Serial number: AV26-746
Date: July 24, 2026
On July 23, 2026, Progress published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-745
Date: July 24, 2026
On July 24, 2026, HPE published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-744
Date: July 24, 2026
On July 22, 2026, MongoDB published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-743
Date: July 24, 2026
On July 24, 2026, Ericsson published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-742
Date: July 24, 2026
On July 24, 2026, Moxa published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-741
Date: July 24, 2026
On July 23, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-740
Date: July 24, 2026
On July 23, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-739
Date: July 23, 2026
On July 23, 2026, JetBrains published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–698
Date: July 14, 2026
Updated: July 23, 2026
On July 14, 2026, Microsoft published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
Microsoft has indicated that CVE-2026-56164 and CVE-2026-56155 are being exploited.
On July 14, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-56164 and CVE-2026-56155 to their Known Exploited Vulnerabilities (KEV) Database.
On July 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-58644 to their Known Exploited Vulnerabilities (KEV) Database.
Open-source reporting indicates that CVE-2026-50522 is being exploited in the wild.
On July 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-50522 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-735
Date: July 22, 2026
Updated: July 23, 2026
On July 22, 2026, Check Point published a security advisory to address vulnerabilities in the following products. Included was a critical update for the following :
Check Point is aware that CVE-2026-16232 is being exploited in the wild.
On July 22, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16232 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Serial number: AV26-738
Date: July 22, 2026
On July 22, 2026, Drupal published security advisories to address a vulnerability in the following product. Included was a critical update for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates or perform the suggested mitigations.
Serial number: AV26-737
Date: July 22, 2026
On July 22, 2026, Exim published a security advisory to address a vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-736
Date: July 22, 2026
On July 21, 2026, Progress published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-734
Date: July 22, 2026
On July 22, 2026, Mitel published security advisories to address vulnerabilities in the following products. Included were critical updates for the following::
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-733
Date: July 22, 2026
On July 22, 2026, n8n published security advisories to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary update.
Serial number: AV26-732
Date: July 22, 2026
On July 22, 2026, ISC published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-731
Date: July 22, 2026
On July 21, 2026, Atlassian published a security advisory to address vulnerabilities, including some critical ones, in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-730
Date: July 22, 2026
On July 21, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-729
Date: July 22, 2026
On July 21, 2026, Oracle published a security advisory to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-728
Date: July 22, 2026
On July 21, 2026, SolarWinds published security advisories to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-727
Date: July 22, 2026
On July 21, 2026, HPE published security advisories to address vulnerabilities in the following products. Include was a critical update for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-723
Date: July 20, 2026
Date: July 21, 2026
On July 17, 2026, WordPress published a security advisory to address vulnerabilities in the following product:
Open-source reporting indicates that CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild.
On July 21, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-60137 and CVE-2026-63030 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-726
Date: July 21, 2026
On July 21, 2026, Mozilla published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-725
Date: July 21, 2026
On July 21, 2026, Zyxel published a security advisory to address a vulnerability in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-724
Date: July 21, 2026
On July 20, 2026, Tenable published a security advisory to address critical vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-722
Date: July 20, 2026
On July 20, 2026, HPE published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-693
Date: July 14, 2026
Updated: July 20, 2026
On July 13, 2026, ServiceNow published a security advisory to address a critical vulnerability in the following products:
Open-source reporting indicates that CVE-2026-6875 is being exploited in the wild.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-721
Date: July 20, 2026
On July 20, 2026, Zimbra published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-720
Date: July 20, 2026
On July 16, 2026, GitHub published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-719
Date: July 20, 2026
Between July 13 and 19, 2026, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26–718
Date: July 20, 2026
Between July 13 and 19, 2026, CISA published ICS advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations, and apply the necessary updates if available.
Serial number: AV26-717
Date: July 20, 2026
Between July 13 and 19, 2026, Ubuntu published security notices to address vulnerabilities in the Linux kernel affecting the following products:
The Cyber Centre encourages users and administrators to review the web link provided and apply the necessary updates.
