Alerts and advisories

OpenBSD security advisory (AV26-1130) - Update 1

2026-11-09T18:34:02Z

Serial number: AV26-1130
Date: November 5, 2026
Updated: November 9, 2026

As of November 5, 2026, OpenBSD is affected by a vulnerability in the following product:

OpenSSH
- Prior to 10.6p2

Update 1

On November 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-123158 to their Known Exploited Vulnerabilities (KEV) Catalog

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Barracuda Networks security advisory (AV26-1112) – Update 1

2026-11-09T14:45:19Z

Serial Number: AV26-1112
Date: November 2, 2026
Updated: November 9, 2026

As of November 2, 2026, Barracuda Networks is affected by a vulnerability in the following products:

Barracuda Email Security Gateway (ESG)
- Prior to 9.4.0.030
Barracuda Load Balancer Application Delivery Controller (ADC)
- Prior to 6.4.0
Barracuda Web Application Firewall (WAF)
- Prior to 11.0.1
Barracuda Web Security Gateway (WSG)
- Prior to 16.1.100.100
Barracuda Message Archiver (BMA)
- Prior to 5.5.4.0
Barracuda WAF Control Center (WCC)
- Prior to 2.2.1

Update 1

Open source reporting indicates that CVE-2026-116606 is exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Red Hat security advisory (AV26-1136)

2026-11-09T14:33:03Z

Serial number: AV26-1136
Date: November 9, 2026

As of November 4, 2026, Red Hat is affected by vulnerabilities in the following products:

Exploit Intelligence
- All version
OpenShift Serverless
- All version
Red Hat AMQ Broker 7
- All version
Red Hat Ansible Automation Platform 2
- All version
Red Hat Ansible Automation Platform Ansible Core 2
- All version
Red Hat Build of Keycloak
- All version
Red Hat Enterprise Linux 10 / 6 / 7 / 8 and 9
- All version
Red Hat Fuse 7
- All version
Red Hat Hardened Images
- All version
Red Hat JBoss Enterprise Application Platform 7 and 8
- All version
Red Hat JBoss Enterprise Application Platform Expansion Pack
- All version
Red Hat OpenShift AI (RHOAI)
- All version
Red Hat OpenShift Container Platform 4 and 5
- All version
Red Hat OpenShift Container Platform 5
- All version
Red Hat OpenShift Dev Spaces
- All version
Red Hat Satellite 6
- All version
Red Hat Single Sign-On 7
- All version
Red Hat build of Apache Camel 4 for Quarkus 3
- All version
Red Hat build of Apicurio Registry 3
- All version
Red Hat build of Debezium 3
- All version
Red Hat build of Keycloak 26.4
- Prior to 26.4-29
- Prior to 26.4-30
- Prior to 26.4.17-2
Red Hat build of Keycloak 26.4.17
- All version
Red Hat build of Keycloak 26.6
- Prior to 26.6-24
- Prior to 26.6.8-2
Red Hat build of Keycloak 26.6.8
- All version
Red Hat build of Quarkus
- All version
Self-service automation portal 2
- All version
ansible-core
- Prior to 2.23.0
gst-plugins-good
- Prior to 1.28.2

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Red Hat Security Advisories

IBM security advisory (AV26-1135)

2026-11-09T14:07:01Z

Serial number: AV26-1135
Date: November 9, 2026

As of November 4, 2026, IBM is affected by vulnerabilities in the following products:

IBM MQ
- Prior to or equal to 10.0.0.5 LTS and CD
- Prior to or equal to 9.2.0.44 LTS
- Prior to or equal to 9.3.0.42 LTS
- Prior to or equal to 9.4.0.26 LTS
- Prior to or equal to 9.4.5.1 CD
IBM Watson Speech Services Cartridge
- Prior to or equal to 5.4.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Dell security advisory (AV26-1134)

2026-11-09T13:54:39Z

Serial number: AV26-1134
Date: November 9, 2026

As of November 2, 2026, Dell is affected by vulnerabilities in the following products:

Alienware Command Center (AWCC)
- Prior to 6.14.54.0
Wyse Management Suite
- Prior to 2609.0.0.155

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

SonicWall security advisory (AV26-1133)

2026-11-06T21:00:51Z

Serial number: AV26-1133

Date: November 6, 2026

As of November 6, 2026, SonicWall is affected by a vulnerability in the following product:

SonicOS
- prior to 7.3.4-7013
- prior to 8.2.2-8015

SonicWall indicates that CVE-2026-19868 is being exploited.

