Serial Number: AV26-917
Date: September 11, 2026

As of September 10, 2026, GitLab is affected by vulnerabilities in the following product:

• GitLab
  • Prior to 19.1.8
  • Prior to 19.2.6
  • Prior to 19.3.2

On September 11, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8 | GitLab Docs
• GitLab release notes | GitLab Docs
• CISA KEV: CVE-2026-85706

Serial number: AV26-867
Date: September 1, 2026
Updated: September 11, 2026

As of August 28, 2026, JFrog is affected by a vulnerability in the following product:

• Artifactory
  • Prior to 7.111.21
  • Prior to 7.117.28
  • Prior to 7.125.20
  • Prior to 7.133.29
  • Prior to 7.146.38
  • Prior to 7.161.20

Open-source reporting indicates that CVE-2026-82329 related to JFrog Artifactory is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Update 1

On September 2, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-82329 to their Known Exploited Vulnerabilities (KEV) Database.

Update 2

On September 11, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-42016 and CVE-2026-42018 to their Known Exploited Vulnerabilities (KEV) Database.

• Artifactory Self-Managed Releases
• JFrog Security Advisories
• CISA KEV: CVE-2026-82329
• CISA KEV: CVE-2026-42016
• CISA KEV: CVE-2026-42018

Serial Number: AV26-916
Date: September 11, 2026

As of September 8, 2026, n8n is affected by a vulnerability in the following product:

• n8n
  • Prior to 2.37.7
  • Prior to 2.38.2
  • Prior to 1.123.76

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release n8n@1.123.76
• Release n8n@2.37.7
• Release n8n@2.38.2
• Overview - n8n-io/n8n - GitHub

Serial number: AV26-903
Date: September 9, 2026
Updated: September 11, 2026

As of September 8, 2026, ConnectWise is affected by a vulnerability in the following product:

• ScreenConnect
  • versions prior to 26.6.5

Open-source reporting indicates that CVE-2026-84869 is being exploited in the wild.

Update 1

On September 11, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-84869 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• ScreenConnect 26.6.5 Security Patch
• ConnectWise - Security Bulletins
• CISA KEV: CVE-2026-84869

Serial Number: AV26-915
Date: September 11, 2026

As of September 11, 2026, Progress Software is affected by a vulnerability in the following product:

• Chef Automate
  • Prior to 4.13.520

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Critical Security Bulletin - August 2026 - Chef Automate Security Vulnerability
• Progress Trust Center

Serial number: AV26-914
Date: September 11, 2026

As of September 10, 2026, National Instruments is affected by vulnerabilities in the following products:

• SystemLink
  • Prior to or equal to 2026 Q3 Patch 1
• SystemLink Server
  • Prior to or equal to 2026 Q3 Patch 1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available./p>

• Improper Access Controls in NI SystemLink
• Storage of Sensitive Information in Cleartext in NI SystemLink
• Available Security Updates for NI Software: 2026

Serial number: AV26-913
Date: Septembre 11, 2026

As of September 10, 2026, GeoVision is affected by vulnerabilities in the following product::

• GV-LPC2011/LPC2211
  • Firmware version 1.13

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• GeoVision Security Advisory - GV-LPC-2026-09-01
• Cyber Security - GeoVision

Serial number: AV26-912
Date: September 11, 2026

As of September 9, 2026, Schneider Electric is affected by vulnerabilities in the following products:

• EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
  • Versions 9.1.2 and prior
• PowerLogic T300
  • Versions 2.9.8-5620 and prior

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.

• Multiple Vulnerabilities on EcoStruxure™ IT Data Center Expert
• Improper Neutralization of Special Elements used in an OS Command vulnerability on PowerLogic T300
• Schneider Electric Security Notifications

Serial Number: AV26-911
Date: September 11, 2026

As of September 10, 2026, MongoDB is affected by vulnerabilities in the following products:

• Java Driver
  • Prior to 5.11.1
• Laravel MongoDB (PHP)
  • Prior to 5.11.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• [PHPLARA-260] Query builder: force literal equality when 3-arg where uses '=' with an array value
• [JAVA-6276] Native heap use-after-free via cancellation racing KMS credential fetch in reactive encryption
• Alerts | MongoDB

Serial Number: AV26-910
Date: September 11, 2026

As of September 10, 2026, HashiCorp is affected by vulnerabilities in the following products:

• Consul
  • Prior to 2.0.4
• Consul Enterprise
  • 1.0 Prior to 1.21.18
  • 21.0 Prior to 1.21.18
  • 9.0 Prior to 1.21.18
• consul-template
  • Prior to 0.43.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• HCSEC-2026-34 - Consul vulnerable to an authorization bypass in the catalog node-write path
• HCSEC-2026-38 - Consul-template vulnerable to an information disclosure issue in error handling
• HCSEC-2026-37 - Consul vulnerable to an authorization bypass in the Connect service mesh
• Security - HashiCorp Discuss

Serial Number: AV26-887
Date: September 8, 2026
Updated: September 10, 2026

As of September 3, 2026, Mikrotik is affected by vulnerabilities in the following product:

• RouterOS
  • Prior to 6.49.21
  • Prior to 7.23.4
  • Prior to 7.24.2
  • Prior to 7.25 beta 3

Open-source reporting indicates that CVE-2026-67276, CVE-2026-67277 and CVE-2026-86060 related to MikroTik are being exploited in the wild.

Update 1

On September 10, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-CVE-2026-67277 and CVE-2026-86060 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerabilities in Mikrotik RouterOS software
• September 2026 vulnerability
• CISA KEV: CVE-2026-67277
• CISA KEV: CVE-2026-86060

Number: AL26-020
Date: September 10, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Cyber Centre is aware of vulnerabilities impacting MikroTik RouterOS devices, especially if the SSH service is exposed to the Internet ^{Footnote 1}.

