Cyber Centre Daily Advisory Digest — 2026-09-08 (6 advisories)
Six vendor advisories from the Canadian Cyber Centre flag actively exploited vulnerabilities in N-able, MikroTik, and Adobe products; patch SonicWall, Dell, and OpenVPN immediately. N-able N-central, MikroTik RouterOS, and Adobe Commerce are affected by CVEs actively exploited in the wild. Administrators must prioritize patching these products alongside SonicWall NSM, Dell infrastructure, and OpenVPN updates.
Detection / Hunteropenrouter
Immediate Actions
- Patch N-able N-central to 2026.3.1.14 or later.
- Apply MikroTik RouterOS updates to fixed versions.
- Install Adobe Commerce hotfix for CVE-2026-7565.
Key Takeaways
- N-able CVE-2026-86218 is actively exploited; patch N-central to 2026.3.1.14.
- MikroTik RouterOS CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060 are exploited in the wild.
- Adobe Commerce CVE-2026-75650 is actively exploited; apply the hotfix for CVE-2026-7565.
- SonicWall NSM On-Prem versions 4.3.0 and earlier have multiple vulnerabilities.
- OpenVPN versions 2.6.22 and 2.7.6 are vulnerable to CVE-2026-84732.
Attack Chain
- Initial Access: Attackers exploit unpatched vulnerabilities in N-able, MikroTik, or Adobe products
- Execution: Exploitation of CVEs allows unauthorized access or code execution
- Persistence: Maintaining access through compromised network or application infrastructure
- Impact: Potential data exfiltration, system compromise, or network disruption
Affected Systems
- SonicWall NSM On-Prem 4.3.0 and earlier
- N-able N-central prior to 2026.3.1.14
- Dell iDRAC9, iDRAC10, PowerEdge Server
- Dell Avamar, PowerProtect DP, IDPA, PowerScale OneFS
- MikroTik RouterOS (multiple versions)
- Adobe Commerce, Magento Open Source, OpenVPN
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-86218 | N-able N-central | Exploited in the wild; details not specified in advisory. | |
| CVE-2026-67276 | MikroTik RouterOS | Exploited in the wild; details not specified in advisory. | |
| CVE-2026-67277 | MikroTik RouterOS | Exploited in the wild; details not specified in advisory. | |
| CVE-2026-86060 | MikroTik RouterOS | Exploited in the wild; details not specified in advisory. | |
| CVE-2026-7565 | Adobe Commerce, Magento Open Source | Hotfix available; details not specified in advisory. | |
| CVE-2026-75650 | Adobe Commerce | Exploited in the wild; details not specified in advisory. | |
| CVE-2026-84732 | OpenVPN | Reliability layer unbounded TLS timeout and acks for non-outstanding packets. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Advisory focuses on patching; no endpoint detection logic provided. |
| Network Visibility | Low | No network indicators or detection rules provided in the advisories. |
| Detection Difficulty | Hard | Exploitation details are absent; detection relies on identifying unpatched versions. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for unpatched instances of N-able N-central, MikroTik RouterOS, and Adobe Commerce (T1190). | Asset inventory and vulnerability scan results. | Initial Access | Low — version identification is deterministic. |
Required Log Sources
- Vulnerability scanner output
- Vendor advisory feeds
- Firewall and IDS logs
Key Behavioral Indicators
- Presence of vulnerable software versions on the network
- Unusual traffic to N-able, MikroTik, or Adobe services
Control Gaps
- Lack of automated patch management for edge devices
- Delayed vulnerability scanning cycles
False Positive Assessment
Low — Advisories are vendor-confirmed and specify exact vulnerable versions.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Update SonicWall NSM On-Prem to versions newer than 4.3.0.
- Patch Dell iDRAC, Avamar, and PowerScale to latest releases.
- Update OpenVPN to versions newer than 2.6.22 and 2.7.6.
User Protection
- Restrict administrative access to affected products.
- Monitor for unauthorized configuration changes.
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
The Canadian government issued six security alerts for software from SonicWall, N-able, Dell, MikroTik, Adobe, and OpenVPN. Attackers are actively exploiting vulnerabilities in N-able, MikroTik, and Adobe products. Administrators using these products should apply the available updates immediately to prevent unauthorized access.
- cveCVE-2026-67276Exploited in the wild; details not specified in advisory.
- cveCVE-2026-67277Exploited in the wild; details not specified in advisory.
- cveCVE-2026-7565Hotfix available; details not specified in advisory.
- cveCVE-2026-75650Exploited in the wild; details not specified in advisory.
- cveCVE-2026-84732Reliability layer unbounded TLS timeout and acks for non-outstanding packets.
- cveCVE-2026-86060Exploited in the wild; details not specified in advisory.
- cveCVE-2026-86218Exploited in the wild; details not specified in advisory.