On November 6, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to their Known Exploited Vulnerabilities (KEV) Catalog.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

JetBrains security advisory (AV26-1132)

2026-11-06T19:23:12Z

Serial Number: AV26-1132
Date: November 6, 2026

As of November 6, 2026, JetBrains is affected by vulnerabilities in the following products:

CLion
- Prior to 2026.3
  Prior to 2026.2.4.1
Datalore
- Prior to 2026.4
- Prior to 2026.2.4
Hub
- Prior to 2026.2.52519
- Prior to 2026.2.52556
IntelliJ IDEA
- Multiple versions
Ktor
- Prior to 3.6.1
YouTrack
- Multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Mozilla security advisory (AV26-1131)

2026-11-06T13:48:46Z

Serial number: AV26-1131
Date: November 6, 2026

As of November 3, 2026, Mozilla is affected by a vulnerability in the following product:

Firefox
- Prior to 159.0.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Rubyonrails security advisory (AV26-1129)

2026-11-05T15:41:50Z

Serial number: AV26-1129
Date: November 5, 2026

As of November 4, 2026, Rubyonrails is affected by a vulnerability in the following product:

Active Storage
- Prior to 8.0.5.2
- Prior to 8.1.4.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Android security advisory – November 2026 monthly rollup (AV26-1128)

2026-11-04T20:03:06Z

Serial number: AV26-1128
Date: Novembre 4, 2026

As of November 2, 2026, Android published a security bulletin to address vulnerabilities affecting Android devices.

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Android Security Bulletin—November 2026

Cisco security advisory (AV26-1127)

2026-11-04T19:57:39Z

Serial number: AV26-1127
Date: November 4, 2026

As of November 4, 2026, Cisco is affected by vulnerabilities in the following product:

Cisco Unified Computing System (USC) Central Software
- Prior to 2.1(2c)

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

GitHub security advisory (AV26-1126)

2026-11-04T19:50:51Z

Serial number: AV26-1126
Date: November 4, 2026

As of November 3, 2026, GitHub is affected by vulnerabilities in the following product:

Enterprise Server
- 3.19.0 Prior to 3.19.14
- 3.20.0 Prior to 3.20.10
- 3.21.0 Prior to 3.21.8
- 3.22.0 Prior to 3.22.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

WatchGuard security advisory (AV26-1125)

2026-11-04T19:39:34Z

Serial number: AV26-1125
Date: November 4, 2026

As of November 4, 2026, WatchGuard is affected by vulnerabilities in the following product:

AuthPoint Authentication Gateway
- Prior to 7.6.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

SolarWinds security advisory (AV26-1124)

2026-11-04T19:38:21Z

Serial number: AV26-1124
Date: November 4, 2026

As of November 3, 2026, SolarWinds is affected by vulnerabilities in the following product:

Dameware
- Prior to or equal to 2026.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Docker security advisory (AV26-1123)

2026-11-04T19:36:26Z

Serial number: AV26-1123
Date: November 4, 2026

As of November 3, 2026, Docker is affected by vulnerabilities in the following products:

Docker Buildx
- Prior to 0.37.2
Docker Desktop
- Prior to 4.98.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

MongoDB security advisory (AV26-1122)

2026-11-04T19:26:51Z

Serial number: AV26-1122
Date: November 4, 2026

As of November 3, 2026, MongoDB is affected by vulnerabilities in the following product:

C Driver
- Prior to 1.30.15
- Prior to 2.5.8

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

[Control Systems] Phoenix Contact security advisory (AV26-1121)

2026-11-04T19:15:29Z

Serial number: AV26-1121
Date: November 4, 2026

As of November 4, 2026, Phoenix Contact is affected by vulnerabilities in the following product:

PLCnext Engineer
- Prior to 2026.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Tanium security advisory (AV26-1120)