In response to the vendor advisory released on September 3, 2026, the Cyber Centre released AV26-887 on September 8, 2026 ^{Footnote 2}.

Tracked as CVE-2026-67277^{Footnote 3}, this vulnerability is a Missing Authentication for Critical Function vulnerability (CWE-306) ^{Footnote 4} that may allow a remote attacker to obtain potentially sensitive information.

Tracked as CVE-2026-86060^{Footnote 5}, this vulnerability is an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability (CWE-88)^{Footnote 6} that may allow a remote attacker to escalate privileges.

Tracked as CVE-2026-67276^{Footnote 7}, this vulnerability is an Improper Verification of Cryptographic Signature (CWE-347)^{Footnote 8} that may allow an attacker to forge a valid signature and open an SSH command channel as the target user without the private key.

On September 10, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-67277 and CVE-2026-86060 to their Known Exploited Vulnerabilities (KEV) Database. ^{Footnote 9Footnote 10}

Suggested actions

The Cyber Centre recommends that organizations using MikroTik RouterOS, review the MikroTik security bulletin^{Footnote 1} and update/upgrade the affected devices to the following vendor-supported fixed versions:

The Cyber Centre recommends following guidance provided by MikroTik^{Footnote 1} and CERT Polska ^{Footnote 11} to immediately update RouterOS, along with checking logs for possible device compromise. If the logs have a critical entry saying device has been “Flagged”, MikroTik recommends following the instructions provided by the status site^{Footnote 12}.

The Cyber Centre also recommends organizations to:

• Determine the current version of software on each appliance.
• Prioritize patching for systems exposing SSH to the internet.
• Monitor authentication logs and network activity for indications of unauthorized access.
• After patching, verify that the appliance is running the updated version and review logs for unusual activity.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions^{Footnote 13} with an emphasis on the following topics:

• Consolidate, monitor, and defend Internet gateways
• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.

References

Serial number: AV26-909
Date: September 10, 2026

As of September 9, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products:

• ClearPass Policy Manager (CPPM)
  • Prior to or equal to 6.11.14
  • Prior to or equal to 6.12.8
• HPE IceWall products
  • Multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• HPESBNW05130 rev.1 - Multiple Vulnerabilities in HPE Aruba Networking ClearPass Policy Manager (CPPM)
• HPESBMU05142 rev.1 - HPE IceWall products, Remote Bypass of Security Restrictions
• HPESBMU05147 rev.1 - HPE IceWall products, Denial of Service vulnerability
• HPE Security Bulletin Library

Serial number: AV26-908
Date: September 10, 2026

As of September 10, 2026, WebPros is affected by vulnerabilities in the following products:

• cPanel & WebHost Manager (WHM) software
  • Prior to 11.110.0.143
  • Prior to 11.134.0.55
  • Prior to 11.136.0.39
  • Prior to 11.138.0.4
  • Prior to WP2: 11.138.1.9

• ConfigServer Security & Firewall (CSF) software
  • Versions 14.00 to 16.29 (CVE-2026-65638)
  • Versions 2.15 to 16.29 (CVE-2026-65639)

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security: CVE-2026-67401 SQL Injection Vulnerability in cPanel's EmailTrack Functionality - September 8, 2026
• Security: CVE-2026-65638 CSF Security Release
• Security: CVE-2026-65639 CSF Security Release
• cPanel Security

Serial number: AV26-808
Date: August 12, 2026
Updated: September 10, 2026

As of August 11, 2026, Adobe is affected by vulnerabilities in the following products:

• Adobe Campaign Classic
  • Prior to or equal to ACC v7: 7.4.3 build 9399
• Adobe Commerce
  • Prior to or equal to 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug and 2.4.4-2026-aug
• Adobe Commerce B2B
  • Prior to or equal to 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul and 1.3.3-2026-jul
• ColdFusion 2023
  • Prior to or equal to 2023.0.22
• ColdFusion 2025
  • Prior to or equal to 2025.0.11
• Content Credentials Command-Line Tool
  • Prior to or equal to c2patool-v0.27.5
• Content Credentials JS SDK
  • Prior to or equal to @contentauth/c2pa-web@0.12.0
• Content Credentials Rust SDK
  • Prior to or equal to c2pa-v0.90.5
• Lightroom Classic
  • Prior to or equal to 15.4, 15.4.1, 15.3, 15.3.1, 15.2, 15.2.1
• Magento Open Source
  • Prior to or equal to 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul and 2.4.6-2026-jul

Update 1

Open-source reporting indicates that CVE-2026-71362 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security update available for Adobe Commerce | APSB26-92
• Adobe Product Security Incident Response Team

Serial number: AV26-907
Date: September 10, 2026

As of September 10, 2026, Advantech is affected by vulnerabilities in the following product:

• Advantech WISE-6610 industrial gateway
  • Multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerabilities Identified in WISE-6610
• Security Advisories - Advantech

Serial number: AV26-906
Date: September 10, 2026

As of September 9, 2026, Fortra is affected by a vulnerability in the following product:

• GoAnywhere MFT Endpoint
  • Prior to 7.10.2

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Path Traversal in Fortra's GoAnywhere MFT Endpoint
• Product Security Advisories | Fortra

Serial number: AV26-905
Date: September 10, 2026

As of September 10, 2026, Palo Alto Networks is affected by vulnerabilities in the following products:

• Cloud NGFW
  • All on AWS*, All on Azure*
• PAN-OS
  • Multiple versions
• Prisma Access
  • Multiple versions
• Prisma Browser
  • Prior to 151.26.5.170

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing
• PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026)
• Palo Alto Networks Security Advisories

Number: AL26-019
Date: September 4, 2026
Updated: September 9, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Cyber Centre is aware of vulnerabilities impacting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway)^{Footnote 1}.  

