Serial number:AV26-586
Date:June 10, 2026
Update:June 18, 2026

On June 10, 2026, Splunk published security advisories to address vulnerabilities in the following products:

• Splunk SOAR – versions prior to 8.5.0
• Splunk Enterprise – multiple versions and platforms
• Splunk Cloud Platform – multiple versions and platforms

Update 1

On June 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20253 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Splunk Security Advisories
• CISA KEV: CVE-2026-20253

Number: AL26-014
Date: June 18, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

On June 17, 2026, the Canadian Centre for Cyber Security (Cyber Centre) became aware of open-source reporting^{Footnote1Footnote2Footnote3} describing a widespread malicious campaign, known as “FortiBleed,” involving exposed credentials affecting Fortinet firewalls and VPN gateways. Exploitation of these credentials could allow malicious actors to gain remote access to affected devices and connected networks, as well as modify various system settings, including critical security controls.

Suggested actions

The Cyber Centre strongly recommends that organizations :

• Inventory all accounts on Fortinet devices, identify unauthorized or suspicious accounts (e.g., forticloud-sync, forticloud-tech) and disable/remove suspected or unneeded accounts.
• Restrict access to management interfaces to trusted networks and hosts only.
• Terminate all active SSL VPN and administrative sessions.
• Reset passwords for all Fortinet VPN and administrative accounts.
• Enforce Multi-Factor Authentication (MFA) across all external gateways and admin interfaces.
• Ensure all Fortinet devices are running the latest firmware. Specifically, check for patches related to CVE-2024-55591 (obtain high privileges) ^Footnote4 and, CVE-2025-59718^Footnote5 and CVE-2025-59719^Footnote6 (authentication bypass)^Footnote7.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics^Footnote8.

• Consolidate, monitor and defend Internet gateways
• Patch operating systems and applications
• Enforce the management of administrative privileges
• Harden operating systems and applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

Serial number:AV26-614
Date:June 17, 2026

On June 17, 2026, Splunk published security advisories to address vulnerabilities in the following product. Included was a critical update for the following:

• Splunk AI Toolkit – versions prior to 5.7.4

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
• Splunk Security Advisories

Serial number:AV26-613
Date: June 17, 2026

On June 17, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following product:

Cisco ISE (Identity Services Engine) and Cisco ISE-PIC (Passive Identity Connector)

• Cisco ISE and ISE-PIC Releases prior to 3.3 - all versions
• Cisco ISE and ISE-PIC Release 3.3 - versions prior to 3.3 Patch 11
• Cisco ISE and ISE-PIC Release 3.4 - versions prior to 3.4 Patch 6
• Cisco ISE and ISE-PIC Release 3.5 - versions prior to 3.5 Patch 4 (August 2026)

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available.

• Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities
• Cisco Security Advisories

Serial number:AV26-612
Date:June 17, 2026

On June 17, 2026, F5 published a security advisory to address vulnerabilities in the following products:

• F5 DoS for NGINX - version 4.9.0
• F5 WAF for NGINX Instance Manager - versions 5.9.0 to 5.13.1
• NGINX App Protect DoS - versions 4.3.0 to 4.7.0
• NGINX App Protect WAF - versions 5.2.0 to 5.8.0 and 4.10.0 to 4.16.0
• NGINX Open Source - versions 1.30.0 to 1.30.2 and 1.31.0 to 1.31.1
• NGINX Instance Manager - versions 2.17.0 to 2.22.0
• NGINX Gateway Fabric - multiple versions
• NGINX Ingress Controller - multiple versions
• NGINX Plus - version 37.0.0 R33 to 37.01 R36

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• K000161614: Out-of-band Security Notification (June 17, 2026)
• MyF5

Serial number:AV26-611
Date:June 17, 2026

On June 17, 2026, Mitel published a security advisory to address vulnerabilities in the following products. Included were critical updates for the following:

• MiCollab - multiple versions
• MiVoice Business Solution Virtual Instance (MiVB SVI) - version 2.1.0.9-2 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mitel Product Security Advisory MISA-2026-0005
• Mitel Security Bulletins