2026-11-04T19:12:46Z

Serial number: AV26-1120
Date: November 4, 2026

As of November 3, 2026, Tanium is affected by vulnerabilities in the following product:

Threat Response
- Prior to 4.12.353
- Prior to 4.17.333
- Prior to 4.9.480

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Zyxel security advisory (AV26-1114) – Update 1

2026-11-04T15:07:31Z

Serial number: AV26-1114
Date: November 3, 2026
Updated: November 4, 2026

As of November 3, 2026, Zyxel is affected by vulnerabilities in the following products:

Zyxel GS1900 series switches
- Multiple versions and models
Zyxel APs, FWA7, and Security Routers
- Multiple versions and models

Update 1
Open-source reporting indicates that CVE-2026-107441 is exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

HPE security advisory (AV26-1119)

2026-11-04T14:50:15Z

Serial number: AV26-1119
Date: November 4, 2026

As of November 3, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following products:

HPE Networking Fabric Composer (AFC)
- Prior to 7.3.5
- Prior to 7.4.1
HPE Networking Virtual Intranet Access (VIA)
- Prior to 4.7.9

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Google security advisory (AV26-1118)

2026-11-04T14:39:02Z

Serial number: AV26-1118
Date: November 4, 2026

As of November 3, 2026, Google is affected by vulnerabilities in the following product:

Stable Channel Chrome for Desktop
- Versions prior to 157.0.8103.38/.39 (Windows/Mac), and 157.0.8103.38 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Google Chrome Security Advisory

WordPress security advisory (AV26-1117)

2026-11-03T21:36:07Z

Serial number: AV26-1117
Date: November 3, 2026

As of October 31, 2026, WordPress is affected by a vulnerability in the following product:

WordPress Core
- Prior to 7.1.4

On November 3, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-119977 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Progress Software security advisory (AV26-1116)

2026-11-03T14:46:33Z

Serial number: AV26-1116
Date: November 3, 2026

As of October 29, 2026, Progress Software is affected by a vulnerability in the following product:

WS_FTP Server
- Prior to 2024.0.6
- Prior to 2025.0.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

[Control systems] Siemens security advisory (AV26-802) – Update 1

2026-11-03T14:39:43Z

Serial Number: AV26-802
Date: August 11, 2026
Updated: November 3, 2026

As of August 11, 2026, Siemens is affected by vulnerabilities in the following products:

Desigo DXR2
- Prior to V01.21.233.16-7862
Desigo PXC3
- Prior to V01.21.233.16-7862
Desigo PXC4
- Prior to V02.21.194.36-2715
Desigo PXC5.E003
- Prior to V02.21.194.36-2715
Desigo PXC5.E24
- Prior to V02.21.194.36-2715
Desigo PXC7
- Prior to V02.21.194.36-2715
LOGO! Soft Comfort
- Prior to V9
Parasolid V38.0
- Prior to V38.0.235
Parasolid V38.1
- Prior to V38.1.230
SIMATIC IoT2050 Advanced
- Prior to V4.3.4.1
Siemens License Server (SLS)
- Prior to V5.1
- Prior to V5.3
Simcenter Femap
- Prior to V2606.0001
Simcenter Nastran
- Prior to V2606
Solid Edge SE2025
- Prior to V225.0 Update 15
Solid Edge SE2026
- Prior to V226.0 Update 7

Update 1
Open source reporting indicates that CVE-2026-58115 is exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available

CERT Services | Siemens

PostgreSQL security advisory (AV26-1115)

2026-11-03T14:24:43Z

Serial number: AV26-1115
Date: November 3, 2026

As of November 2, 2026, PostgreSQL is affected by vulnerabilities in the following product:

psqlODBC
- Prior to 18.00.0006

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

SUSE Linux security advisory (AV26-1113)

2026-11-02T18:25:26Z

Serial Number: AV26-1113
Date: November 2, 2026

As of November 2, 2026, SUSE is affected by a vulnerability in the following product:

Rancher
- Prior to 2.11.19
- Prior to 2.12.15
- Prior to 2.13.11
- Prior to 2.14.7
- Prior to 2.15.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Red Hat security advisory (AV26-1111)