In response to the vendor advisory released on August 19, 2026, the Cyber Centre released AV26-833 on August 19, 2026^{Footnote 2}.

Tracked as CVE-2026-19490^{Footnote 3}, this vulnerability is an Authentication Bypass Using an Alternate Path vulnerability (CWE-288)^{Footnote 4}. The vulnerability may allow a remote, unauthenticated attacker to circumvent authentication controls on NetScaler appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server.

Tracked as CVE-2026-19489^{Footnote 5}, this vulnerability is a Classic Buffer Overflow vulnerability (CWE-120)^{Footnote 6}. This vulnerability may allow memory overflow leading to unpredictable behavior or Denial of Service conditions.

Pre-conditions for these vulnerabilities are that the NetScaler ADC or NetScaler Gateway 14.1-43.56 and later, as well as 13.1-61.28 and later, must be configured as a SAML IdP (Security Assertion Markup Language Identity Provider).

Earlier builds with Gateway or AAA configuration are also vulnerable.

To determine if organizations are impacted, it is recommended to check if the appliance meets the precondition by inspecting the NetScaler configuration for the specified strings:

For CVE-2026-19489:

"add lsn group.*sipalg.*"

For CVE-2026-19490:

SAML action configuration:

"add authentication samlAction.*"

Auth or VPN vserver:

"add authentication vserver .*" or "add vpn vserver .*"

Further information about the impacted configurations can be found in the Citrix advisory^{Footnote 1}.

Update 1

On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19490 to their Known Exploited Vulnerabilities (KEV) Database.^{Footnote 9}

Suggested actions

The Cyber Centre recommends that organizations using Citrix NetScaler ADC and NetScaler Gateway appliances (particularly for SAML IDP-configured appliances), review the Citrix security bulletin^{Footnote 1} and update/upgrade the affected systems to the following vendor-supported fixed versions:

The Cyber Centre also recommends organizations to:

• determine the current version of software on each appliance
• identify NetScaler appliances configured as Gateway services or AAA virtual servers
• review configurations for SAML authentication deployments, where applicable
• prioritize patching affected systems on an emergency basis
• monitor authentication logs and network activity for indications of unauthorized access
• follow Citrix incident response guidance if compromise is suspected
• after patching, verify the appliance is running the updated version and review logs for unusual activity

Citrix has provided steps to take if NetScaler ADC or NetScaler Gateway are suspected to be compromised^{Footnote 7}.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions^{Footnote 8} with an emphasis on the following topics:

• consolidate, monitor, and defend Internet gateways
• patch operating systems and applications
• harden operating systems and applications
• isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

Serial Number: AV26-833
Date: August 19, 2026
Updated: September 9, 2026

As of August 19, 2026, Citrix is affected by vulnerabilities in the following products:

• NetScaler ADC and NetScaler
  • Version 13.1 prior to 13.1-63.21
  • Version 14.1 prior to 14.1-73.32
• NetScaler ADC FIPS
  • Prior to 14.1-73.32 FIPS
• NetScaler ADC FIPS and NDcPP
  • Prior to 13.1-37.277

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Update 1

On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19490 to their Known Exploited Vulnerabilities (KEV) Database.

• NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490
• Citrix Security Advisories
• CISA KEV: CVE-2026-19490

Serial number: AV26-197
Date: March 5, 2026
Updated: September 9, 2026

On March 4, 2026, Cisco published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:

• Cisco Security Cloud Control (SCC) Firewall Management – all versions
• Cisco Secure Firewall Management Center (FMC) – all versions
• Cisco Secure Firewall Adaptive Security Appliance (ASA) – versions prior to 9.20.4.14
• Cisco Secure Firewall Threat Defense (FTD) – all versions

Update 1

On March 18, 2026, Cisco stated that CVE-2026-20131 is being actively exploited.

Update 2

On March 19, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20131 to their Known Exploited Vulnerabilities (KEV) Database.

Update 3

On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20079 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.

• Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability
• Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
• Cisco Secure Firewall Adaptive Security Appliance Software TCP Flood Denial of Service Vulnerability
• Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IPsec Denial of Service Vulnerability
• Cisco Security Advisories
• CISA KEV: CVE-2026-20131
• CISA KEV: CVE-2026-20079

Serial number: AV26-023
Date: January 13, 2026
Updated: September 9, 2026

On January 13, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:

• FortiFone 7.0 – versions 7.0.0 to 7.0.1
• FortiFone 3.0 – versions 3.0.13 to 3.0.23
• FortiOS 7.6 – versions 7.6.0 to 7.6.3
• FortiOS 7.4 – versions 7.4.0 to 7.4.8
• FortiOS 7.2 – versions 7.2.0 to 7.2.11
• FortiOS 7.0 – versions 7.0.0 to 7.0.17
• FortiOS 6.4 – versions 6.4.0 to 6.4.16
• FortiSASE 25.2 – version 25.2.b
• FortiSASE 25.1.a – version 25.1.a.2
• FortiSIEM 7.4 – version 7.4.0
• FortiSIEM 7.3 – versions 7.3.0 to 7.3.4
• FortiSIEM 7.2 – versions 7.2.0 to 7.2.6
• FortiSIEM 7.1 – versions 7.1.0 to 7.1.8
• FortiSIEM 7.0 – versions 7.0.0 to 7.0.4
• FortiSIEM 6.7 – versions 6.7.0 to 6.7.10
• FortiSwitchManager 7.2 – versions 7.2.0 to 7.2.6
• FortiSwitchManager 7.0 – versions 7.0.0 to 7.0.5

