Number: AL26-015
Date: July 2, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of active exploitation of a vulnerability affecting Microsoft SharePoint Server. In response to the Microsoft security advisory, released on May 21, 2026^Footnote1, the Cyber Centre issued AV26-456^Footnote2 Update 1 on May 21, 2026.

Tracked as CVE-2026-45659^Footnote3, this vulnerability is a critical Deserialization of Untrusted Data (CWE-502)^Footnote4 vulnerability affecting multiple versions of Microsoft SharePoint Server and could allow a low privileged remote attacker to execute remote code.

This vulnerability was added to the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog^Footnote5 on July 1, 2026.

Suggested actions

The Cyber Centre recommends that organizations upgrade affected Microsoft SharePoint instances to a fixed version:

The Cyber Centre recommends organizations:

• Identify all on-premises SharePoint Server instances, particularly those exposed to the internet.
• Use or upgrade to supported versions of on-premises Microsoft SharePoint Server.
• Apply the latest security updates from Microsoft.

Important note: Microsoft SharePoint Enterprise Server 2016^Footnote6 and Server 2019^Footnote7 will be end of life on July 14, 2026. Organizations are urged to migrate to a supported version.

In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topics^Footnote8.

• Patch operating systems and applications
• Harden operating systems and applications
• Isolate web-facing applications

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

Serial number: AV26-645
Date: June 30, 2026

On June 30, 2026, Citrix published a security advisory to address critical vulnerabilities in the following products:

• NetScaler ADC and NetScaler Gateway - versions 14.1 before 14.1-72.61
• NetScaler ADC and NetScaler Gateway - versions 13.1 before 13.1-63.18
• NetScaler ADC FIPS – versions before 14.1-72.61 FIPS
• NetScaler ADC FIPS and NDcPP – versions before 13.1-37.272

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474
• Citrix Security Advisories

Serial number:AV26-644
Date:June 30, 2026

On June 30, 2026, Mozilla published a security advisory to address a vulnerability in the following product:

• Firefox – versions prior to 152.04

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Mozilla Foundation Security Advisory 2026-62
• Mozilla Security Advisories

Serial number: AV26-643
Date: June 30, 2026

On June 23, 2026, wolfSSL published a security advisory to address vulnerabilities in the following product:

• wolfSSL – versions prior to 5.9.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• wolfSSL Release 5.9.2 (June 23, 2026)
• wolfSSL

Serial number: AV26-642
Date: June 30, 2026

On May 26, 2026, SimpleHelp published a security update to address vulnerabilities in the following product:

• SimpleHelp – versions 5.5.0 to versions prior to 5.5.16
• SimpleHelp – versions 6.0 to versions prior to 6.0 RC2

On June 29, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48558 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary update.

• SimpleHelp 5.5 and 6.0 Security Fix
• SimpleHelp Release News
• CISA KEV: CVE-2026-48558

Serial number: AV26-641
Date: June 29, 2026

On June 29, 2026, Apple published security advisories to address vulnerabilities in the following products:

• iOS and iPadOS – versions prior to 26.5.2
• macOS Tahoe – versions prior to 26.5.2
• Safari – versions prior to 26.5.2

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• About the security content of iOS 26.5.2 and iPadOS 26.5.2
• About the security content of macOS Tahoe 26.5.2
• Apple security releases