2026-11-02T14:36:56Z

Serial number: AV26-1111
Date: November 2, 2026

As of October 30, 2026, Red Hat is affected by vulnerabilities in the following products:

Red Hat Build of Keycloak
- All version
Red Hat Enterprise Linux 10
- All version
Red Hat Enterprise Linux 6
- All version
Red Hat Enterprise Linux 7
- All version
Red Hat Enterprise Linux 8
- All version
Red Hat Enterprise Linux 9
- All version
Red Hat Fuse 7
- All version
Red Hat Hardened Images
- All version
Red Hat JBoss Enterprise Application Platform 7
- All version
Red Hat JBoss Enterprise Application Platform 8
- All version
Red Hat JBoss Enterprise Application Platform Expansion Pack
- All version
Red Hat OpenShift Container Platform 4
- All version
Red Hat OpenShift Container Platform 5
- All version
Red Hat Single Sign-On 7
- All version
Red Hat build of Apache Camel for Spring Boot 4
- All version

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Red Hat Security Advisories

Dell security advisory (AV26-1110)

2026-11-02T14:23:12Z

Serial number: AV26-1110
Date: November 2, 2026

As of October 30, 2026, Dell is affected by vulnerabilities in the following products:

OpenManage Enterprise
- Prior to 4.8.0
PowerProtect Data Domain
- Prior to 7.13.1.90
- Prior to 8.3.1.50
- Prior to 8.6.1.30
- Prior to 8.9.0.0
PowerProtect Data Domain Management Center
- Prior to 7.13.1.90
- Prior to 8.3.1.50
- Prior to 8.6.1.30
- Prior to 8.9.0.0
PowerProtect Data Domain Virtual Edition
- Prior to 7.13.1.90
- Prior to 8.3.1.50
- Prior to 8.6.1.30
- Prior to 8.9.0.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Google security advisory (AV26-1109)

2026-11-02T14:12:04Z

Serial number: AV26-1109
Date: November 2, 2026

As of October 29, 2026, Google is affected by vulnerabilities in the following product:

Stable Channel Chrome for Desktop
- Versions prior to 156.0.8078.79/.80 (Windows/Mac), and 156.0.8078.79 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Google Chrome Security Advisory

Linux security advisory (AV26-1108)

2026-10-30T21:34:05Z

Serial Number: AV26-1108
Date: October 30, 2026

As of October 15, 2026, Linux is affected by a vulnerability in the following product:

Linux Kernel
- Prior to 5.10.272
- Prior to 5.15.223
- Prior to 6.1.190
- Prior to 6.6.159
- Prior to 6.12.113
- Prior to 6.18.56
- Prior to 7.2.10
- Prior to 7.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Ivanti security advisory (AV26-1035) - Update 2

2026-10-30T18:01:12Z

Serial number: AV26-1035
Date: October 13, 2026
Updated: October 30, 2026

As of October 13, 2026, Ivanti is affected by vulnerabilities in the following products:

Ivanti Connect Secure
- Versions prior to 25.1.1.3
- Versions prior to 25.1.3.1
- Versions prior to 22.8R2.6
Ivanti Neurons Patch for Intune
- Versions prior to September 16, 2026
Ivanti Xtraction
- Versions prior to 2026.4

On October 13, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to their Known Exploited Vulnerabilities (KEV) Database.

Update 1

Open-source reporting indicates that CVE-2026-111357 is being exploited in the wild.

Update 2

On October 30, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111357 and CVE-2026-118527 to their Known Exploited Vulnerabilities (KEV) Catalog.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

MongoDB security advisory (AV26-1107)

2026-10-30T15:53:31Z

Serial Number: AV26-1107
Date: October 30, 2026

As of October 28, 2026, MongoDB is affected by vulnerabilities in the following product:

Laravel MongoDB
- Prior to 5.12.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

HashiCorp security advisory (AV26-1106)

2026-10-30T15:49:12Z

Serial Number: AV26-1106
Date: October 30, 2026

As of October 29, 2026, HashiCorp is affected by vulnerabilities in the following products:

Nomad
- Prior to 2.1.0
Nomad Enterprise
- Prior to 2.1.0
- Prior to 1.11.12
- Prior to 1.10.18
Boundary
- Prior to 1.0.2
Boundary Enterprise
- Prior to 1.0.2 and 0.21.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Drupal security advisory (AV26-1105)

