Customer Advisory: NCSC Advisory on CVE-2026-109618 and CVE-2026-1096191

Following the recent National Cyber Security Centre (NCSC) advisory regarding vulnerabilities CVE-2026-109618 and CVE-2026-1096191, Aridhia has completed an assessment of its managed services and public-facing platforms.

Assessment Outcome

We can confirm that:

  • The Aridhia Digital Research Environment (DRE) is not impacted by CVE-2026-109618 or CVE-2026-1096191.
  • The Aridhia public website is not impacted by these vulnerabilities.
  • The Aridhia Knowledge Base is not impacted by these vulnerabilities.

Actions Taken

As part of our established vulnerability management and security monitoring processes, Aridhia's Information Security and Operations teams have reviewed:

  • DRE platform components and supporting infrastructure.
  • Public-facing services and web applications.
  • The Aridhia website and Knowledge Base platforms.
  • Available threat intelligence and vendor guidance relating to the reported vulnerabilities.

No vulnerable components have been identified within Aridhia-managed services.

Customer-Managed Virtual Machines

As a precautionary measure, we are currently analysing customer-controlled virtual machines (VMs) hosted within the DRE to determine whether any customer-managed components may be affected by these vulnerabilities.

This assessment is ongoing. We will provide a further update to affected customers once the analysis has been completed and any required remediation actions have been identified.

Ongoing Monitoring

Aridhia continues to monitor guidance from the NCSC, technology vendors, and threat intelligence sources. Should new information become available that changes the assessed risk profile, we will review our position and take any necessary actions in accordance with our security management processes.

Customer Impact

At this time:

  • There is no identified impact to Aridhia-managed services.
  • No action is required from customers in relation to Aridhia-managed platforms.
  • A further communication will be issued regarding the status of customer-controlled VMs once the ongoing analysis has been completed.

If you have any questions regarding this advisory, please contact the Aridhia Information Security team.

Back to top