Serial number: AV26-716
Date: July 20, 2026
Between July 13 and 19, 2026, Dell published security advisories to address vulnerabilities in multiple products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-715
Date: July 20, 2026
Between July 13 and 19, 2026, IBM published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-714
Date: July 17, 2026
On July 16, 2026, Microsoft published a security update to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.
Serial number: AV26-713
Date: July 17, 2026
On July 16, 2026, Google published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates, when available.
Serial number: AV26-712
Date: July 17, 2026
On July 14, 2026, Broadcom published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following:
The Cyber Centre encourages users and administrators to review the web links provided and apply the necessary updates.
Serial number: AV26-711
Date: July 17, 2026
On July 17, 2026, FreePBX published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.
Serial number: AV26-351
Date: April 14, 2026
Updated: July 16, 2026
On April 14, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
Open-source reporting indicates that CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 have been exploited.
On July 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-39808 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-568
Date: June 9, 2026
Updated: July 16, 2026
On June 9, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following:
On July 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-25089 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-710
Date: July 16, 2026
On July 15, 2026, Grafana published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-709
Date: July 16, 2026
On July 14, 2026, JetBrains published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following products:
The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.
Serial number: AV26-708
Date: July 16, 2026
On July 15, 2026, Splunk published security advisories to address vulnerabilities in the following products. Included were critical updates for the following:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-707
Date: July 16, 2026
On July 14, 2026, Zoom published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.
Serial number: AV26-706
Date: July 15, 2026
On July 15, 2026, Cisco published security advisories to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.
Serial number: AV26-526
Date: May 29, 2026
Updated: July 15, 2026
On May 28, 2026, Oracle published a security advisory to address critical vulnerabilities in the following products:
Open-source reporting indicates that CVE-2026-46817 is being exploited.
On July 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46817 to their Known Exploited Vulnerabilities (KEV) Database.
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.
Number: AL26-017
Date: July 15, 2026
This Alert is intended for IT professionals and managers.
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security (Cyber Centre) is also available to provide additional assistance regarding the content of this Alert upon request.
The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting Microsoft SharePoint Server. In response to the Microsoft security advisory, released on July 14, 2026Footnote 1, the Cyber Centre issued AV26-698Footnote 2 on July 14, 2026.
Tracked as CVE-2026-55164Footnote 3, this vulnerability is a Missing Authentication for Critical Function (CWE-306)Footnote 4 vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to elevate privileges over a network.
Tracked as CVE-2026-55040Footnote 5Footnote 6, this vulnerability is a Weak Authentication (CWE-1390)Footnote 7 vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to bypass a security feature over a network.
Tracked as CVE-2026-58644Footnote 8, this vulnerability is a Deserialization of Untrusted Data (CWE-502)Footnote 9 vulnerability affecting multiple versions of Microsoft SharePoint Server, that could allow an unauthorized attacker to execute code over a network.
Microsoft is aware of exploitation of CVE-2026-56164 and other previously released SharePoint related vulnerabilities. CVE-2026-56164 was added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalogFootnote 10 on July 14, 2026.
The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:
| Affected product | Affected versions | Fixed versions |
|---|---|---|
| Microsoft SharePoint Enterprise Server 2016 | 16.0.0 before 16.0.5561.1001 | 16.0.5561.1001 |
| Microsoft SharePoint Server 2019 | 16.0.0 before 16.0.10417.20175 | 16.0.10417.20175 |
| Microsoft SharePoint Server Subscription Edition | 16.0.0 before 16.0.19725.20434 | 16.0.19725.20434 |
The Cyber Centre recommends organizations:
Important note: Microsoft SharePoint Enterprise Server 2016Footnote 11 and Server 2019Footnote 12 are end of life as of July 14, 2026. Organizations are urged to migrate to a supported version.
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre's Top 10 IT Security Actions with an emphasis on the following topicsFootnote 13.
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal or email contact@cyber.gc.ca.
Serial number: AV26-705
Date: July 15, 2026
On July 14, 2026, Tenable published a security advisory to address a critical vulnerability in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-704
Date: July 15, 2026
On July 15, 2026, F5 published a security advisory to address vulnerabilities in the following products:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
Serial number: AV26-703
Date: July 15, 2026
On July 14, 2026, Notepad++ published a security advisory to address vulnerabilities in the following product:
The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.