2026-10-30T15:43:17Z

Serial number: AV26-1105
Date: October 30, 2026

As of October 28, 2026, Drupal is affected by a vulnerability in the following product:

Commerce Core
- Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13

Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Cisco security advisory (AV26-1102) - Update 1

2026-10-29T20:20:34Z

Serial number: AV26-1102
Date: October 29, 2026

As of October 28, 2026, Cisco is affected by a vulnerability in the following products:

Cisco Secure Firewall Adaptive Security Appliance (ASA)
- Versions prior to 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.4, 9.24.1.27 and 9.24.10.1
Cisco Secure Firewall Threat Defense (FTD)
- Versions prior to 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1
Cisco Network Management and Provisioning License (Smart Software Manager) On-Prem
- Versions prior to 10-202610

Cisco indicates that CVE-2026-76418 is exploited in the wild.

Update 1
On October 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-76418 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

GitLab security advisory (AV26-1028) - Update 1

2026-10-29T20:14:55Z

Serial number: AV26-1028
Date: October 13, 2026
Updated: October 29, 2026

As of October 12, 2026, GitLab is affected by vulnerabilities in the following product:

GitLab
- Prior to 19.2.8
- Prior to 19.3.5
- Prior to 19.4.2

Update 1
On October 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229 to their Known Exploited Vulnerabilities (KEV) Catalog.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Mattermost security advisory (AV26-1104)

2026-10-29T14:04:33Z

Serial number: AV26-1104
Date: October 29, 2026

As of October 28, 2026, Mattermost is affected by a vulnerability in the following product:

Mattermost
- Prior to or equal to 11.10.0
- Prior to or equal to 11.9.2
- Prior to or equal to 11.8.6
- Prior to or equal to 11.7.11

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Mattermost Security Updates

n8n security advisory (AV26-1103)

2026-10-29T13:55:57Z

Serial number: AV26-1103
Date: October 29, 2026

As of October 28, 2026, n8n is affected by vulnerabilities in the following product:

n8n
- Prior to 2.44.1
- Prior to 2.43.5

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

VMware security advisory (AV26-763) – Update 2

2026-10-28T19:53:28Z

Serial number: AV26-763
Date: July 30, 2026
Updated: October 28, 2026

As of July 30, 2026, VMware is affected by vulnerabilities in the following products:

Cloud Foundation
- 5.x
- 9.0.x.x
- 9.1.x.x
- Prior to 5.2.3
ESX
- Prior to ESXi-9.0.2.0100-25595025
- Prior to ESXi-9.1.0.0-25370933
- Prior to ESXi-9.1.0.0200-25557999
- Prior to ESXi80U3i-25205845
- Prior to ESXi80U3k-25595708
Fusion
- Prior to 26H1
Telco Cloud Infrastructure
- 3.0
Telco Cloud Platform
- 4.x
- 5.0.x
- 5.1.x
Workstation
- Prior to 26H1
vCenter
- Prior to 8.0 U3k
- Prior to 9.0.2.0100
- Prior to 9.1.0.0300
vSphere Foundation
- 9.0.x.x
- 9.1.x.x

Update 2

On October 28, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709 to their Known Exploited Vulnerabilities (KEV) Database.

Update 1

On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-59310 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Juniper Networks security advisory (AV26-1101)

2026-10-28T19:30:45Z

Serial number: AV26-1101
Date: October 28, 2026

As of October 28, 2026, Juniper Networks is affected by vulnerabilities in the following products:

Session Smart Conductor
- Prior to 7.0.5
- Prior to 7.1.7
- Prior to 7.2.3
Session Smart Router
- Prior to 7.0.5
- Prior to 7.1.7
- Prior to 7.2.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Mozilla security advisory (AV26-1100)

2026-10-28T19:17:01Z

Serial number: AV26-1100
Date: October 28, 2026

As of October 27, 2026, Mozilla is affected by vulnerabilities in the following products:

Firefox
- Prior to 159
Firefox ESR
- Prior to 115.44
- Prior to 153.6
Thunderbird
- Prior to 159
- Prior to 153.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Apple security advisory (AV26-1099)

