Loading story…
The Canadian Centre for Cyber Security issued advisory AV26-828 warning that Mattermost is affected by CVE-2026-9816. The notice says the vulnerability impacts Mattermost versions 10.11.21 and earlier, 11.7.6 and earlier, and 11.8.3 and earlier, based on vendor information reflected in the advisory.
Administrators and users were directed to review Mattermost's official security updates and apply vendor-provided fixes as they become available. The advisory and related vendor update page indicate that organizations running affected Mattermost deployments should verify their installed versions and prioritize patching to reduce exposure.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-828 stating that Mattermost is affected by CVE-2026-9816. The notice says versions prior to or equal to 10.11.21, 11.7.6, and 11.8.3 are affected and advises users to review Mattermost security updates and apply fixes as available.
Mattermost published patches for Mattermost Server under advisory MMSA-2026-00685_00686_00687_00691, affecting versions before 10.11.22, 11.7.7, and 11.8.x updates. The advisory covered four CVEs: CVE-2026-10080, CVE-2026-10527, CVE-2026-9816, and CVE-2026-9859.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcemattermost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Zimbra Collaboration versions earlier than **10.1.20** were flagged in security advisories warning of vulnerabilities that require vendor-issued updates. The advisory, identified as **`AV26-816`**, prompted national cyber authorities to direct administrators to review Zimbra’s remediation guidance and upgrade affected deployments. The **Canadian Centre for Cyber Security** and **Guyana National CIRT** both urged organizations to assess their exposure, prioritize patching, and apply the available update where necessary. The notices emphasize that systems running unsupported or unpatched Zimbra releases remain at risk until they are brought to **10.1.20** or later in line with the vendor advisory.
Aug 15, 2026
Microsoft disclosed security vulnerabilities affecting **Microsoft Edge (Chromium-based)**, with the Canadian Centre for Cyber Security warning that versions prior to **`150.0.4078.99`** are impacted. The advisory directs organizations to consult Microsoft's **Security Update Guide** for vulnerability details and remediation information tied to the affected browser release. Government and industry notices amplified the advisory and urged users and administrators to apply relevant Edge updates as they become available. The guidance highlights the need for prompt patching across enterprise environments running outdated Edge installations to reduce exposure to the disclosed flaws.
Jul 27, 2026
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose `Control-M/Server` and related components to serious remote attacks. **CVE-2026-10539** is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects `Control-M/Server` versions `9.0.20.x` through `9.0.21.200`, and possibly earlier unsupported releases, and is rated `CVSS 4.0 9.5` / `CVSS 3.1 9.0`. A second issue, **CVE-2026-10538**, is a high-severity improper deserialization vulnerability in out-of-support `Control-M/Server` and `Control-M/Enterprise Manager` `9.0.20.x` components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated `CVSS 4.0 8.9` / `CVSS 3.1 8.0`. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
Jul 3, 2026