Advisories and Notifications

Canon is aware of reports that multiple TLS intermediate certificates issued by eMudhra Limited have been compromised, potentially impacting the trust and integrity of TLS/SSL communications.

We are currently investigating the impact of these exposed TLS intermediate certificates on our products, solutions and services.

At this stage of our investigation, we have concluded that the following product is impacted. We recommend following the advice provided in the link below:

• uniFLOW sysHUB

The following products are not impacted, and this list will be updated once we receive further information:

• Print In City

• Readiris PDF, IRISPowerscan, IRISPulse, IRISOCR, and IRISXtract

• Therefore™ Online and Therefore™ On-Premises

• uniFLOW Server and uniFLOW Online

Update History:

30 October 2026: Created.

Two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been identified in PHP that may allow unauthenticated remote code execution.

We have been investigating the impact of these vulnerabilities on Canon-branded products and services. We have completed the assessment of many of products and services and as a result, no adverse impact on customers has been confirmed at this time. For the Canon-branded products and internet services identified through our assessment to date, the necessary updates have been applied, with no customer action required. We are continuing to assess the remaining Canon-branded products and services*****.

At this stage of our investigation, we have concluded that the following products are not impacted. This list will be updated once we receive further information:

• Canon Production Printing Products**

• MarketDirect StoreFront**

• OL Connect Suite****

• ONYX Align**

• ONYX Thrive, ONYX PosterShop and ONYX RIPCenter, all supported versions, including bundled components such as ONYX Cut-Server, Media Manager, Dashboard and Layout Tool**

• PaperCut MF***

• Print In City*

• Readiris PDF, IRISPowerscan, IRISPulse*, IRISOCR*, and IRISXtract

• Scan2x**

• Scrive*****

• Therefore™ Online and Therefore™ On-Premises*

• Tungsten Power PDF, Tungsten ControlSuite, Tungsten eCopy ShareScan, and Tungsten SafeCom***

• uniFLOW Online, uniFLOW Server, sysHUB and associated application and services

The following third-party product(s) are impacted, and we recommend following the advice provided in the link(s) below:

• MyQ*

We do note that the following applications and services were impacted by the above PHP vulnerabilities but were promptly patched. No further customer action is required: ****

• CaptureOnTouch Scan to Legal Case Plugin for Windows****

• CaptureOnTouch Scan to QuickBooks Online Plugin Pro for macOS****

• CaptureOnTouch Scan to QuickBooks Online Plugin Pro for Windows****

• Creative Park****

• LFP e-Service****

• LFP Monitor****

• Quick Scan (Box Users)****

• R40 Receipt Edition Software Installer for Mac****

• R40 Receipt Edition Software Installer for Windows****

• Scan for QuickBooks Online (Web Version for QBO users)****

• Web Manual (Server)****

Update History:

30 October 2026: Updated not impacted product list (*****).

29 October 2026: Updated impacted and not impacted product, application and service list. No further action is required from customers (****).

28 October 2026: Updated not impacted product list (***).

26 October 2026: Updated not impacted product list (**).

23 October 2026: Updated impacted and not impacted product list (*).

22 October 2026: Created.

A vulnerability has been identified in the uniFLOW Online Legacy UI relating to the Reduced Function Login feature (CVE-2026-92378), which could retain a previous user session when the device entered "Service Offline" Emergency Mode. During an investigation of the Legacy UI, it was discovered that the login process contained a logic flaw associated with the Reduced Function Login mechanism. Under a specific sequence of actions, the session of a previously authenticated user could be retained on the device. As a result, User B, a subsequently authenticated user, could potentially be logged on to the device as User A, the previously authenticated user.

Canon and NT-ware take security vulnerabilities seriously and can confirm that we have received no reports of active exploitation of this vulnerability. NT-ware has implemented a global fix to ensure correct login behaviour across all deployments. As the remediation has already been applied globally, no further action is required from customers.

Further details regarding the vulnerability, affected versions, and the globally deployed fix can be found at:

Security Advisory: Previous login session retained when entering Reduced Function Login

A vulnerability has been identified in the uniFLOW Universal Login Manager (ULM) Standalone product (CVE-2026-1433) that could allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface (RUI). Exploitation requires administrative privileges and may result in the disclosure of configuration data associated with SMTP or LDAP integrations. Deployments connected to uniFLOW Server or uniFLOW Online are not affected.

Canon along with NT-ware takes security vulnerabilities seriously and recommends that customers using affected versions of uniFLOW ULM Standalone apply the available update. To maintain the security of uniFLOW ULM Standalone environments, an update is required for all affected installations.

Although we have not received any reports of active exploitation of this vulnerability, we strongly recommend reviewing the security advisory and implementing the recommended remediation measures at the earliest opportunity.