2026-10-28T19:05:56Z

Serial number: AV26-1099
Date: October 28, 2026

As of October 26, 2026, Apple is affected by vulnerabilities in the following products:

iOS and iPadOS
- Prior to 18.7.11
- Prior to 26.7.2
- Prior to 27.2
MacOS (Golden Gate/Tahoe/Sequoia)
- Prior to 27.2
- Prior to 26.7.2
- Prior to 15.8.2
visionOS
- Prior to 27.2
tvOS
- Prior to 27.2
watchOS
- Prior to 27.2
Safari
- Prior to 27.2

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Apple security releases - Apple Support

AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations

2026-10-28T18:49:45Z

Serial number: AV26-028
Date: October 28, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of an ongoing voice phishing (vishing) campaign targeting Canadian organizations, including organizations in the legal and financial sectors. Multiple Canadian firms have been targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages. The tradecraft and infrastructure are consistent with publicly reported operations by a financially motivated threat actor ^{Footnote 1}^{Footnote 2}.

Throughout 2026, this activity has shifted across sectors, increasingly targeting finance and legal organizations since July ^{Footnote 1}. The Cyber Centre has identified related infrastructure naming Canadian organizations since January, with October activity concentrated on the legal sector. The campaign bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains, limiting the effectiveness of blocklists.

Initial Access

Help desk voice phishing: Callers impersonate internal IT or help desk staff and claim an urgent passkey migration, MFA enrolment or password change is required. Calls may target personal mobile phones, office phones or Microsoft Teams, and may spoof legitimate help desk numbers. Callers may reference internal IT staff or missed deadlines to add credibility and may end the call if the employee attempts independent verification ^{Footnote 1}.
Organisation-branded adversary-in-the-middle sign-in pages: The caller directs the employee to an organisation-branded subdomain on a generic root domain designed to mimic an enrolment portal.
- The targeted organization’s name may appear as a subdomain of a generic domain (e.g., .onetimesso[.]com, .registermymfa[.]com) or be incorporated directly into a newly registered domain (e.g., sso[.]com, internal[.]com).
- Domains commonly combine action words such as "activate", "enroll", "register", "create", "add", "enable", "deploy" or "set" with authentication-related terms such as "passkey", "sso", "mfa" or "2fa". Other commonly used terms include "okta", "internal", "signin", "account", "security", "portal", "setup", "connect" and "sync".
- The page relays credentials and MFA responses to the legitimate identity provider, providing the actor with an authenticated session ^{Footnote 1}^{Footnote 2}.

Post-Compromise Activity

After obtaining an authenticated session, the actor has been reported to ^{Footnote 1}^{Footnote 2}:

Register attacker-controlled MFA methods or devices to maintain access.
Delete password-reset, MFA-change and security notifications, and reset passwords for non-SSO applications.
Use automated scripts and Microsoft Graph to access and exfiltrate data from Microsoft 365 and connected SaaS applications, including SharePoint and OneDrive.
Send extortion demands following data theft.

Suggested actions

The Cyber Centre recommends that organizations:

Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys or platform authenticators, particularly for privileged and high-risk users ^{Footnote 3}.
Enforce conditional access requiring managed devices and restrict sign-ins from commercial VPNs, hosting providers and residential proxies.
Strengthen verification for MFA resets, account recovery and new device enrolments, and reduce session lifetimes^{Footnote 1}.
Monitor for suspicious MFA registrations, scripted or high-volume Microsoft 365 file access, security-email deletion and newly registered domains impersonating the organization ^{Footnote 2}.
Instruct employees to independently verify unexpected IT calls requesting MFA, passkey or password changes, regardless of caller ID or urgency ^{Footnote 4}.
Provide a clear channel for reporting suspicious calls and associated websites.
If compromise is suspected, revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity.
Preserve relevant identity provider and Microsoft 365 audit logs for investigation ^{Footnote 5}.
Restrict external communications in collaboration platforms (e.g., Microsoft Teams, Webex, Slack, among others), including direct messaging, calls and meeting invitations, to trusted or operationally required external users, and regularly review guest access and permissions.

Organizations should also review the Cyber Centre’s Top 10 IT Security Actions^{Footnote 6}.

