Serial number:AV26-1053
Date:October 15, 2026

As of October 15, 2026, SUSE is affected by vulnerabilities in the following products:

• Rancher
  • Prior to 2.10.5
  • Prior to 2.11.1
  • Prior to 2.9.9
• Steve
  • Prior to 0.2.1
  • Prior to 0.3.3
  • Prior to 0.4.4
  • Prior to 0.5.13

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Users who can create Projects can gain access to arbitrary projects
• Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
• SUSE Update Advisories

Serial number:AV26-1052
Date:October 15, 2026

As of October 7, 2026, Johnson Controls is affected by a vulnerability in the following product:

• ADVMS
  • Prior to 3.10

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Vulnerability impacting American Dynamics VMS - JCI-PSA-2026-17
• Johnson Controls Product Security Advisories

Serial number:AV26-1051
Date:October 15, 2026

As of October 13, 2026, Schneider Electric is affected by a vulnerability in the following products:

• Sage RTU 1410/1430/1450
  • Versions prior to C3414-500-S02L0
• Sage RTU 2400
  • Versions prior to C3414-500-S02L0
• Sage RTU 3030 Magnum
  • Versions prior to C3414-500-S02L0
• Sage RTU 4400
  • Versions prior to C3414-500-S02L0

The Cyber Centre encourages users and administrators to review the provided web link perform the suggested mitigations and apply the necessary updates.

• Insufficient Verification of Data Authenticity vulnerability on SAGE RTU Products
• Schneider Electric Security Notifications

Serial number:AV26-1050
Date:October 15, 2026

As of October 15, 2026, JetBrains is affected by vulnerabilities in the following products:

• Datalore
  • Prior to 2026.2.1
• Junie CLI
  • Prior to 26.8.3
• TeamCity
  • Prior to 2026.2
  • Prior to 2026.1.4
  • Prior to 2025.11.8
• YouTrack
  • Prior to 2026.2.19575
  • Piror to 2026.3.16075
  • Prior to 2026.3.16397
  • Prior to 2026.3.16402

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Fixed security issues
• Security - The JetBrains Blog

Serial number:AV26-1002
Date:October 5, 2026
Updated:October 15, 2026

As of October 5, 2026, Atlassian is affected by a vulnerability in the following products:

• Bamboo Data Center
  • Version 10.2.4 and prior
  • Version 12.1.12 and prior
• Bamboo Server
  • All versions
• Bitbucket Data Center
  • Version 10.2.8 and prior
  • Version 10.5.1 and prior
  • Version 9.4.26 and prior
• Bitbucket Server
  • All versions
• Confluence Data Center
  • Version 10.2.19 and prior
  • Version 9.2.26 and prior
• Confluence Server
  • All versions
• Crowd Data Center
  • Version 6.3.7 and prior
  • Version 7.0.3 and prior
  • Version 7.1.1 and prior
  • Version 7.2.4 and prior
• Crowd Server
  • All versions
• Crucible Data Center
  • Version 4.9.15 and prior
• Crucible Server
  • Version 4.9.15 and prior
• Fisheye Data Center
  • Version 4.9.15 and prior
• Fisheye Server
  • Version 4.9.15 and prior
• Jira Service Management Data Center
  • Version 10.3.26 and prior
  • Version 11.3.12 and prior
  • Version 5.12.40 and prior
• Jira Service Management Server
  • Version 5.12.40 and prior
• Jira Software Data Center
  • Version 10.3.26 and prior
  • Version 11.3.12 and prior
  • Version 9.12.40 and prior
• Jira Software Server
  • Version 9.12.40 and prior

Update 1
Open source reporting indicates that CVE-2026-21589 is being exploited in the wild.

Update 2
On October 15, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-21589 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple Products
• Security Advisories & Bulletins
• CISA KEV: CVE-2026-21589

Serial number:AV26-1049
Date:October 15, 2026

As of October 14, 2026, F5 is affected by vulnerabilities in the following products:

• NGINX Gateway Fabric
  • Prior to 2.8.0
• NGINX Ingress Controller
  • Prior to 5.7.0
• NGINX JavaScript
  • Prior to 1.0.2
• NGINX Open Source
  • Prior to 1.30.6
  • Prior to 1.31.7
• NGINX Plus
  • Prior to 37.0.5.1
  • Prior to 37.1.0.1
  • Versions R33 to R36
• NGINX Instance Manager
  • Prior to 2.24.0
• F5 WAF for NGINX
  • Prior to 5.16.0
  • Prior to 5.14.2
• F5 DoS for NGINX
  • Prior to 4.11.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• K000162615: NGINX ngx_http_js_module vulnerability CVE-2026-101019
• K000162617: NGINX Ingress Controller vulnerability CVE-2026-104939
• K000162416: NGINX ngx_http_core_module vulnerability CVE-2026-15176
• MyF5 New and Updated Articles