Security is built into the fabric of our products, team, infrastructure, and processes, so you can be rest assured your data is safeguarded.
Privacy Policy | EULA | DPA
NinjaOne continues to monitor for threats and vulnerabilities across all of our systems and services. Protecting our customers and their data remains NinjaOne’s top priority.
Published:
NinjaOne’s security team is aware of the Node.js vulnerabilities reported on October 21, 2026, specifically CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069.
There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities.
Originally published:
Last updated:
Following the reported eMudhra certificate authority compromise, NinjaOne has deployed agent updates removing trust in the affected certificate roots across all customer-facing environments, including Commercial and FedRAMP Moderate.
NinjaOne’s security team has not detected exploitation of this issue against NinjaOne. This update is an industry-aligned precaution in response to a third-party certificate authority compromise, not a NinjaOne security incident.
Most customers will not experience any changes. Customers using certificates that chain to the affected eMudhra roots, including emSign ECC Root CA – G3, are strongly encouraged to replace them. Agent downloads or automations connecting to sites using these certificates may fail certificate validation.
If you experience related download or installation failures, contact NinjaOne Support for assistance.
Updated the notice to confirm that agent updates removing trust in the affected certificate roots have been deployed across all customer-facing environments, including Commercial and FedRAMP Moderate. Added the security team’s finding that no exploitation against NinjaOne has been detected and clarified potential certificate validation failures.
NinjaOne published a notice about the eMudhra certificate authority compromise reported on October 17, 2026. The notice explained that NinjaOne was removing trust in the affected certificates within the NinjaOne agent as an industry-aligned precaution and encouraged customers using affected certificates to replace them.
Published:
NinjaOne’s security team is aware of the PHP vulnerabilities reported on October 21, 2026, specifically CVE-2026-109618 and CVE-2026-109619.
There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities.
NinjaOne is committed to making our products accessible and user-friendly to everyone. That’s why we’ve partnered with a third-party to perform accessibility assessments against the Web Content Accessibility Guidelines (WCAG) 2.2 AA / Voluntary Product Accessibility Template (VPAT) 2.5 standards for major products and functionality. In our most recent testing, the NinjaOne core platform achieved “Supports” or “Partially supports” for all applicable WCAG 2.2 criteria. Our VPAT reports are available to customers or prospects upon request.
As we develop and release new products and features, we conduct ongoing accessibility testing to identify potential compliance gaps. We are committed to making commercially reasonable efforts to resolve these issues based on their severity and the scope of the changes they require. We also incorporate accessibility objectives into our regular release planning and prioritize them alongside other development initiatives. Your feedback helps us ensure our solutions are accessible and aligned with your specific module usage and assistive technology needs. We recognize that accessibility is a priority for the NinjaOne community and are committed to incorporating these requirements into our broader product roadmap.
For questions or suggestions, please contact your account team or email us at [email protected].
NinjaOne does not typically process personal and/or sensitive data, please refer to our DPA for more details. The solution collects computer information (e.g., computer name, hardware type, local IP address, file structures, etc.).
Yes
Yes
Yes
