Data Recovery

Serial number:AV26-763
Date:July 30, 2026
Updated: October 28, 2026

As of July 30, 2026, VMware is affected by vulnerabilities in the following products:

• Cloud Foundation
  • 5.x
  • 9.0.x.x
  • 9.1.x.x
  • Prior to 5.2.3
• ESX
  • Prior to ESXi-9.0.2.0100-25595025
  • Prior to ESXi-9.1.0.0-25370933
  • Prior to ESXi-9.1.0.0200-25557999
  • Prior to ESXi80U3i-25205845
  • Prior to ESXi80U3k-25595708
• Fusion
  • Prior to 26H1
• Telco Cloud Infrastructure
  • 3.0
• Telco Cloud Platform
  • 4.x
  • 5.0.x
  • 5.1.x
• Workstation
  • Prior to 26H1
• vCenter
  • Prior to 8.0 U3k
  • Prior to 9.0.2.0100
  • Prior to 9.1.0.0300
• vSphere Foundation
  • 9.0.x.x
  • 9.1.x.x

Update 2

On October 28, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-41709 to their Known Exploited Vulnerabilities (KEV) Database.

Update 1

On August 18, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-59310 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• VMSA-2026-0006: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)
• Security Advisories - VMware Cloud Foundation
• CISA KEV: CVE-2026-59310
• CISA KEV: CVE-2026-41709

Serial number:AV26-1101
Date:October 28, 2026

As of October 28, 2026, Juniper Networks is affected by vulnerabilities in the following products:

• Session Smart Conductor
  • Prior to 7.0.5
  • Prior to 7.1.7
  • Prior to 7.2.3
• Session Smart Router
  • Prior to 7.0.5
  • Prior to 7.1.7
  • Prior to 7.2.3

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• 2026-10 On-Demand Security Bulletin: Session Smart Router and Session Smart Conductor: Multiple internally discovered vulnerabilities resolved
• CEC Juniper Community

Serial number:AV26-1100
Date:October 28, 2026

As of October 27, 2026, Mozilla is affected by vulnerabilities in the following products:

• Firefox
  • Prior to 159
• Firefox ESR
  • Prior to 115.44
  • Prior to 153.6
• Thunderbird
  • Prior to 159
  • Prior to 153.6

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Mozilla Foundation Security Advisory 2026-118
• Mozilla Foundation Security Advisory 2026-119
• Mozilla Foundation Security Advisory 2026-120
• Mozilla Foundation Security Advisory 2026-121
• Mozilla Foundation Security Advisory 2026-122
• Mozilla Foundation Security Advisories — Mozilla

Serial number:AV26-1099
Date:October 28, 2026

As of October 26, 2026, Apple is affected by vulnerabilities in the following products:

• iOS and iPadOS
  • Prior to 18.7.11
  • Prior to 26.7.2
  • Prior to 27.2
• MacOS (Golden Gate/Tahoe/Sequoia)
  • Prior to 27.2
  • Prior to 26.7.2
  • Prior to 15.8.2
• visionOS
  • Prior to 27.2
• tvOS
  • Prior to 27.2
• watchOS
  • Prior to 27.2
• Safari
  • Prior to 27.2

The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.

• Apple security releases - Apple Support

Serial number:AV26-028
Date:October 28, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of an ongoing voice phishing (vishing) campaign targeting Canadian organizations, including organizations in the legal and financial sectors. Multiple Canadian firms have been targeted by individuals impersonating internal IT support and directing employees to fraudulent sign-in pages. The tradecraft and infrastructure are consistent with publicly reported operations by a financially motivated threat actor ^{Footnote1Footnote2}.

Throughout 2026, this activity has shifted across sectors, increasingly targeting finance and legal organizations since July ^Footnote1. The Cyber Centre has identified related infrastructure naming Canadian organizations since January, with October activity concentrated on the legal sector. The campaign bypasses conventional multi-factor authentication (MFA) through real-time relay and frequently rotates lure domains, limiting the effectiveness of blocklists.

Initial Access

• Help desk voice phishing: Callers impersonate internal IT or help desk staff and claim an urgent passkey migration, MFA enrolment or password change is required. Calls may target personal mobile phones, office phones or Microsoft Teams, and may spoof legitimate help desk numbers. Callers may reference internal IT staff or missed deadlines to add credibility and may end the call if the employee attempts independent verification ^Footnote1.
• Organisation-branded adversary-in-the-middle sign-in pages: The caller directs the employee to an organisation-branded subdomain on a generic root domain designed to mimic an enrolment portal.
  • The targeted organization’s name may appear as a subdomain of a generic domain (e.g., <org-name>.onetimesso[.]com, <org-name>.registermymfa[.]com) or be incorporated directly into a newly registered domain (e.g., <org-name>sso[.]com, <org-name>internal[.]com).
  • Domains commonly combine action words such as "activate", "enroll", "register", "create", "add", "enable", "deploy" or "set" with authentication-related terms such as "passkey", "sso", "mfa" or "2fa". Other commonly used terms include "okta", "internal", "signin", "account", "security", "portal", "setup", "connect" and "sync".
  • The page relays credentials and MFA responses to the legitimate identity provider, providing the actor with an authenticated session ^{Footnote1Footnote2}.

Post-Compromise Activity

After obtaining an authenticated session, the actor has been reported to ^{Footnote1Footnote2}:

• Register attacker-controlled MFA methods or devices to maintain access.
• Delete password-reset, MFA-change and security notifications, and reset passwords for non-SSO applications.
• Use automated scripts and Microsoft Graph to access and exfiltrate data from Microsoft 365 and connected SaaS applications, including SharePoint and OneDrive.
• Send extortion demands following data theft.

Suggested actions

The Cyber Centre recommends that organizations:

• Deploy phishing-resistant MFA, such as FIDO2 security keys, device-bound passkeys or platform authenticators, particularly for privileged and high-risk users ^Footnote3.
• Enforce conditional access requiring managed devices and restrict sign-ins from commercial VPNs, hosting providers and residential proxies.
• Strengthen verification for MFA resets, account recovery and new device enrolments, and reduce session lifetimes^Footnote1.
• Monitor for suspicious MFA registrations, scripted or high-volume Microsoft 365 file access, security-email deletion and newly registered domains impersonating the organization ^Footnote2.
• Instruct employees to independently verify unexpected IT calls requesting MFA, passkey or password changes, regardless of caller ID or urgency ^Footnote4.
• Provide a clear channel for reporting suspicious calls and associated websites.
• If compromise is suspected, revoke active sessions and tokens, reset credentials, remove unauthorized MFA methods or devices, and review mailbox and file activity.
• Preserve relevant identity provider and Microsoft 365 audit logs for investigation ^Footnote5.
• Restrict external communications in collaboration platforms (e.g., Microsoft Teams, Webex, Slack, among others), including direct messaging, calls and meeting invitations, to trusted or operationally required external users, and regularly review guest access and permissions.

Organizations should also review the Cyber Centre’s Top 10 IT Security Actions^Footnote6.

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial number:AV26-1098
Date:October 28, 2026

As of October 28, 2026, Progress is affected by a vulnerability in the following product:

• Telerik Document Processing Libraries
  • Prior to 2026.3.1027

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Document Processing Libraries Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadWordsProcessing (CVE-2026-118035)
• Progress Trust Center