Snapshot 224545
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Centre Start your security review Overview At Softcat, trust is at the heart of everything we do. Our customers, partners, and stakeholders rely on us to protect their data, operate ethically, and uphold the highest standards of security and compliance. We take that responsibility seriously. We are committed to robust cybersecurity, ethical business practices, and transparent governance. Our Trust Centre provides access to key documentation and certifications that demonstrate our dedication to these principles. Want to be part of our journey? 🔐 Explore Careers at Softcat 🤝 Work with Softcat Compliance Cyber Essentials Cyber Essentials Plus FSQS GDPR ISO 14001:2015 ISO 22301:2019 ISO 50001:2018 ISO 9001:2015 ISO/IEC 20000-1:2018 ISO/IEC 27001 SoA ISO/IEC 27001:2022 JOSCAR NHS DSPT (UK) PCI DSS Documents/Certificates COMPLIANCECyber Essentials COMPLIANCECyber Essentials Plus COMPLIANCEFSQS COMPLIANCEGDPR COMPLIANCEISO 14001:2015 COMPLIANCEISO 22301:2019 COMPLIANCEISO 50001:2018 COMPLIANCEISO 9001:2015 COMPLIANCEISO/IEC 20000-1:2018 COMPLIANCEISO/IEC 27001 SoA COMPLIANCEISO/IEC 27001:2022 COMPLIANCEJOSCAR Corporate Security Asset Management Practices Employee Training Incident Response View more Policies Acceptable Use Policy Access Control Policy AI Policy View more Physical & Environment Physical Access Security Legal Insurance Letter PLC Insurance Letter LLC Network Security Firewall Security Information and Event Management BC/DR Alternate Processing/Storage Site Business Continuity Management System (BCMS) Business Continuity Plan (BCP) View more ESG Anti-Bribery and Corruption Anti-Modern Slavery Diversity, Equity, and Inclusion View more Data Privacy Data Privacy Officer Employee Privacy Training Privacy Whitepaper View more Change Management Change Management Program Trust Centre Updates PHP2Shell Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Vulnerabilities Softcat is aware of the recently disclosed PHP vulnerability and has reviewed its potential impact across our environment. Affected software was identified in support of Softcat.com. Existing web application firewall protections mitigated the immediate risk, and the required fix has now been successfully deployed. We have also identified affected PHP components within some third-party applications, in these instances the relevant vendor updates are being tracked and applied. At this time, we have not identified any impact to customer data or Softcat’s customer-facing services. We continue to monitor the situation and will update this statement if there is any material change. For queries relating to third-party products resold by Softcat, customers should contact the relevant vendor directly or review its published security advisories, if further assistance is required, your Softcat Account Manager can help facilitate this We are aware of the upcoming PHP security release and are currently assessing our environment for any potential exposure. Based on the information available to us at this time, we do not believe our systems are affected. We will continue to monitor the situation as further details emerge. Should any impact be identified, remediation activities will be carried out in accordance with our established vulnerability management processes and security policies, which are available on our trust centre. Fortinet “FortiBleed” (credential exposure) vulnerability Vulnerabilities Softcat is aware of the Fortinet “FortiBleed” (credential exposure) vulnerability impacting certain FortiGate devices and related services. We can confirm that Softcat does not use Fortinet FortiGate firewalls or associated perimeter/VPN services within our own internal operations, and we are not aware of any impact to Softcat or our managed service offerings at this time. As an IT reseller, Softcat provides access to a wide range of vendor technologies, including Fortinet products which may be procured by customers. Where customers have deployed Fortinet solutions within their own environments, they should follow Fortinet’s published guidance, including the rotation of any potentially exposed credentials and review of affected devices. Fortinet is communicating directly with impacted customers and partners. If you require any assistance engaging with Fortinet or other vendors in relation to products procured via Softcat, please contact your account manager for support. React2Shell Vulnerability Statement Vulnerabilities Softcat are closely monitoring the React2Shell vulnerability impacting applications built using React. We can confirm that Softcat has not been impacted by this and in addition, we have undertaken an internal exercise to identify any instances of React software within our estate and ensure they were updated to the latest secure versions. As a technology reseller, Softcat offers customers a route to procure products and services from third party vendors, whom may use React in their operations. Customers should monitor for notifications from these vendors directly. Should assistance contacting vendors be required you can contact your account manager for support. Salesloft Drift Statement. General Softcat are closely following the incident impacting Salesforce customers utilising Salesloft Drift. We can confirm that Softcat does not utilise Salesforce in our own operations and are not aware of any impact to us or customers of our own managed service offerings at this time. As an IT reseller, Softcat provides a route for customers to procure products and services from thousands of vendors, many of whom will utilise Salesforce in their operations. Impacted vendors, such as Cloudflare, Palo Alto and Zscaler are notifying customers directly. If you require any assistance contacting vendors in relation to services procured through Softcat, please contact your account manager for support. Oracle Fusion General Softcat is aware of and is closely following the news and commentary associated with the suspected Oracle data breach. We are also aware that our domain appears in the CloudSek search tool, which lists the domains the threat actor has claimed are affected by this incident. Softcat does not use Oracle Cloud or Fusion applications; however, we do utilise Netsuite as our ERP. Our user access to this is secured by SSO with conditional access policies that should mitigate any risk to user accounts. Although Oracle has not yet issued any guidance on suggested mitigation, we have rotated credentials on local accounts that include our non-human identities stored within the platform. At present, we are not aware of any impact to Softcat or our customers arising from this event. We will continue to closely monitor this situation and will notify our customers if this changes.