Source: Canadian Centre for Cyber Security

10 stories in the last 30d

CISA added actively exploited NetScaler flaw CVE-2026-19490 to its KEV catalog; the Canadian Cyber Centre urges Citrix ADC and Gateway admins to patch.

The Canadian Centre for Cyber Security updated advisory AV26-833 covering Citrix NetScaler ADC and Gateway vulnerabilities in versions 13.1 (prior to 13.1-63.21) and 14.1 (prior to 14.1-73.32), plus FIPS builds. On September 9, 2026, CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog, indicating confirmed exploitation. The bulletin also references CVE-2026-19489 from the Citrix NetScaler ADC and Gateway Security Bulletin. Administrators should apply the fixed builds, including 13.1-37.277 and 14.1-73.32 for FIPS variants.

Canadian Centre for Cyber SecuritySep 9, 20:10 UTC · 7d agoExploit / PoC in the wildCVE-2026-19489 CVE-2026-19490

Cisco security advisory (AV26-197) – Update 3

CISA added Cisco CVE-2026-20079 to its KEV catalog; the Canadian Cyber Centre urges updates across Secure Firewall ASA, FTD, FMC, and SCC products.

The Canadian Centre for Cyber Security updated advisory AV26-197 covering March 2026 Cisco advisories for Security Cloud Control, Secure Firewall Management Center, ASA, and FTD. Cisco confirmed CVE-2026-20131 was actively exploited on March 18, 2026, and CISA added it to KEV on March 19. In Update 3, dated September 9, 2026, CISA added CVE-2026-20079 to the KEV catalog. The underlying flaws include FMC authentication bypass and remote code execution, ASA TCP-flood denial of service, and ASA/FTD IPsec denial of service.

Canadian Centre for Cyber SecuritySep 9, 20:04 UTC · 7d agoExploit / PoC in the wildCVE-2026-20131 CVE-2026-20079

Fortinet security advisory (AV26-023) - Update 1

CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.

The Canadian Centre for Cyber Security updated advisory AV26-023, which relays January 2026 Fortinet advisories covering FortiFone, FortiOS, FortiSASE, FortiSIEM, and FortiSwitchManager. On September 9, 2026, CISA added CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its Known Exploited Vulnerabilities catalog. Related Fortinet flaws include unauthenticated local configuration access (CVE-2025-47855) and unauthenticated remote command injection (CVE-2025-64155). Administrators should review the advisories and apply available updates.

Canadian Centre for Cyber SecuritySep 9, 19:57 UTC · 7d agoExploit / PoC in the wildCVE-2025-25249 CVE-2025-47855 CVE-2025-64155

Google security advisory (AV26-883) – Update 1

Google patched actively exploited Chrome flaw CVE-2026-85046 in Chrome 152.0.7977.82; CISA added it to the KEV catalog, urging updates.

The Canadian Centre for Cyber Security (advisory AV26-883, Update 1) reports Google fixed CVE-2026-85046 in Chrome 152.0.7977.82 and that an exploit exists in the wild. CISA added the vulnerability to its Known Exploited Vulnerabilities database on September 4, 2026. Users and administrators should update Chrome stable desktop channels promptly.

Canadian Centre for Cyber SecuritySep 4, 17:21 UTC · 12d agoExploit / PoC in the wildCVE-2026-85046

JFrog security advisory (AV26-867) – Update 1

CISA added actively exploited CVE-2026-82329 in JFrog Artifactory to its KEV catalog; administrators of affected versions should patch.

Canada's Cyber Centre (advisory AV26-867, Update 1) relays a JFrog security advisory covering Artifactory, where open-source reporting indicates CVE-2026-82329 is being exploited in the wild. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 2, 2026. Multiple Artifactory release lines prior to fixed versions (e.g., prior to 7.111.21 through 7.161.20) are affected; users and administrators are urged to apply available updates.

Canadian Centre for Cyber SecuritySep 2, 18:55 UTC · 14d agoExploit / PoC in the wildCVE-2026-82329

SonicWall security advisory (AV26-872) – Update 1

CISA added exploited SonicWall SMA1000 flaws CVE-2026-83548 and CVE-2026-83549 to KEV; admins of affected hotfix versions should patch.

Canada's Cyber Centre (advisory AV26-872, Update 1) relays a SonicWall advisory for SMA1000 appliances (6210, 7210, 8200v), stating CVE-2026-83548 and CVE-2026-83549 are being exploited. CISA added both flaws to its Known Exploited Vulnerabilities catalog on September 2, 2026. Affected versions include platform-hotfix 12.4.3-03453 and 12.5.0-02835 and older; administrators should apply available updates.

Canadian Centre for Cyber SecuritySep 2, 18:44 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

PaperCut security advisory (AV26-858) – Update 2

CISA added actively exploited PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078 to KEV; Canada's Cyber Centre urges Emergency Patch Release 2 for v24-v26.

Canada's Cyber Centre updated security advisory AV26-858, noting PaperCut MF and PaperCut NG versions prior to the v24, v25, and v26 Emergency Patch Release 2 are affected by CVE-2026-81578 and CVE-2026-82078. Open-source reporting indicates both vulnerabilities are being exploited in the wild. In Update 2 (August 31, 2026), CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and the Cyber Centre urges administrators to apply the emergency patches immediately.

Canadian Centre for Cyber SecurityAug 31, 16:00 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078

Citrix security advisory (AV26-645) – Update 3

Canada's Cyber Centre updates Citrix advisory as CVE-2026-8451 and CVE-2026-8452 in NetScaler ADC/Gateway are confirmed exploited in the wild.

The Canadian Centre for Cyber Security updated advisory AV26-645 on August 26, 2026, covering critical vulnerabilities in Citrix NetScaler ADC and Gateway (versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus FIPS builds). Open-source reporting indicates CVE-2026-8451 and CVE-2026-8452 are being exploited in the wild. Update 3 references related CISA action, and patched builds were released starting June 30, 2026.

Canadian Centre for Cyber SecurityAug 26, 18:27 UTC · 21d agoExploit / PoC in the wildCVE-2026-8451 CVE-2026-8452

Gitea security advisory (AV26-845)

CISA added CVE-2026-60004, an actively exploited RCE via diffpatch Git hook installation in Gitea, to the KEV catalog; users should upgrade past 1.27.1.

Canadian Centre for Cyber Security advisory AV26-845 reports that Gitea versions prior to 1.27.1 are affected by CVE-2026-60004, remote code execution via diffpatch Git hook installation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 25, 2026, indicating observed exploitation. Fixed releases 1.27.1 and 1.27.2 are available, and administrators should upgrade promptly.

Canadian Centre for Cyber SecurityAug 25, 18:29 UTC · 22d agoExploit / PoC in the wildCVE-2026-60004

Oracle security advisory – January 2026 quarterly rollup (AV26-042) – Update 2

CISA added actively exploited Oracle flaw CVE-2026-21962 to the KEV catalog; it allows remote unauthorized access to Oracle HTTP Server and WebLogic Proxy Plug-in.

Canada's Cyber Centre updated advisory AV26-042 on Oracle's January 2026 quarterly rollup, reporting that CISA added CVE-2026-21962 to the Known Exploited Vulnerabilities catalog on August 24, 2026. The flaw affects the Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in in Oracle Fusion Middleware and may allow a remote attacker to obtain unauthorized access. A public proof of concept has been available since January 21, 2026, and fixes shipped in Oracle's January 20, 2026 advisory covering multiple products.

Canadian Centre for Cyber SecurityAug 24, 18:42 UTC · 23d agoExploit / PoC in the wildCVE-2026-21962