Alerts and Advisories

AL26-025: BeyondTrust Remote Support Authentication Bypass Exploited in the Wild, Added to CISA's KEV List

The Cyber Centre issued Alert AL26-025 on October 16, 2026 for CVE-2026-102764, an authentication bypass affecting all versions of BeyondTrust Remote Support that lets an unauthenticated remote attacker upload files and take over the appliance. Exploitation is reported in the wild and CISA added the CVE to its Known Exploited Vulnerabilities list the same day. Remote support appliances sit on the trust boundary of utilities, municipalities and carriers; patch, review logs and rotate any credentials the appliance held.

AV26-1051: Schneider Electric Sage RTUs Carry an Insufficient Data Authenticity Verification Flaw

Control systems advisory AV26-1051 of October 15, 2026 covers Schneider Electric Sage RTU 1410, 1430, 1450, 2400, 3030 Magnum and 4400 units running firmware before C3414-500-S02L0, with an insufficient verification of data authenticity vulnerability. Sage RTUs are common in Canadian electricity and water systems. The flaw is a reminder that authenticity on OT links depends on cryptography the equipment can actually run, and that remote terminal units belong in the cryptographic inventory alongside the firewalls in front of them.

AV26-1043: Juniper Patches Junos OS and Junos OS Evolved Across Releases 23.2 to 26.2

Advisory AV26-1043 of October 15, 2026 lists Junos OS and Junos OS Evolved fixes across every supported release train from 23.2 to 26.2, including the X100 and X300 Evolved builds used in carrier and data centre routing. Routers and switches in Canadian carrier and utility networks typically run for a decade; a quarterly patch cycle for Junos is the minimum, and the same inventory that tracks firmware should track the cryptographic protocols each platform still relies on.

AV26-1041: PAN-OS Management Interface Remote Code Execution Flaw Exploited, Added to CISA's KEV List

Advisory AV26-1041, issued October 14 and updated October 15, 2026, covers PAN-OS 10.2 through 12.2 and Prisma Browser. CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface, and CISA added it to its Known Exploited Vulnerabilities list on October 14. Firewalls are long lived equipment at the centre of most Canadian infrastructure networks: patch, confirm the management interface is not reachable from the internet, and record the device in your cryptographic inventory.

PEERSTITCH: Telecom Managed Service Provider's FortiManager Compromised, Configurations for 500 Managed Firewalls Taken, Rotate Trust Material

Unit 42 reported on October 14, 2026 that an actor used CVE-2024-47575 in FortiManager to register a rogue device at a telecommunications managed service provider and pull a configuration archive covering more than 500 managed FortiGate firewalls, then used CVE-2025-61624 to place a memory resident implant in FortiOS logging and IKE daemons. Unit 42 does not confirm intrusion into client networks and does not attribute the activity to a state; both flaws were patched in 2024 and 2025. Its recommendation is the one that matters for operators: treat every credential and certificate held by a compromised management platform as compromised, rotate the cryptographic trust material, and isolate edge management interfaces. This is about management plane exposure and key hygiene, not any one vendor.

Rotating trust material starts with knowing what there is to rotate: Fabric's Encryption Intelligence assessment inventories the certificates, pre-shared keys and tunnel parameters across a managed FortiGate estate from the configurations already in place, so the rotation list is complete before the work starts.

AV26-1037: Fortinet Patches FortiManager, FortiAnalyzer, FortiMail, FortiSIEM and FortiSandbox

Advisory AV26-1037 of October 13, 2026 covers FortiManager and FortiManager Cloud before 7.6.5 and 7.4.7, FortiAnalyzer before 7.6.5, 7.4.8 and 7.2.12, plus FortiMail, FortiSIEM and FortiSandbox. The fixes address arbitrary file read and write through SQL injection, an arbitrary file write in a gRPC service, and improper access control in the web management interface. FortiManager holds the configurations and trust material for every firewall it manages, which is exactly what the PEERSTITCH intrusion took from a telecom service provider this month; patch the management plane first.

Fabric's Encryption Intelligence assessment reads the FortiGate and FortiManager configurations you already run and shows which tunnels, certificates and key lengths that management plane is protecting, before a patch cycle or an intrusion forces the question.

AV26-1035: Ivanti Connect Secure VPN Flaw Added to CISA's Exploited List, a Second CVE Now Exploited

Advisory AV26-1035, issued October 13 and updated October 16, 2026, covers Ivanti Connect Secure versions up to 25.2.2 and 22.8R2.4 alongside Ivanti Neurons Patch for Intune and Xtraction. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities list on October 13 and open source reporting now shows CVE-2026-111357 exploited as well. Connect Secure is the remote access front door for many Canadian operators; patch now and treat VPN appliances as part of the cryptographic inventory, since the keys and certificates they hold are what an attacker leaves with.

AV26-1023: Another Citrix NetScaler Fix, CVE-2026-107406, Covers ADC, Gateway and FIPS Builds

Cyber Centre advisory AV26-1023 covers CVE-2026-107406 in Citrix NetScaler ADC and NetScaler Gateway before 13.1-64.29 and 14.1-73.46, including FIPS and NDcPP builds. It follows alert AL26-024 and advisory AV26-996 on the same platform, so organizations running NetScaler for remote access should move to the fixed builds and confirm the earlier patches are in place.

