Snapshot 255939
Normalized text
Scripts and page chrome removed; this is what change detection compares.
NinjaOne’s security team is aware of the Node.js vulnerabilities reported on October 21, 2026, specifically CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069. There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities. Following the reported eMudhra certificate authority compromise, NinjaOne has deployed agent updates removing trust in the affected certificate roots across all customer-facing environments, including Commercial and FedRAMP Moderate. NinjaOne’s security team has not detected exploitation of this issue against NinjaOne. This update is an industry-aligned precaution in response to a third-party certificate authority compromise, not a NinjaOne security incident. Most customers will not experience any changes. Customers using certificates that chain to the affected eMudhra roots, including emSign ECC Root CA – G3, are strongly encouraged to replace them. Agent downloads or automations connecting to sites using these certificates may fail certificate validation. If you experience related download or installation failures, contact NinjaOne Support for assistance. View update history October 29, 2026 — Remediation update Updated the notice to confirm that agent updates removing trust in the affected certificate roots have been deployed across all customer-facing environments, including Commercial and FedRAMP Moderate. Added the security team’s finding that no exploitation against NinjaOne has been detected and clarified potential certificate validation failures. October 21, 2026 — Initial notice NinjaOne published a notice about the eMudhra certificate authority compromise reported on October 17, 2026. The notice explained that NinjaOne was removing trust in the affected certificates within the NinjaOne agent as an industry-aligned precaution and encouraged customers using affected certificates to replace them. NinjaOne’s security team is aware of the PHP vulnerabilities reported on October 21, 2026, specifically CVE-2026-109618 and CVE-2026-109619. There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities. Compliance ISO 27018 ISO 42001 DORA FedRAMP High – Ready TX-RAMP GovRAMP FedRAMP Rev5 Class C Certification NIS 2 Directive GDPR CCPA SOC 3 HIPAA SOC 2 ISO 27001:2022 Resources View all 111 resources Controls FedRAMP Moderate FedRAMP Moderate Authorization & Hosting Vulnerability Management Continuous Monitoring & Independent Assessments + 4 more AI Ethical Use of AI & Internal Policy Managing AI Vendor Security AI/ML for Data Excellence + 1 more Product Security Application Program Interface (API) / Integrations Role-Based Access Control (RBAC) SSO + 2 more Information Security Data Classification Data Storage Asset Inventory + 7 more NinjaRemote Enhanced encryption and secure communication for NinjaRemote backend operations Network Security Network Security Organizational Security Change Management Asset Inventory Asset Management + 3 more Privacy Data Processing Agreement Incident Management & Response Data Breach Notification Incident Response Plan (IRP) Business Continuity & Disaster Recovery Recovery Time Objective (RTO) / Recovery Point Objective (RPO) Disaster Recovery Plan Business Continuity Plan Infrastructure Physical Access Control – Data Center SOC 3 – Data Center SOC 2 Type II – Data Center Threat Management Antivirus and Malware Risk Management Penetration Testing + 2 more Third-Party Service Providers / Subprocessors Third Party Risk Management (TPRM) Third-Party Service Providers / Subprocessors Accessibility Statement NinjaOne is committed to making our products accessible and user-friendly to everyone. That’s why we’ve partnered with a third-party to perform accessibility assessments against the Web Content Accessibility Guidelines (WCAG) 2.2 AA / Voluntary Product Accessibility Template (VPAT) 2.5 standards for major products and functionality. In our most recent testing, the NinjaOne core platform achieved “Supports” or “Partially supports” for all applicable WCAG 2.2 criteria. Our VPAT reports are available to customers or prospects upon request. As we develop and release new products and features, we conduct ongoing accessibility testing to identify potential compliance gaps. We are committed to making commercially reasonable efforts to resolve these issues based on their severity and the scope of the changes they require. We also incorporate accessibility objectives into our regular release planning and prioritize them alongside other development initiatives. Your feedback helps us ensure our solutions are accessible and aligned with your specific module usage and assistive technology needs. We recognize that accessibility is a priority for the NinjaOne community and are committed to incorporating these requirements into our broader product roadmap. For questions or suggestions, please contact your account team or email us at [email protected]. Subprocessors View all subprocessors Exypnox Technical Support Services Philippines Amazon Web Services Cloud Infrastructure/Hosting USA, Canada, Germany, Australia Zendesk Cloud Support Services USA, Germany, Ireland, Australia, Japan Sentry Troubleshooting and Debugging USA Pendo Usage Analytics GCP EU multi-region Google Cloud Provider Cloud Services and Fraud Prevention USA, GCP EU-multi region Panther Labs Security Information and Event Management USA, Germany, Australia Anthropic Enterprise AI Services for Technical Support USA, Canada, Germany, Australia, Ireland, UK, Singapore, Japan FAQ View all 109 FAQs What types of PII data are stored in NinjaOne? NinjaOne does not typically process personal and/or sensitive data, please refer to our DPA for more details. The solution collects computer information (e.g., computer name, hardware type, local IP address, file structures, etc.). Does NinjaOne have written policies, procedures and/or processes in place to ensure the proper management and supervision of staff for the preparation, review, execution of your operations? Yes Is NinjaOne GDPR compliant? Yes Does NinjaOne have a documented Information Security Policy? Yes PDF Viewer Download