Update 1

On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-25249 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Heap-based buffer overflow in cw_acd daemon – CVE-2025-25249
• Unauthenticated access to local configuration – CVE-2025-47855
• Unauthenticated remote command injection – CVE-2025-64155
• Fortinet PSIRT Advisories
• CISA KEV: CVE-2025-25249

Serial Number: AV26-904
Date: September 9, 2026

As of September 8, 2026, Google is affected by vulnerabilities in the following product:

• Chrome
  • Prior to 153.0.8010.37

Google is aware that an exploit for CVE-2026-87491 exists in the wild.

On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87491 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Stable Channel Update for Desktop
• CISA KEV: CVE-2026-87491

Serial Number: AV26-902
Date: September 9, 2026

As of September 9, 2026, Check Point is affected by vulnerabilities in the following products:

• Security Gateway
  • Multiple versions
• Check Point Spark Firewall using Site to Site VPN or Remote Access VPN
  • Multiple versions
• Security Management Server
  • Multiple versions
• Check Point Spark Firewall
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
• CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution
• Check Point Security

Serial Number: AV26-885
Date: September 8, 2026
Updated: September 9, 2026

As of September 6, 2026, N-able is affected by vulnerabilities in the following product:

• N-central
  • Prior to 2026.3.1.14

N-able indicates that CVE-2026-86218 is being exploited in the wild.

Update 1

On September 8, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-86218 to their Known Exploited Vulnerabilities (KEV) Database.

Update 2

Open-source reporting indicates that CVE-2026-86207 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• N-central 2026.3 Hotfix 4 – CVE-2026-86218
• 2026.3 HF4 Release Notes
• Release Notes | N-able Status | N-able Status Page
• CISA KEV: CVE-2026-86218

Serial Number: AV26-901
Date: September 9, 2026

As of September 4, 2026, misp is affected by vulnerabilities in the following product:

• misp
  • Prior to or equal to 2.5.45

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Authorise the sharing group whenever one is submitted

Serial Number: AV26-900
Date: September 9, 2026

As of September 8, 2026, NVIDIA is affected by vulnerabilities in the following product:

• Triton Inference Server
  • Versions 0.0 to 26.03
  • Versions 0.0 to 26.06

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Bulletin: Triton Inference Server - September 2026
• NVIDIA Product Security

Serial Number: AV26-899
Date: September 9, 2026

Commvault security advisory (AV26-899)

As of September 8, 2026, Commvault is affected by vulnerabilities in the following product:

• Commvault Cloud
  • 36.0 Prior to 11.36.123
  • 40.0 Prior to 11.40.72
  • 44.0 Prior to 11.44.20
  • 46.0 Prior to 11.46.20

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Commvault Cloud Security Advisories

Serial Number: AV26-898
Date: September 9, 2026

As of September 8, 2026, Fortinet is affected by vulnerabilities in the following products:

• FortiOS 7.6
  • Versions 7.6.1 to 7.6.6
• FortiProxy 7.6
  • Versions 7.6.2 to 7.6.6
• FortiPAM Chrome Extension 8.0
  • All versions
• FortiPAM Chrome Extension 7.4
  • All versions
• FortiSandbox 5.0
  • Versions 5.0.0 to 5.0.5
• FortiSandbox 4.4
  • Versions 4.4.0 to 4.4.8
• FortiSandbox Cloud 5.0
  • Versions 5.0.4 to 5.0.5
• FortiSandbox PaaS 5.0
  • Versions 5.0.4 to 5.0.5
• FortiMonitorOnSight 7.2
  • Versions 7.2.4 to 7.2.7
• FortiMonitorOnSight 7.2
  • Versions 7.2.0 to 7.2.2

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Fortinet PSIRT Advisories

Serial Number: AV26-897
Date: September 8, 2026

As of September 8, 2026, Ivanti is affected by vulnerabilities in the following products:

• Endpoint Manager Mobile
  • Prior to 12.10.0.0
  • Prior to 12.9.0.2
  • Prior to 12.8.0.4
• Neurons for ITSM (Cloud/SaaS)
  • Prior to mo2026.2
• Neurons for ITSM On-Prem
  • Prior to 2025.2 Sept 2026 Security Patch
  • Prior to 2025.3 Sept 2026 Security Patch
  • Prior to 2025.4 Sept 2026 Security Patch
  • Prior to 2026.1 Sept 2026 Security Patch
  • Prior to 2026.2
• Sentry
  • Prior to R10.8.2
  • Prior to R10.7.3
  • Prior to R10.6.4

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory Ivanti Neurons for ITSM (Multiple CVEs)
• Security Advisory - Ivanti Endpoint Manager Mobile (CVE-2026-18851)
• Security Advisory Ivanti Sentry (CVE-2026-83527)
• September 2026 Security Update

Serial Number: AV26-896
Date: September 8, 2026

As of September 8, 2026, Microsoft is affected by vulnerabilities in the following products:

• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS
• .NET 11.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 8.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 9.0 installed on Windows
• ASP.NET Core 10.0
• ASP.NET Core 11.0
• ASP.NET Core 8.0
• ASP.NET Core 9.0
• Azure AI Language Authoring
• Azure Arc SQL Server Extension
• Azure Cosmos DB
• Azure CycleCloud
• Azure HDInsight
• HEIF Image Extension
• HEVC Video Extensions
• HEVC Video Extensions for Licensed Applications
• HEVC Video Extensions from Device Manufacturer
• Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
• Microsoft .NET Framework 3.5 AND 4.7.2
• Microsoft .NET Framework 3.5 AND 4.8
• Microsoft .NET Framework 3.5 AND 4.8.1
• Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2
• Microsoft .NET Framework 4.8
• Microsoft .NET Framework 4.8.1
• Microsoft 365 Apps for Enterprise
• Microsoft Access 2016
• Microsoft Authentication Library (MSAL)
• Microsoft Authenticator for Android
• Microsoft Azure Active Directory B2C
• Microsoft Azure CLI
• Microsoft Copilot Studio
• Microsoft Discovery Studio
• Microsoft Dynamics 365 (on-premises)
• Microsoft Dynamics 365 Customer Engagement
• Microsoft Entra ID
• Microsoft Excel 2016
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019
• Microsoft Exchange Server Subscription Edition RTM
• Microsoft Fabric
• Microsoft Office 2016
• Microsoft Office 2019
• Microsoft Office 365 for Mac
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024
• Microsoft Office LTSC for Mac
• Microsoft Office for Android
• Microsoft Outlook 2016
• Microsoft Power Platform
• Microsoft PowerPoint 2016
• Microsoft Publisher 2016
• Microsoft SQL Server 2017
• Microsoft SQL Server 2019
• Microsoft SQL Server 2022
• Microsoft SQL Server 2025
• Microsoft SharePoint Server Subscription Edition
• Microsoft Teams for Android
• Microsoft Visual Studio 2022
• Microsoft Visual Studio 2026
• Microsoft Word 2016
• Microsoft.AspNetCore.OData
• Microsoft.Diagnostics.Runtime
• Office Online Server
• Power Automate agent for virtual desktops
• Power Automate for Desktop
• Raw Image Extension
• Remote Desktop client for Windows Desktop
• SQL Server Management Studio 22
• Skype for Business Server 2015
• Skype for Business Server 2019
• Skype for Business Server Subscription Edition CU1
• Spring Cloud Azure
• Visual Studio Code
• Web Media Extensions
• WebP Image Extension
• Windows 10
• Windows 11
• Windows Server 2012
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Microsoft has indicated that CVE-2026-81963 and CVE-2026-85880 have been exploited.

Update 1

On September 8, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-81963 and CVE-2026-85880 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• September 2026 Security Updates
• CISA KEV: CVE-2026-81963
• CISA KEV: CVE-2026-85880

Serial Number: AV26-888
Date: September 8, 2026

As of September 8, 2026, Adobe is affected by a vulnerability in the following products:

• Adobe Acrobat
  • Multiple versions
• Adobe Animate 2023
  • Prior to or equal to 2023.0.16
• Adobe Animate 2024
  • Prior to or equal to 0.14 
• Adobe Campaign Classic
  • Prior to or equal to ACC v7: 7.4.4 build 9401
• Adobe ColdFusion 2023
  • Prior to or equal to 2023.0.23
• Adobe ColdFusion 2025
  • Prior to or equal to 0.12 
• Adobe Commerce
  • All except Hotfix for CVE-2026-7565
  • Prior to or equal to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug
• Adobe Commerce B2B
  • All except Hotfix for CVE-2026-7565
  • Prior to or equal to 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug
• Adobe Experience Manager (AEM)
  • Prior to or equal to AEM Cloud Service (CS) Release 2026.7.0
  • Prior to or equal to 5 LTS Service Pack 2
  • Prior to or equal to 5 Service Pack 24 and earlier
• Adobe Illustrator 2025
  • Prior to or equal to 8.10
• Adobe Illustrator 2026
  • Prior to or equal to 7
• Adobe Photoshop 2025
  • Prior to or equal to 11.6
• Adobe Photoshop 2026
  • Prior to or equal to 6
• Magento Open Source
  • All except Hotfix for CVE-2026-7565
  • Prior to or equal to 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug

Adobe indicates that CVE-2026-75650 is exploited in the wild.

Update 1

On September 8, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-75650 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Adobe Product Security Incident Response Team
• CISA KEV: CVE-2026-75650

Serial Number: AV26-895
Date: September 8, 2026

As of September 8, 2026, Commvault is affected by vulnerabilities in the following product:

• Commvault Cloud
  • 11.36.0 Prior to 11.36.123
  • 11.40.0 Prior to 11.40.72
  • 11.44.0 Prior to 11.44.20
  • 11.46.0 Prior to 11.46.20

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CV_2026_07_1: Command Center API Authentication Bypass
• Commvault Cloud Security Advisories

Serial Number: AV26-894
Date: September 8, 2026

As of September 8, 2026, SAP_SE is affected by vulnerabilities in the following products:

• SAP Extended Passport (EPP) Processing – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 and 9.20
• SAP NetWeaver (Message Server) - versions KERNEL 9.16, 9.18, 9.19, and 9.20
• SAP Cloud Application Programming Model (CAP)
  • prior or equal to 1.183
  • prior or equal to 2.7.6
  • prior or equal to 3.9.6
  • prior or equal to 4.0.2
• SAP NetWeaver (SAP GUI for Java) - version BC-FES-JAV 8.10
• SAP Integration Suite
  • Version Cloud Integration - Trading Partner Management V2 2.9.2,
  • Version B2B Integration Factory - Cloud Integration - Trading Partner Management 1.10.0
• SAP NetWeaver Business Client – versions BC-WD-CLT-BUS 8.00 and 8.10
• SAP NetWeaver Application Server for ABAP and ABAP Platform – versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19 and 9.20