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Progress security advisory (AV26-1098)

2026-10-28T17:29:48Z

Serial number: AV26-1098
Date: October 28, 2026

As of October 28, 2026, Progress is affected by a vulnerability in the following product:

Telerik Document Processing Libraries
- Prior to 2026.3.1027

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Oracle Corporation security advisory (AV26-1071) – Update 1

2026-10-28T17:15:17Z

Serial Number: AV26-1071
Date: October 20, 2026
Updated: October 28, 2026

As of October 20, 2026, Oracle Corporation is affected by vulnerabilities in the following products:

Helidon
JD Edwards EnterpriseOne Configurator
JD Edwards EnterpriseOne General Ledger
JD Edwards EnterpriseOne Homebuilder
JD Edwards EnterpriseOne Human Resources Management
JD Edwards EnterpriseOne Localizations
JD Edwards EnterpriseOne Operational Sourcing
JD Edwards EnterpriseOne Orchestrator
JD Edwards EnterpriseOne Sales Order Entry
JD Edwards EnterpriseOne Tools
MySQL Client
MySQL Cluster
MySQL Connectors
MySQL Enterprise Backup
MySQL Router
MySQL Server
MySQL Server, MySQL Cluster
Oracle APEX
Oracle Access Manager
Oracle Agile Engineering Data Management
Oracle Agile PLM
Oracle Agile PLM MCAD Connector
Oracle Agile Product Lifecycle Management for Process
Oracle Application Testing Suite
Oracle Autonomous Health Framework
Oracle BI Publisher
Oracle Business Intelligence Enterprise Edition
Oracle Business Process Management Suite
Oracle Coherence
Oracle Commerce Platform
Oracle Communications BRM - Elastic Charging Engine
Oracle Communications Billing and Revenue Management
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Certificate Management
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications EAGLE Element Management System
Oracle Communications EAGLE LNP Application Processor
Oracle Communications LSMS
Oracle Communications Network Analytics Data Director
Oracle Communications Operations Monitor
Oracle Communications Policy Management
Oracle Communications Service Catalog and Design
Oracle Communications Unified Assurance
Oracle Communications Unified Inventory Management
Oracle Data Integrator
Oracle Database Server
Oracle Demand Planning
Oracle E-Business Suite
Oracle Enterprise Manager Base Platform
Oracle Enterprise Manager for Oracle Database
Oracle Enterprise Manager for Siebel
Oracle Enterprise Manager for Virtualization
Oracle Essbase
Oracle Financial Services Analytical Applications Infrastructure
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Fusion Middleware
Oracle Fusion Middleware Control
Oracle Global Lifecycle Management NextGen OUI Framework
Oracle Global Lifecycle Management OPatch
Oracle Global Lifecycle Management OPatchAuto
Oracle GoldenGate
Oracle GoldenGate Big Data and Application Adapters
Oracle GoldenGate Stream Analytics
Oracle GraalVM Enterprise Edition
Oracle GraalVM for JDK
Oracle HTTP Server
Oracle Health Sciences Information Manager
Oracle Healthcare Data Repository
Oracle Healthcare Master Person Index
Oracle Hospitality Cruise Shipboard Property Management (SPMS)
Oracle Hospitality OPERA 5 Property Services
Oracle Identity Manager
Oracle Identity Manager Connector
Oracle JDeveloper
Oracle Java SE
Oracle JavaFX
Oracle Managed File Transfer
Oracle Management Pack for Oracle GoldenGate
Oracle Middleware Common Libraries and Tools
Oracle NoSQL Database
Oracle Outside In Technology
Oracle Product Lifecycle Analytics
Oracle REST Data Services
Oracle Retail Merchandise Financial Planning
Oracle Retail Merchandising System
Oracle Retail Predictive Application Server
Oracle Retail Xstore Point of Service
Oracle SOA Suite
Oracle SQL Developer
Oracle Secure Backup
Oracle Service Bus
Oracle Solaris
Oracle TimesTen In-Memory Database
Oracle Trusted Answer Search
Oracle Utilities Network Management System
Oracle VM VirtualBox
Oracle Web Services Manager
Oracle WebCenter Content
Oracle WebCenter Portal
Oracle WebCenter Sites
Oracle WebLogic Server
Oracle Weblogic Server Proxy Plug-in
Oracle ZFS Storage Appliance Kit
PeopleSoft Enterprise CC Common Application Objects
PeopleSoft Enterprise FIN Cash Management
PeopleSoft Enterprise FIN Common Objects Argentina
PeopleSoft Enterprise FIN Common Objects Brazil
PeopleSoft Enterprise FIN General Ledger Brazil
PeopleSoft Enterprise FIN Inventory Brazil
PeopleSoft Enterprise FIN Manufacturing Brazil
PeopleSoft Enterprise FIN Product Configurator Brazil
PeopleSoft Enterprise HCM Global Payroll Switzerland
PeopleSoft Enterprise HCM Human Resources
PeopleSoft Enterprise PeopleTools
PeopleSoft Enterprise SCM Manufacturing
PeopleSoft Enterprise SCM Purchasing
PeopleSoft Enterprise SCM Strategic Sourcing
Primavera Gateway
Primavera Unifier
Siebel Applications
WebCenter Content: Imaging

