Serial number:AV26-462
Date:May 13, 2026
Updated: May 29, 2026

On May 13, 2026, Palo Alto Networks published security advisories to address vulnerabilities in the following products:

• PAN-OS 12.1 – versions prior to 12.1.4-h5
• PAN-OS 12.1 – versions prior to 12.1.7
• PAN-OS 11.2 – multiple versions
• PAN-OS 11.1 – multiple versions
• PAN-OS 10.2 – multiple versions

Update 1

On May 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to their Known Exploited Vulnerabilities (KEV) Database.

Impacted products for CVE-2026-0257:

• PAN-OS 12.1 – versions prior to 12.1.4-h6
• PAN-OS 12.1 – versions prior to 12.1.7
• PAN-OS 11.2 – multiple versions
• PAN-OS 11.1 – multiple versions
• PAN-OS 10.2 – multiple versions
• Prisma Access 11.2.0 – versions prior to 11.2.7-h13
• Prisma Access 10.2.0 – versions prior to 10.2.10-h36

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested mitigations and apply the necessary updates.

• CVE-2026-0265 PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
• CVE-2026-0264 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution
• CVE-2026-0263 PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing
• Palo Alto Network Security Advisories
• CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
• CISA KEV: CVE-2026-0257

Number: AL26-013
Date: May 29, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

On May 18, 2026, GitHub detected unauthorized access to its internal systems originating from a compromised employee device^Footnote1. The intrusion was facilitated by a maliciously modified version of the Nx Console Visual Studio Code extension (version 18.95.0)^Footnote2. The attacker successfully exfiltrated approximately 3,800 internal GitHub repositories, containing proprietary source code and internal configuration data. GitHub Enterprise Server customers are advised to follow vendors recommendations. No action is required for GitHub Enterprise Cloud clients.

In response to this security incident, and the release of the GitHub Security Notification, the Cyber Centre released AV26-512 on May 27, 2026^Footnote3.

The purpose of this alert is to increase awareness of the reported incident and to take necessary measures.

Suggested actions

The Cyber Centre suggests the following actions:

• Monitor for compromise by reviewing CI/CD (Continuous Integration/Continuous Deployment) logs for unexpected repository access/cloning, unauthorized admin actions, authentication/access control changes, unauthorized pushes or orphan commits, and suspicious commits after May 18, 2026 — especially from bot/service accounts (e.g., ci-bot, build-bot).
• Remove Nx Console v18.95.0 from all environments and downgrade/upgrade to a known good version (18.94.0 or 18.96.0+).
• If the malicious version of Nx Console is present:
  • Check macOS systems for ~/.local/share/kitty/cat.py and related persistence (launch agents)
  • Immediately rotate all credentials (AWS, GCP, Azure, GitHub, npm) exposed on developer machines between May 11–20, 2026.
• Strengthen controls by disabling IDE extension auto-updates in high-security environments and enforcing an approved allowlist of developer tools.
• Rotate GitHub Enterprise Server GPG (GNU Privacy Guard) public keys per vendor guidance, as future patches/releases require the new key before installation.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics^Footnote4.

• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

Serial number:AV26-526 
Date: May 29, 2026

On May 28, 2026, Oracle published a security advisory to address critical vulnerabilities in the following products:

• Oracle Communications Unified Assurance - versions 6.1.1 to 7.0.0
• Oracle Database Server - versions 23.4.0 to 23.26.2
• Oracle E-Business Suite - versions 12.2.3 to 12.2.15
• Oracle Hospitality OPERA 5 Property Services - versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6 and 5.6.28
• Oracle REST Data Services - versions 24.2.0 to 26.1.0

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Oracle Critical Security Patch Update Advisory - May 2026
• Oracle Critical Patch Updates, Security Alerts and Bulletins

Serial number:AV26-525
Date: May 29, 2026

On May 28, 2026, Microsoft published a security update to address vulnerabilities in the following product:

• Microsoft Edge Stable Channel – versions prior to 148.0.3967.96

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• Microsoft Edge Stable Channel Release Notes

Serial number:AV26-524
Date: May 28, 2026

On May 28, 2026, Mitel published a security advisory to address vulnerabilities in the following products:

• Mitel Standard Linux – versions 12.x and prior
• MiVoice 5000 – versions 8.x and prior
• MiVoice Border Gateway – versions 11.6.x, 12.x and prior
• MiVoice Business – versions 10.1.x to 10.5.x
• MiVoice Business Solution Virtual Instance – versions 2.x and prior
• MiVoice MX-ONE – versions 7.3 to 7.8 and version 8.x and prior
• OpenScape 4000 – versions V10 R1.x, V11 R0.22, V11 R1.26 and prior
• OpenScape Branch – versions V10.3 and V11.x and prior
• OpenScape SBC – versions V10.3 and V11.x and prior
• OpenScape Voice Server – versions V9R3 JITC, V10, V11 and prior
• MiCollab – versions 10.x and prior
• MiCloud Management Portal – versions 6.3.x and prior
• Mitel Open Integration Gateway – versions 4.3.x and prior
• Mitel Performance Analytics MPA – versions 3.6x and prior
• OpenScape Contact Media Service (used by Mitel CX and OpenScape Contact Center) – versions V12Rx and prior
• Mitel SIP DECT – versions 9.1, 9.2, 10.0, 10.1 and prior
• OpenScape Xpert Clients 6010P – versions V7, V8 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Linux Kernel Local Privilege Escalation Vulnerabilities "Dirty Frag" (CVE-2026-43284, CVE-2026-43500)
• Mitel Security Bulletins

Serial number:AV26-523
Date: May 28, 2026

On May 27, 2026, Tanium published security advisories to address vulnerabilities in the following products:

• Connect 2024H2 – versions prior to Update 25 (v5.26.191)
• Connect 2025H1 – versions prior to Update 19 (v5.29.237)
• Connect 2025H2 – versions prior to Update 9 (v5.37.140)

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Tanium Security Advisories - TAN-2026-015
• Tanium Security Advisories - TAN-2026-014
• Tanium Security Advisories