Details regarding the vulnerability, affected versions, and recommended mitigation and remediation steps can be found at:

Security Advisory: ULM Potential Information Disclosure

Canon would like to thank the following researcher for identifying the vulnerability:

• CVE-2026-1433: Sam Shepherd working with BAE Systems

Description:
OpenSSL has identified a vulnerability in which a malicious user can supply a Cryptographic Message Syntax (CMS) message with an oversized Initialization Vector (IV). OpenSSL copies this IV into a fixed‑size stack buffer without validating its length, resulting in a stack buffer overflow. This vulnerability affects OpenSSL’s parsing of CMS AuthEnvelopedData and EnvelopedData structures that use Authenticated Encryption with Associated Data (AEAD) ciphers such as AES‑GCM.

The potential impacts of this vulnerability include:
• Denial of Service (DoS) due to application crashes
• Potential remote code execution, depending on platform mitigations
• No valid key material required by the attacker, as the stack buffer overflow occurs before authentication

IRIS has taken this vulnerability seriously and confirmed that one of its products uses OpenSSL. The affected product is IRIS XMailFetcher.

Affected Versions:
IRIS XMailFetcher: Version 5.0.29 and earlier.

Remediation/Mitigation:
IRIS has released IRIS XMailFetcher version 5.0.30, a security update that addresses this vulnerability (CVE‑2025‑15467).

This release includes no additional changes or new features and is focused solely on resolving this issue.

We strongly recommend updating to version 5.0.30 as soon as possible. If you require assistance with the update, please contact our support team.

The fix is available under “download center” and the communication can be found under “Technical News” in the IRIS Partner Portal, under the headline: “IRIS XMailFetcher 5.0.30 – CVE‑2025‑15467 Fix”.

Please note that IRIS resolved this issue by releasing the fix on 19 February 2026.

There have been no reports of this vulnerability being exploited in the wild. However, to enhance product security, we advise all customers to install the latest IRIS XMailFetcher version 5.0.30.

CVE/CVSS:
CVE-2025-15467: A stack buffer overflow vulnerability in OpenSSL affecting the parsing of CMS AuthEnvelopedData and EnvelopedData messages. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score: 9.3.

Description:
Therefore Corporation GmbH has recently become aware that Therefore™ Online and Therefore™ On-Premises contain an account impersonation vulnerability. A malicious user may potentially be able to impersonate the web service account or the account of a service using the API when connecting to the Therefore™ Server. If the malicious user gains this impersonation user access, then it is possible for them to access the documents stored in Therefore™. This impersonation is at application level (Therefore access level), not the operating system level.

Affected Versions:
All Therefore™ Online and Therefore™ On-Premises versions.

Remediation/Mitigation:
For Therefore™ Online systems, customers have already been patched. No further action is required from users or administrators.

For Therefore™ On-Premises systems, a hotfix is available to install. We strongly recommend patching all Therefore™ On-Premises systems, regardless of version. We request our customers to please contact your local Canon office or authorized reseller partner for more information.

Please note that Therefore Corporation GmbH resolved this issue by releasing a hotfix on 20 October 2025.

CVE/CVSS:
CVE-2025-11843: Therefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N Base Score: 8.8.

Canon U.S.A., Inc. has recently become aware that the Canon EOS Webcam Utility Pro for MAC OS contains an improper directory permissions vulnerability. Exploitation of this potential vulnerability requires administrator access by a malicious user. An attacker could modify the directory, potentially resulting in code execution and ultimately leading to privilege escalation.

Whilst we have not received any reports of exploitation, we recommend that you read the security advisory link.

Details of the vulnerability, mitigation and remediation can be found at:

Security Advisory: Vulnerability Mitigation/Remediation for Canon EOS Webcam Utility Pro for MAC OS

A potential issue of the uniqueness of an ID card has been identified in the card readers rebranded by NT-ware (originally developed and provided by rf IDEAS) and published CVE-2024-1578.

Whilst we have not received any reports of exploitation, we recommend that you read the security advisory link.

Details of the vulnerability, mitigation and remediation can be found at:

Security Advisory: Multiple MiCard PLUS card reader dropped characters

A potential susceptibility to compromise in device registration has been identified in uniFLOW Online and published CVE-2024-1621.

Whilst we have not received any reports of exploitation, we recommend that you read the security advisory link.

Details of the vulnerability, mitigation and remediation can be found at:

Security Advisory: Device registration susceptible to compromise

A potential data exposure vulnerability has been identified in uniFLOW Server and uniFLOW Remote Print Server.

Whilst we have not received any reports of exploitation, we recommend that you upgrade your implementation to the latest version.

Details of the vulnerability, mitigation and remediation can be found at:

Security Advisory: MOM Tech Support Vulnerability - NT-ware Support