Update 1
Open source reporting indicates that CVE-2026-101767 is exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Oracle Critical Patch Update Advisory - October 2026

Tanium security advisory (AV26-1097)

2026-10-28T15:40:28Z

Serial number: AV26-1097
Date: October 28, 2026

As of October 27, 2026, Tanium is affected by vulnerabilities in the following products:

Certificate Manager
- Prior to 1.17.417
- Prior to 1.18.368
- Prior to 1.22.119
Endpoint Configuration Toolset Solution
- Prior to 1.51.60
- Prior to 1.59.50
- Prior to 1.71.25
Enforce
- Prior to 2.10.778
- Prior to 2.9.736
- Prior to 3.0.373
Provision
- Prior to 1.17.150
- Prior to 1.23.161
- Prior to 1.24.199
Threat Response
- Prior to 4.12.349
- Prior to 4.17.327
- Prior to 4.9.476
end-user-cx
- Multiple versions
index-cx
- Multiple versions

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

All Advisories - Tanium Security Advisories

Veeam security advisory (AV26-1096)

2026-10-28T15:28:22Z

Serial number: AV26-1096
Date: October 28, 2026

As of October 27, 2026, Veeam is affected by vulnerabilities in the following products:

Veeam Agent for Linux
- Prior to 13.1.2
Veeam Backup and Replication
- Prior to 13.0.3
- Prior to 13.1.2
Veeam Backup for Microsoft 365
- Prior to or equal to 8.5.0.1014
- Prior to or equal to 8.6.0.1102
Veeam ONE
- Prior to or equal to 13.1.0.7233

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

Google Chrome security advisory (AV26-1095)

2026-10-28T14:50:37Z

Serial number: AV26-1095
Date: October 28, 2026

As of October 27, 2026, Google is affected by vulnerabilities in the following product:

Stable Channel Chrome for Desktop
- Versions prior to 156.0.8078.73/.74 (Windows/Mac), and 156.0.8078.73 (Linux)

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

Google Chrome Security Advisory

WatchGuard security advisory (AV26-1094)

2026-10-28T14:41:15Z

Serial number: AV26-1094
Date: October 28, 2026

As of October 27, 2026, WatchGuard is affected by vulnerabilities in the following products:

Fireware OS
- Multiple versions
Mobile VPN with SSL Client
- Prior to 2026.4
- Prior to 12.0

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

WatchGuard Security Advisories

TeamViewer security advisory (AV26-1093)

2026-10-28T14:38:08Z

Serial number: AV26-1093
Date: October 28, 2026

As of October 27, 2026, TeamViewer is affected by vulnerabilities in the following products:

TeamViewer Full Client & Host (Windows)
- Prior to 15.83
TeamViewer Full Client & Host (Linux)
- Prior to 15.83
TeamViewer Full Client & Host (macOS)
- Prior to 15.83
TeamViewer Host (Windows, Linux, macOS)
- Prior to 15.83
TeamViewer Portable (Windows)
- Prior to 15.83
TeamViewer Remote Control App (Android)
- Prior to 15.8.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.