Cyber Centre Daily Advisory Digest — 2026-09-09 (4 advisories)
Canadian Cyber Centre published four vendor advisories covering unpatched vulnerabilities in Fortinet, Commvault, NVIDIA Triton Inference Server, and MISP products. Four vendor security advisories were published on 2026-09-09 covering Fortinet, Commvault, NVIDIA, and MISP products. No CVE IDs, severity scores, or exploit details are included; administrators are directed to vendor PSIRT pages for patch information.
Detection / Hunteropenrouter
Immediate Actions
- Review Fortinet PSIRT advisory page and patch all affected FortiOS and FortiProxy instances.
- Update Commvault Cloud to builds 11.36.123, 11.40.72, 11.44.20, or 11.46.20 respectively.
- Update NVIDIA Triton Inference Server to versions above 26.03 and 26.06.
- Update MISP to a version above 2.5.45.
Key Takeaways
- Fortinet advisory AV26-898 covers FortiOS, FortiProxy, FortiPam, FortiSandbox, and FortiMonitorOnSight versions.
- Commvault Cloud versions 36.0 through 46.0 require updates prior to listed build numbers.
- NVIDIA Triton Inference Server versions 0.0 to 26.03 and 0.0 to 26.06 are affected.
- MISP versions prior to or equal to 2.5.45 are affected; update recommended.
- No CVE IDs, severity ratings, or exploit details are provided in the digest.
Affected Systems
- FortiOS 7.6 versions 7.6.1 to 7.6.6
- FortiProxy 7.6 versions 7.6.2 to 7.6.6
- FortiPam Chrome Extension 8.0 and 7.4 all versions
- FortiSandbox 5.0 and 4.4 multiple versions
- Commvault Cloud 36.0 through 46.0 prior to listed builds
- NVIDIA Triton Inference Server 0.0 to 26.03 and 26.06
- MISP prior to or equal to 2.5.45
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | No detection logic or behavioral indicators are described in the advisories. |
| Network Visibility | None | No network indicators or C2 infrastructure are mentioned in the digest. |
| Detection Difficulty | Easy | Detection is straightforward version checking against published advisory ranges. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Identify hosts running FortiOS, FortiProxy, FortiSandbox, or FortiMonitorOnSight within the affected version ranges (T1082). | Asset inventory, CMDB, or endpoint version data | Discovery | Low — version matching is deterministic |
| Identify servers running NVIDIA Triton Inference Server versions 0.0 to 26.06 (T1082). | Container or host inventory with software version data | Discovery | Low — version matching is deterministic |
Required Log Sources
- Vendor PSIRT advisory feeds
- Asset inventory and version tracking
Key Behavioral Indicators
- FortiOS or FortiProxy running versions below latest patched release
- Commvault Cloud running build numbers below listed minimums
- MISP instance at version 2.5.45 or earlier
Control Gaps
- No vulnerability scanning coverage for FortiPam Chrome Extension
- No asset inventory for NVIDIA Triton Inference Server deployments
- No automated patch compliance reporting for MISP instances
False Positive Assessment
Low — advisories reference specific product versions; matching is deterministic with no behavioral indicators to misfire.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enable automatic update notifications for all Fortinet product PSIRT feeds.
- Subscribe to Commvault and NVIDIA security bulletin mailing lists.
- Implement version-based access blocking for unpatched FortiProxy gateways.
User Protection
- Remove or disable FortiPam Chrome Extension versions 8.0 and 7.4 until patched.
- Restrict network access to unpatched FortiSandbox and FortiMonitorOnSight appliances.
Plain-Language Summary
Canada's cyber agency published four security advisories on September 9, 2026. They warn that several products from Fortinet, Commvault, NVIDIA, and MISP have known security flaws that need patching. Administrators should review the vendor links and apply updates. No details about active attacks are provided.