Serial number:AV26-176
Date:February 26, 2026

On February 25, 2026, n8n published security updates to address critical vulnerabilities in the following products:

• n8n (Merge Node) – multiple versions
• n8n (Expression Sandbox) – multiple versions
• n8n (Task Runner Sandbox) – multiple versions
• n8n (Form Node) – multiple versions
• n8n (Form Trigger/Chat Trigger/Send & Wait/Webhook/Chat Nodes) – multiple versions

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary update.

• Remote Code Execution via Merge Node
• Expression Sandbox Escape Leading to RCE
• Sandbox Escape in JavaScript Task Runner
• Unauthenticated Expression Evaluation via Form Node
• Stored XSS via Various Nodes
• n8n Security

Serial number:AV26-175
Date:February 26, 2026

On February 25, 2026, Drupal published security advisories to address vulnerabilities in the following products:

• Material Icons – versions prior to 2.0.4
• Theme Negotiation by Rules – versions prior to 1.2.1
• Tagify – versions prior to 1.2.49
• Anti-Spam by CleanTalk – versions prior to 9.7.0
• CAPTCHA – versions prior to 1.17.0, version 2.0.0 to versions prior to 2.0.10
• Islandora – versions prior to 2.17.5
• Drupal Canvas – versions prior to 1.1.1
• SAML SSO - Service Provider – versions prior to 3.1.3
• Responsive Favicons – versions prior to 2.0.2

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates or perform the suggested mitigations.

• Drupal Security Advisories

Serial number:AV26-174
Date:February 26, 2026

On February 25, 2026, ServiceNow published a Security Advisory to address vulnerabilities in the following products. Included was a critical update for the following:

• ServiceNow Australia – versions prior to Australia
• ServiceNow Xanadu – versions prior to Xanadu Patch 11 Hot Fix 1a
• ServiceNow Yokohama – versions prior to Yokohama Patch 12 and Patch 10 Hot Fix 1b
• ServiceNow Zurich – versions prior to Zurich Patch 5 and Patch 4 Hot Fix 3b

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• [Security Advisory] CVE-2026-0542 - Remote Code Execution in ServiceNow AI Platform
• ServiceNow security advisories

Serial number:AV26-173
Date:February 25, 2026

Between February 24 and 25, 2026, VMware published security advisories to address critical vulnerabilities in multiple products:

• VMware Tanzu – multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Security Advisories – Tanzu

Serial number:AV26-172
Date:February 25, 2026

On February 25, 2026, Juniper Networks published a security advisory to address vulnerabilities in the following products. Included was a critical update for the following:

• Junos OS Evolved on PTX Series – 25.4 versions prior to 25.4R1-S1-EVO, 25.4R2-EVO

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• 2026-02 Out-of-Cycle Security Bulletin: Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root (CVE-2026-21902)
• Juniper Networks

Serial number:AV26-166
Date: February 25, 2026
Updated: February 25, 2026

On February 25, 2026, Cisco published security advisories to address critical vulnerabilities in the following products:

• Cisco Catalyst SD-WAN Controller – multiple versions
• Cisco Catalyst SD-WAN Manager – multiple versions
• Cisco Nexus 3600 and 9500-R Switching Platform – multiple versions
• Cisco Nexus 9000 Series Fabric Switches – multiple versions
• Cisco UCS Software (UCS Manager Mode) – versions prior to 4.3(6e)
• Cisco UCS Software (Intersight Managed Mode) – versions prior to 4.3(6.260003)

Cisco has indicated that CVE-2026-20127 has been exploited.

Update 1

On February 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20127 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links, perform the suggested recommendations, and apply the necessary updates when available.

• Cisco Security Advisories
• Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
• Cisco Catalyst SD-WAN Vulnerabilities
• Cisco Nexus 3600 and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability
• Cisco Nexus 9000 Series Fabric Switches in ACI Mode SNMP Denial of Service Vulnerability
• Cisco Nexus 9000 Series Fabric Switches in ACI Mode Denial of Service Vulnerability
• Cisco NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability
• CISA KEV : CVE-2026-20127