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• SAP Security Patch Day – September 2026

Serial Number: AV26-893
Date: September 8, 2026

As of September 8, 2026, Hitachi is affected by vulnerabilities in the following product:

• Cosminexus Component Container
  • Multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerability in Cosminexus
• Hitachi Vulnerability Information

Serial Number: AV26-892
Date: September 8, 2026

As of September 4, 2026, Inductive Automation is affected by a vulnerability in the following product:

• Ignition
  • Prior to or equal to 8.1.53

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CSAF/csaf_files/OT/white/2026/icsa-26-246-06.json at develop · cisagov/CSAF · GitHub
• Inductive Automation Ignition | CISA

Serial Number: AV26-891
Date: September 8, 2026

As of September 7, 2026, JetBrains is affected by vulnerabilities in the following products:

• GoLand
  • Prior to 2026.2.2.1
• Hub
  • Prior to 2026.2.52442
• IntelliJ IDEA
  • Prior to 2026.2.2
• YouTrack
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Fixed security issues

Serial Number: AV26-890
Date: September 8, 2026

As of September 8, 2026, Siemens is affected by vulnerabilities in the following products:

• Reyrolle 7SR5
  • Versions prior to V2.70
• Teamcenter
  • Multiple versions and models
• Siveillance Control
  • Multiple versions and models
• SIMATIC AX Runtime
  • Multiple versions and models
• Desigo CC Product Family
  • Multiple versions and models
• Industrial Edge Management
  • Multiple versions and models
• SIMOVE Fleetmanager and SIPLANT
  • Multiple versions and models

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• CERT Services | Siemens

Serial Number: AV26-889
Date: September 8, 2026

As of September 7, 2026, OpenVPN is affected by vulnerabilities in the following product:

• OpenVPN
  • Prior to or equal to 2.6.22
  • Prior to or equal to 2.7.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-84732 - Reliability layer unbounded TLS timeout and acks for non-outstanding packets
• Security Advisories & Updates | OpenVPN

Serial Number: AV26-886
Date: September 8, 2026

As of September 7, 2026, Dell is affected by vulnerabilities in the following products:

• Dell OpenManage Network Integration
  • Prior to 3.10 or later
• Dell iDRAC9
  • Versions prior to 7.30.10.50 and 7.00.00.184
• Dell iDRAC10
  • Prior to 1.30.30.50 or later
• Dell PowerEdge Server for Intel 2026
  • Multiple versions and models
• Dell Open Manage Python SDK (omsdk)
  • Prior to 1.2.519 or later
• Dell Avamar
  • Multiple versions
• Dell Networker Virtual Edition (NVE)
  • Multiple versions
• Dell PowerProtect DP Series Appliance
  • Multiple versions
• Dell Integrated Data Protection Appliance (IDPA)
  • Multiple versions
• Dell PowerScale OneFS
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Security Advisories, Notices and Resources | Dell Canada

Serial Number: AV26-884
Date: September 4, 2026

As of September 4, 2026, SonicWall is affected by vulnerabilities in the following product:

• Network Security Manager (NSM) On-Prem (VMWare, Hyper-V, Azure and KVM)
  • 4.3.0 and earlier versions

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• SonicWall NSM On-Prem Affected By Multiple Vulnerabilities
• Security Advisory

Serial Number: AV26-883
Date: September 4, 2026

As of September 3, 2026, Google is affected by vulnerabilities in the following product:

• Chrome
  • Prior to 152.0.7977.82

Google is aware that an exploit for CVE-2026-85046 exists in the wild.

Update 1

On September 4, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Stable Channel Update for Desktop
• CISA KEV: CVE-2026-85046

Serial Number: AV26-882
Date: September 3, 2026

As of September 3, 2026, SUSE is affected by vulnerabilities in the following product:

• Rancher
  • Prior to 2.15.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release v2.15.1 · rancher/rancher · GitHub
• SUSE Update Advisories

Serial Number: AV26-881
Date: September 3, 2026

As of September 3, 2026, Siemens is affected by a vulnerability in the following products:

• Mendix SAML (Mendix 10 compatible)
  • Prior to V4.2.3
• Mendix SAML (Mendix 11 compatible)
  • Prior to V4.2.3
• Mendix SAML (Mendix 9.24 compatible)
  • Prior to V3.6.27

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• SSA-887643: Account Hijacking Vulnerability in Mendix SAML module
• CERT Services | Siemens

Serial Number: AV26-880
Date: September 3, 2026

As of September 3, 2026, n8n is affected by vulnerabilities in the following product:

• n8n
  • Prior to 1.123.76
  • Prior to 2.35.4
  • Prior to 2.36.2
  • Prior to 2.37.7
  • Prior to 2.38.2

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Overview · n8n-io/n8n · GitHub

Serial Number: AV26-879
Date: September 3, 2026

As of September 2, 2026, AMD is affected by vulnerabilities in the following products:

• 2nd Gen AMD EPYC™ Processors
  • all except RomePI 1.0.0.H
• 3rd Gen AMD EPYC™ Processors
  • all except MilanPI 1.0.0.C
• 4th Gen AMD EPYC™ Processors
  • all except GenoaPI 1.0.0.8
• AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
  • all except ComboAM4 1.0.0.B
  • all except ComboAM4v2 1.2.0.B
• AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
  • all except PicassoPI-FP5 1.0.1.0
  • all except PollockPI-FT5 1.0.0.6
• AMD EPYC™ Embedded 3000
  • all except Snowyowl PI 1.1.0.B
• AMD EPYC™ Embedded 7002
  • all except EmbRomePI-SP3 1.0.0.B
• AMD EPYC™ Embedded 7003
  • all except EmbMilanPI-SP3 1.0.0.8
• AMD EPYC™ Embedded 9003
  • all except EmbGenoaPI-SP5 1.0.0.3
• AMD Instinct™ MI300A
  • all except MI300 SR5 PI 1.0.0.1
• AMD Radeon™ PRO V620 Graphics Products
  • all except Contact your AMD Customer Engineering representative
• AMD Ryzen™ 3000 Series Desktop Processors
  • all except ComboAM4 1.0.0.B
  • all except ComboAM4v2 1.2.0.B
• AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
  • all except PicassoPI-FP5 1.0.1.0
• AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
  • all except CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics
  • all except ComboAM4v2 1.2.0.B
• AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
  • all except RenoirPI-FP6 1.0.0.D
• AMD Ryzen™ 5000 Series Desktop Processors
  • all except ComboAM4v2 1.2.0.B
  • all except ComboAM4v2v 1.2.0.B
• AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
  • all except ComboAM4v2 1.2.0.B
• AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • all except CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics
  • all except CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
  • all except RembrandtPI-FP7 1.0.0.9b
• AMD Ryzen™ 7000 Series Processors
  • all except ComboAM5 1.0.0.7b
• AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • all except MendocinoPI-FT6 1.0.0.6
• AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
  • all except RembrandtPI-FP7 1.0.0.9b
• AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics
  • all except PhoenixPI-FP8-FP7 1.0.0.2
• AMD Ryzen™ 7045 Series Mobile Processors
  • all except DragonRangeFL1PI 1.0.0.3a
• AMD Ryzen™ Embedded 5000
  • all except EmbAM4PI 1.0.0.4
• AMD Ryzen™ Embedded R1000
  • all except EmbeddedPI-FP5 1.2.0.A
• AMD Ryzen™ Embedded R2000
  • all except EmbeddedPI-FP5 1.0.0.2
• AMD Ryzen™ Embedded V1000
  • all except EmbeddedPI-FP5 1.2.0.A
• AMD Ryzen™ Embedded V2000
  • all except EmbeddedPI-FP6 1.0.0.9
• AMD Ryzen™ Embedded V3000
  • all except EmbeddedPI-FP7r2 1.0.0.8
• AMD Ryzen™ Threadripper™ 3000 Series Processors
  • all except CastlePeakPI-SP3r3 1.0.0.A
• AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors
  • all except CastlePeakWSPI-sWRX8 1.0.0.C
  • all except ChagallWSPI-sWRX8 1.0.0.7
• AMD Ryzen™ Threadripper™ PRO 5000WX Processors
  • all except ChagallWSPI-sWRX8 1.0.0.7

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• AMD Processor Vulnerabilities
• AMD Product Security

Numéro de série : AV26-879
Date : 3 septembre 2026

En date du 2 septembre 2026, AMD est touché par des vulnérabilités dans les produits suivants :

• 2nd Gen AMD EPYC™ Processors
  • TOUS sauf RomePI 1.0.0.H
• 3rd Gen AMD EPYC™ Processors
  • TOUS sauf MilanPI 1.0.0.C
• 4th Gen AMD EPYC™ Processors
  • TOUS sauf GenoaPI 1.0.0.8
• AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
  • TOUS sauf ComboAM4 1.0.0.B
  • TOUS sauf ComboAM4v2 1.2.0.B
• AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
  • TOUS sauf PicassoPI-FP5 1.0.1.0
  • TOUS sauf PollockPI-FT5 1.0.0.6
• AMD EPYC™ Embedded 3000
  • TOUS sauf Snowyowl PI 1.1.0.B
• AMD EPYC™ Embedded 7002
  • TOUS sauf EmbRomePI-SP3 1.0.0.B
• AMD EPYC™ Embedded 7003
  • TOUS sauf EmbMilanPI-SP3 1.0.0.8
• AMD EPYC™ Embedded 9003
  • TOUS sauf EmbGenoaPI-SP5 1.0.0.3
• AMD Instinct™ MI300A
  • TOUS sauf MI300 SR5 PI 1.0.0.1
• AMD Radeon™ PRO V620 Graphics Products
  • TOUS sauf Contact your AMD \Customer Engineering representative
• AMD Ryzen™ 3000 Series Desktop Processors
  • TOUS sauf ComboAM4 1.0.0.B
  • TOUS sauf ComboAM4v2 1.2.0.B
• AMD Ryzen™ 3000 Series Mobile Processor with Radeon™ Graphics
  • TOUS sauf PicassoPI-FP5 1.0.1.0
• AMD Ryzen™ 3000 Series Processors with Radeon™ Graphics
  • TOUS sauf CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics
  • TOUS sauf ComboAM4v2 1.2.0.B
• AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
  • TOUS sauf RenoirPI-FP6 1.0.0.D
• AMD Ryzen™ 5000 Series Desktop Processors
  • TOUS sauf ComboAM4v2 1.2.0.B
  • TOUS sauf ComboAM4v2v 1.2.0.B
• AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
  • TOUS sauf ComboAM4v2 1.2.0.B
• AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • TOUS sauf CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics
  • TOUS sauf CezannePI-FP6 1.0.0.F
• AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
  • TOUS sauf RembrandtPI-FP7 1.0.0.9b
• AMD Ryzen™ 7000 Series Processors
  • TOUS sauf ComboAM5 1.0.0.7b
• AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • TOUS sauf MendocinoPI-FT6 1.0.0.6
• AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics
  • TOUS sauf RembrandtPI-FP7 1.0.0.9b
• AMD Ryzen™ 7040 Series Processors with Radeon™ Graphics
  • TOUS sauf PhoenixPI-FP8-FP7 1.0.0.2
• AMD Ryzen™ 7045 Series Mobile Processors
  • TOUS sauf DragonRangeFL1PI 1.0.0.3a
• AMD Ryzen™ Embedded 5000
  • TOUS sauf EmbAM4PI 1.0.0.4
• AMD Ryzen™ Embedded R1000
  • TOUS sauf EmbeddedPI-FP5 1.2.0.A
• AMD Ryzen™ Embedded R2000
  • TOUS sauf EmbeddedPI-FP5 1.0.0.2
• AMD Ryzen™ Embedded V1000
  • TOUS sauf EmbeddedPI-FP5 1.2.0.A
• AMD Ryzen™ Embedded V2000
  • TOUS sauf EmbeddedPI-FP6 1.0.0.9
• AMD Ryzen™ Embedded V3000
  • TOUS sauf EmbeddedPI-FP7r2 1.0.0.8
• AMD Ryzen™ Threadripper™ 3000 Series Processors
  • TOUS sauf CastlePeakPI-SP3r3 1.0.0.A
• AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors
  • TOUS sauf CastlePeakWSPI-sWRX8 1.0.0.C
  • TOUS sauf ChagallWSPI-sWRX8 1.0.0.7
• AMD Ryzen™ Threadripper™ PRO 5000WX Processors
  • TOUS sauf ChagallWSPI-sWRX8 1.0.0.7

