Mattermost security advisory (AV26-828)

unknownCVE-2026-9816

Serial Number: AV26-828 Date: August 18, 2026 As of August 17, 2026, Mattermost is affected by vulnerabilities in the following product: Mattermost Prior to or equal to 10.11.21 Prior to or equal to 11.7.6 Prior to or equal to 11.8.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-9816 Detail Mattermost Security Updates

CSIRTS triage

vendor: Mattermost product: MattermostOtheraffected: ≤10.11.21, ≤11.7.6, ≤11.8.3

What: Mattermost contains one or more unspecified vulnerabilities affecting multiple version branches.
Who is affected: Mattermost deployments on versions 10.11.21 and earlier, 11.7.6 and earlier, or 11.8.3 and earlier.
Urgency: Moderate; severity is unknown and no active exploitation reported, but multiple version branches affected suggests widespread impact.
Action: Update to versions after 10.11.21, 11.7.6, and 11.8.3 respectively as patches become available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Mattermost

Get an email when a new Mattermost advisory drops — max one per day, one-click unsubscribe.

Details

Source: Canadian Centre for Cyber Security (CA · national-cert · site)
Severity: unknown
Published: 2026-08-18
Exploitation: Not in CISA KEV at last sync

Original advisory: https://cyber.gc.ca/en/alerts-advisories/mattermost-security-advisory-av26-828

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-98160.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-9816	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.