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories">Johnson Controls Product Security Advisories</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8384" about="/en/alerts-advisories/control-systems-schneider-electric-security-advisory-av26-1051" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1051<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 13, 2026, Schneider Electric is affected by a vulnerability in the following products:</p> <ul><li>Sage RTU 1410/1430/1450 <ul><li>Versions prior to C3414-500-S02L0</li> </ul></li> <li>Sage RTU 2400 <ul><li>Versions prior to C3414-500-S02L0</li> </ul></li> <li>Sage RTU 3030 Magnum <ul><li>Versions prior to C3414-500-S02L0</li> </ul></li> <li>Sage RTU 4400 <ul><li>Versions prior to C3414-500-S02L0</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web link perform the suggested mitigations and apply the necessary updates.</p> <ul class="list-unstyled"><li><a href="https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&amp;p_enDocType=Security+and+Safety+Notice&amp;p_File_Name=SEVD-2026-286-02.pdf">Insufficient Verification of Data Authenticity vulnerability on SAGE RTU Products</a></li> <li><a href="https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp">Schneider Electric Security Notifications</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8383" about="/en/alerts-advisories/jetbrains-security-advisory-av26-1050" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1050<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 15, 2026, JetBrains is affected by vulnerabilities in the following products:</p> <ul><li>Datalore <ul><li>Prior to 2026.2.1</li> </ul></li> <li>Junie CLI <ul><li>Prior to 26.8.3</li> </ul></li> <li>TeamCity <ul><li>Prior to 2026.2</li> <li>Prior to 2026.1.4</li> <li>Prior to 2025.11.8</li> </ul></li> <li>YouTrack <ul><li>Prior to 2026.2.19575</li> <li>Piror to 2026.3.16075</li> <li>Prior to 2026.3.16397</li> <li>Prior to 2026.3.16402</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://www.jetbrains.com/privacy-security/issues-fixed/">Fixed security issues</a></li> <li><a href="https://blog.jetbrains.com/security/">Security – The JetBrains Blog </a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8328" about="/en/alerts-advisories/atlassian-security-advisory-av26-1002" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1002<br /><strong>Date: </strong>October 5, 2026<br /><strong>Updated: </strong>October 15, 2026</p> <p>As of October 5, 2026, Atlassian is affected by a vulnerability in the following products:</p> <ul><li>Bamboo Data Center <ul><li>Version 10.2.4 and prior</li> <li>Version 12.1.12 and prior</li> </ul></li> <li>Bamboo Server <ul><li>All versions</li> </ul></li> <li>Bitbucket Data Center <ul><li>Version 10.2.8 and prior</li> <li>Version 10.5.1 and prior</li> <li>Version 9.4.26 and prior</li> </ul></li> <li>Bitbucket Server <ul><li>All versions</li> </ul></li> <li>Confluence Data Center <ul><li>Version 10.2.19 and prior</li> <li>Version 9.2.26 and prior</li> </ul></li> <li>Confluence Server <ul><li>All versions</li> </ul></li> <li>Crowd Data Center <ul><li>Version 6.3.7 and prior</li> <li>Version 7.0.3 and prior</li> <li>Version 7.1.1 and prior</li> <li>Version 7.2.4 and prior</li> </ul></li> <li>Crowd Server <ul><li>All versions</li> </ul></li> <li>Crucible Data Center <ul><li>Version 4.9.15 and prior</li> </ul></li> <li>Crucible Server <ul><li>Version 4.9.15 and prior</li> </ul></li> <li>Fisheye Data Center <ul><li>Version 4.9.15 and prior</li> </ul></li> <li>Fisheye Server <ul><li>Version 4.9.15 and prior</li> </ul></li> <li>Jira Service Management Data Center <ul><li>Version 10.3.26 and prior</li> <li>Version 11.3.12 and prior</li> <li>Version 5.12.40 and prior</li> </ul></li> <li>Jira Service Management Server <ul><li>Version 5.12.40 and prior</li> </ul></li> <li>Jira Software Data Center <ul><li>Version 10.3.26 and prior</li> <li>Version 11.3.12 and prior</li> <li>Version 9.12.40 and prior</li> </ul></li> <li>Jira Software Server <ul><li>Version 9.12.40 and prior</li> </ul></li> </ul><p><strong>Update 1</strong><br /> Open source reporting indicates that CVE-2026-21589 is being exploited in the wild.</p> <p><strong>Update 2</strong><br /> On October 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21589 to their Known Exploited Vulnerabilities (KEV) Database.</p> <p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html">CVE-2026-21589 – Arbitrary File Access Vulnerability impacts Multiple Products</a></li> <li><a href="https://confluence.atlassian.com/security/security-advisories-bulletins-1236937381.html">Security Advisories &amp; Bulletins</a></li> <li><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21589">CISA KEV: CVE-2026-21589</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8382" about="/en/alerts-advisories/f5-security-advisory-av26-1049" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1049<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 14, 2026, F5 is affected by vulnerabilities in the following products:</p> <ul><li>NGINX Gateway Fabric <ul><li>Prior to 2.8.0</li> </ul></li> <li>NGINX Ingress Controller <ul><li>Prior to 5.7.0</li> </ul></li> <li>NGINX JavaScript <ul><li>Prior to 1.0.2</li> </ul></li> <li>NGINX Open Source <ul><li>Prior to 1.30.6</li> <li>Prior to 1.31.7</li> </ul></li> <li>NGINX Plus <ul><li>Prior to 37.0.5.1</li> <li>Prior to 37.1.0.1</li> <li>Versions R33 to R36</li> </ul></li> <li>NGINX Instance Manager <ul><li>Prior to 2.24.0</li> </ul></li> <li>F5 WAF for NGINX <ul><li>Prior to 5.16.0</li> <li>Prior to 5.14.2</li> </ul></li> <li>F5 DoS for NGINX <ul><li>Prior to 4.11.0</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://my.f5.com/manage/s/article/K000162615">K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019</a></li> <li><a href="https://my.f5.com/manage/s/article/K000162617">K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939</a></li> <li><a href="https://my.f5.com/manage/s/article/K000162416">K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176</a></li> <li><a href="https://my.f5.com/manage/s/new-updated-articles#f-f5_document_type=Security%20Advisory">MyF5 New and Updated Articles</a></li> </ul></div> </div> </div> </div> </div> </article>

<article data-history-node-id="8381" about="/en/alerts-advisories/sonicwall-security-advisory-av26-1048" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder block-extra-field-blocknodecccs-threatslinks clearfix"> </div> <div data-block-plugin-id="field_block:node:cccs_threats:body" class="block block-layout-builder block-field-blocknodecccs-threatsbody clearfix"> <div class="field field–name-body field–type-text-with-summary field–label-hidden field–item"><p><strong>Serial number: </strong>AV26-1048<br /><strong>Date: </strong>October 15, 2026</p> <p>As of October 14, 2026, SonicWall is affected by vulnerabilities in the following product:</p> <ul><li>Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM) <ul><li>Version 4.3.1 and prior</li> </ul></li> </ul><p class="mrgn-bttm-md">The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.</p> <ul class="list-unstyled"><li><a href="https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0018">SonicWall NSM On-Prem Affected By Multiple Vulnerabilities</a></li> <li><a href="https://psirt.global.sonicwall.com/">SonicWall Security Advisory</a></li> </ul></div> </div> </div> </div> </div> </article>