Le Centre pour la cybersécurité encourage les utilisateurs et les administrateurs à consulter les liens fournis et à installer les mises à jour nécessaires, dès qu'elles sont disponibles.

• AMD Processor Vulnerabilities (en anglais seulement)
• AMD Product Security (en anglais seulement)

Serial Number: AV26-878
Date: September 3, 2026

As of September 2, 2026, F5 is affected by vulnerabilities in the following products:

• BIG-IP (all modules)
  • Prior to 17.1.3.4
  • Prior to 17.5.1.8
  • Prior to 21.0.0.3
  • Prior to 21.1.0.1

• BIG-IQ
  • Prior to 8.4.2.1

• NGINX Gateway Fabric
  • Prior to 2.6.8

• NGINX Ingress Controller
  • Prior to 2026-lts-r5
  • Prior to 5.6.0

• NGINX JavaScript
  • 9.9
  • Prior to 1.0.1
• APM Clients
  • Prior to 7.2.6

• BIG-IP APM
  • Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• K000162872: Out-of-band Security Notification (September 2, 2026)

Serial Number: AV26-877
Date: September 3, 2026

As of September 2, 2026, Jenkins Project is affected by vulnerabilities in the following products:

• Jenkins
  • ALL except 2.568.3
  • ALL except 2.580

• Jenkins Allure Plugin
  • Prior to or equal to 2.35.2

• Jenkins Customizable Header Plugin
  • Prior to or equal to 295.v2544b_ca_19b_97

• Jenkins File Parameter Plugin
  • Prior to or equal to 425.v3fa_801681b_5e

• Jenkins GitLab Plugin
  • Prior to or equal to 1.9.16

• Jenkins LDAP Plugin
  • Prior to or equal to 807.809.vd3a_4e5e4ec98

• Jenkins Microsoft Entra ID (previously Azure AD) Plugin
  • Prior to or equal to 710.v0b_ff8e9cc2d2

• Jenkins Parameterized Remote Trigger Plugin
  • Prior to or equal to 3.2.2

• Jenkins Performance Plugin
  • Prior to or equal to 1015.v09ca_52b_3370e

• Jenkins Pipeline: Build Step Plugin
  • Prior to or equal to 599.v4b_67ea_11b_152

• Jenkins SAML Plugin
  • Prior to or equal to 4.618.v441a_27fa_46d2

• Jenkins Script Security Plugin
  • Prior to or equal to 1412.v7737b_3405f86

• Jenkins TICS Plugin
  • Prior to or equal to 2025.1.1

• Jenkins ThinBackup Plugin
  • Prior to or equal to 2.1.4

• Jenkins XebiaLabs XL Deploy Plugin
  • Prior to or equal to 26.1.0

• Jenkins update-center2
  • Prior to or equal to 3.18.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Jenkins Security Advisory 2026-09-02
• Security Advisories

Serial Number: AV26-876
Date: September 3, 2026

As of September 2, 2026, Cisco is affected by vulnerabilities in the following products:

• Cisco IOS XR Software
  • Multiple versions

• Cisco Nexus 9000 Series Switches
  • Multiple products

• Cisco Desk Phone 9800 Series and Video Phone 8875
  • Prior to 5.0(1)
• IP Phone 7800 and 8800
  • Prior to 14.4(1)SR3

• IP Phone 8845 and 8865
  • Prior to14.4(1)SR4

• Wireless IP Phone 8821
  • Prior to 11.0(6)SR8

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
• Cisco IOS XR Software Security Hardening Release: September 2026
• Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
• Cisco Security Advisories

Serial Number: AV26-872
Date: September 2, 2026

As of September 1, 2026, SonicWall is affected by a vulnerability in the following product:

• SMA1000 - 6210, 7210, 8200v
  • 12.4.3-03453 (platform-hotfix) and older versions
  • 12.5.0-02835 (platform-hotfix) and older versions

SonicWall indicates that CVE-2026-83548 and CVE-2026-83549 are being exploited.

Update 1

On September 2, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-83548 and CVE-2026-83549 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory
• SonicWall Security Advisories
• CISA KEV: CVE-2026-83548
• CISA KEV: CVE-2026-83549