Acme

A critical vulnerability with a CVSS score of 10.0 was recently disclosed in a popular in-memory cache, allowing authenticated users to execute arbitrary code through crafted scripts. Acme has applied the vendor patch to every cache version we deploy for customers, and the fix ships with this week's scheduled release. In Acme deployments the cache is reachable only by internal services inside the Acme environment and is never exposed to end users or the internet, so the risk of exploitation is minimal.

A critical vulnerability known as GatewayGremlin (CVE-2026-1185) was recently disclosed, affecting a widely used ingress controller in container orchestration environments. With a CVSS score of 9.8, it allows unauthenticated remote code execution and puts clusters that run the affected controller at significant risk. Acme does not run the affected controller in any production or customer environment, so no action is required from customers.

We remain committed to the highest standards of security and will keep monitoring for related advisories.

Subscribe to get notified about security bulletins, compliance changes and product security advisories. We will post updates on vulnerabilities, certifications and our newest security improvements here.