AV26-1020: Cisco Patches Nexus Switches and Meraki MX Security and SD-WAN Appliances

Cyber Centre advisory AV26-1020 covers vulnerabilities in Cisco Nexus 3000 and 9000 Series switches and NX-OS, UCS fabric interconnects, Meraki MX security and SD-WAN appliances, Meraki MS switches, MR access points and MG cellular gateways, among other products. Some fixes, including those for Meraki campus gateways, are scheduled for late October and mid November 2026, so operators of branch, municipal and data centre networks on this gear should track Cisco's advisories and plan interim mitigations.

AV26-1017: SonicWall SMA1000 Remote Access Appliances Carry a Flaw Exploited in the Wild

Cyber Centre advisory AV26-1017 covers vulnerabilities in SonicWall SMA1000 remote access appliances (models 6210, 7210 and 8200v) on platform hotfix builds 12.4.3-03670 and 12.5.0-03082 and earlier. An October 9 update notes open source reporting that CVE-2026-102255 is being exploited in the wild. SMA1000 gateways sit at the edge of many utility, municipal and financial networks, so owners should apply SonicWall's fixes promptly.

AV26-996: Another Citrix NetScaler Flaw Exploited, CVE-2026-88779 Added to CISA's KEV Catalog

Cyber Centre advisory AV26-996 covers CVE-2026-88779 in Citrix NetScaler ADC and NetScaler Gateway, including FIPS builds. Citrix indicates the flaw is exploited in the wild and CISA added it to its Known Exploited Vulnerabilities catalog on October 4, 2026. It is the third NetScaler CVE flagged since alert AL26-024 on September 27, so remote access gateways on NetScaler should be patched again and checked for signs of compromise.

AV26-995: Moxa MGate Industrial Protocol Gateways Carry Two New Vulnerabilities

Cyber Centre control systems advisory AV26-995 covers two vulnerabilities, CVE-2026-86325 and CVE-2026-86326, in Moxa MGate 3000 and 5000 Series protocol gateways. These devices translate between industrial protocols at the boundary of SCADA and plant networks in energy, water and pipeline operations, so owners should review Moxa's advisory and update affected units.

AV26-980: OpenSSL Patches Vulnerabilities Across Seven Release Branches, From 1.0.2 to 4.0

Cyber Centre advisory AV26-980 reports vulnerabilities in OpenSSL versions before 1.0.2zs, 1.1.1zj, 3.0.23, 3.4.8, 3.5.9, 3.6.5 and 4.0.3, and asks administrators to apply updates. OpenSSL sits inside firewalls, VPN appliances, routers and industrial devices, often several versions behind, so the practical question for operators is whether they know which of their systems carry which build.

AV26-978: Cisco Catalyst SD-WAN Manager Authentication Bypass Added to CISA's Exploited List

Cyber Centre advisory AV26-978 covers an API authentication bypass in Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-76504, which CISA added to its Known Exploited Vulnerabilities catalog on September 30, 2026. SD-WAN Manager is the central configuration and policy console for an entire wide area network, so operators of branch, utility and carrier SD-WAN fabrics should update to the fixed releases promptly.

AL26-024: Citrix NetScaler ADC and Gateway Critical Flaws Under Active Exploitation, Patch Now

Alert AL26-024 from the Canadian Centre for Cyber Security covers two critical vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway, CVE-2026-88771 (improper input validation allowing unauthenticated remote code execution) and CVE-2026-88772 (buffer overflow). Exploitation has been reported across multiple customer environments worldwide, so the advice is to patch Internet facing appliances first, preserve logs and look for signs of compromise that predate the fix.

AL26-022: F5 BIG-IP APM Heap Overflow Allows Unauthenticated Remote Code Execution

Alert AL26-022 from the Canadian Centre for Cyber Security covers CVE-2026-94127, a heap based buffer overflow in F5 BIG-IP Access Policy Manager that affects systems where an APM access policy and an OAuth profile share a virtual server. Crafted traffic may let an unauthenticated attacker execute code on the device, so remote access gateways built on BIG-IP APM should be patched promptly.

AL26-021: Cisco ISE Authentication Bypass Flaws, CVE-2026-76460 Added to CISA Exploited List

The Canadian Centre for Cyber Security issued alert AL26-021 for authentication bypass vulnerabilities in Cisco Identity Services Engine and ISE Passive Identity Connector. One of the CVEs has been added to CISA's Known Exploited Vulnerabilities list, so patching is urgent for any organization that uses ISE for network access control.

AL26-020: Critical MikroTik RouterOS Flaws Hit Authentication and Signature Verification

Alert AL26-020 from the Canadian Centre for Cyber Security covers critical MikroTik RouterOS vulnerabilities affecting authentication and signature verification. MikroTik equipment is common in smaller ISP, community and industrial networks, where patch cycles are often slow.

AL26-019: Citrix NetScaler Authentication Bypass Under Active Exploitation, Patch Now

Alert AL26-019 warns of a Citrix NetScaler ADC and Gateway authentication bypass under active exploitation. NetScaler sits at the edge of many enterprise and government networks, so the Cyber Centre's advice is to patch immediately and review access logs.