Cyber Centre Daily Advisory Digest — 2026-07-27 (4 advisories)
This is a compilation of four vulnerability advisories issued by the Canadian Centre for Cyber Security on 2026-07-27, covering Microsoft Edge (Chromium-based), Redis, multiple Fortinet products, and Erlang/OTP. The most significant item is an update to a prior Fortinet advisory (AV26-109) noting that CISA added CVE-2025-68686 to its Known Exploited Vulnerabilities database, confirming active exploitation of a vulnerability spanning FortiAuthenticator, FortiClientWindows, FortiOS, and FortiSandbox. No technical exploitation details, IOCs, or attack narratives are provided in the advisories; they primarily direct readers to vendor patch/update resources.
Detection / HunterAnthropic
What Happened
Canada's national cyber security agency published a daily digest listing four separate security bulletins about software that needs updating: Microsoft's Edge browser, the Redis database software, several Fortinet security products, and the Erlang programming platform. The most urgent item is that a known flaw in Fortinet products has now been confirmed by the U.S. government (CISA) as being actively used by attackers, meaning organizations using affected Fortinet software are at real risk right now. This affects any organization or individual using outdated versions of these products, from home users of Edge to businesses relying on Fortinet security appliances. It matters because unpatched software with confirmed active exploitation is one of the easiest ways attackers gain access to networks. Anyone using these products should check their software version against the ones listed and apply vendor updates as soon as possible, following their organization's standard patching process.
Key Takeaways
- Four vulnerability advisories were published by the Canadian Centre for Cyber Security on 2026-07-27, covering Microsoft Edge, Redis, Fortinet products, and Erlang/OTP.
- CISA added CVE-2025-68686, affecting multiple Fortinet products (FortiAuthenticator, FortiClientWindows, FortiOS, FortiSandbox), to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-27, indicating active exploitation in the wild.
- Microsoft Edge (Chromium-based) versions prior to 150.0.4078.99 are affected by unspecified vulnerabilities requiring update.
- Redis versions prior to 8.8.0 contain a vulnerability related to corrupt stream RDB handling with shared NACK across consumers.
- Erlang/OTP versions in the 10.2 (prior to 11.7.4) and 6.0 (prior to 17.0.4) branches are affected by vulnerabilities requiring patching.
Affected Systems
- Microsoft Edge (Chromium-based) prior to 150.0.4078.99
- Redis prior to version 8.8.0
- FortiAuthenticator 6.3, 6.4, 6.5, and 6.6 (6.6.0–6.6.6)
- FortiClientWindows 7.0, 7.2 (7.2.0–7.2.12), 7.4 (7.4.0–7.4.4)
- FortiOS 6.4, 7.0, 7.2, 7.4 (7.4.0–7.4.10), 7.6 (7.6.0–7.6.4)
- FortiSandbox 4.0, 4.2, 4.4 (4.4.0–4.4.7), 5.0 (5.0–5.1)
- Erlang/OTP 10.2 branch prior to 11.7.4; 6.0 branch prior to 17.0.4
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-68686 | FortiAuthenticator, FortiClientWindows, FortiOS, FortiSandbox | A vulnerability affecting multiple Fortinet products that was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-27, indicating it is being actively exploited in the wild. |
Attack Chain
N/A - This is a compilation of vulnerability advisories with no described attack chain, exploitation technique, or malware behavior. Only affected product/version ranges and a CISA KEV addition are noted.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The advisories contain no detection rules, YARA/Sigma/Snort content, or query logic. They are purely notification-style bulletins directing readers to vendor patch and advisory pages.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | No exploitation technique, payload, or endpoint behavior is described; the advisories are patch notifications rather than incident reporting. |
| Network Visibility | None | No network indicators, C2 infrastructure, or traffic patterns are provided in these advisories. |
| Detection Difficulty | Very Hard | Without exploitation details, IOCs, or TTPs disclosed in these advisories, defenders cannot build detections; the appropriate response is patch verification rather than behavioral detection. |
Required Log Sources
- Vulnerability/patch management system inventory logs
- Fortinet device version/configuration audit logs
- Web browser update/version telemetry
- Redis and Erlang/OTP application version inventories
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider inventorying all Fortinet FortiAuthenticator, FortiClientWindows, FortiOS, and FortiSandbox instances to identify any running versions in the affected ranges, given confirmed active exploitation of CVE-2025-68686 per CISA KEV. | Asset/configuration management data, vulnerability scanner results, device firmware/software version reporting | Pre-exploitation / Exposure Assessment | Low - this is an inventory and patch-verification exercise rather than a behavioral detection, so false positives are not a primary concern. |
| If Fortinet appliances are internet-facing, consider reviewing authentication and administrative access logs for anomalous login attempts or configuration changes around the disclosure period, in case exploitation of CVE-2025-68686 has already occurred (T1190). | Fortinet device syslog/audit logs, VPN/authentication logs, administrative interface access logs | Initial Access | Medium - legitimate administrative activity could resemble anomalous access without additional context. |
Control Gaps
- Signature-based detection tools (YARA/Snort/Sigma) would not catch unpatched vulnerable software; only patch management and vulnerability scanning close this gap.
- Perimeter firewalls alone would not prevent exploitation of a vulnerability in a Fortinet security appliance itself if that appliance is the vulnerable component.
Key Behavioral Indicators
- Presence of Fortinet software versions within the affected ranges listed in the advisory (behavioral/inventory indicator, not a signature)
- Presence of Microsoft Edge versions prior to 150.0.4078.99
- Presence of Redis versions prior to 8.8.0
- Presence of Erlang/OTP versions in the affected 10.2 or 6.0 branches
False Positive Assessment
Low - this content consists of vendor/vulnerability advisory notifications rather than behavioral detections, so there is minimal false-positive risk; the primary action is patch verification rather than alert tuning.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response and patch management runbook before acting; prioritize patching or upgrading FortiAuthenticator, FortiClientWindows, FortiOS, and FortiSandbox instances affected by CVE-2025-68686 given its addition to CISA's KEV catalog.
- Consider identifying and updating Microsoft Edge (Chromium-based) installations to version 150.0.4078.99 or later.
- Consider upgrading Redis deployments to version 8.8.0 or later to address the corrupt stream RDB handling issue.
- Consider upgrading Erlang/OTP deployments to versions 11.7.4 or 17.0.4 or later, depending on branch.
Infrastructure Hardening
- Evaluate whether internet-facing Fortinet appliances can be restricted to trusted management networks or placed behind additional access controls pending patching.
- Consider establishing or reviewing a vulnerability management process that flags KEV-listed CVEs for expedited remediation timelines.
- Evaluate whether asset inventory tooling accurately tracks software versions for Fortinet, Redis, Erlang/OTP, and browser deployments across the environment.
User Protection
- Consider ensuring endpoint browsers (Microsoft Edge) are configured for automatic updates where organizational policy allows.
- If applicable, evaluate whether FortiClientWindows endpoint agents across the fleet are centrally managed and can be updated via existing endpoint management tooling.
Security Awareness
- Consider briefing IT and security teams on the CISA KEV designation for CVE-2025-68686 to support prioritization of Fortinet patching efforts.
- Consider incorporating regular review of Cyber Centre and CISA KEV advisories into existing vulnerability management and patch cadence processes.
