{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-65660", "aliases": [], "title": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition：コード実行", "summary": "Microsoft Office SharePoint においてコード生成の制御が不適切であり、認可された攻撃者がネットワーク越しにコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "product": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition", "category": "windows", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft SharePoint Enterprise Server 2016", "range": ">= 16.0.0 / < 16.0.5565.1001（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server 2019", "range": ">= 16.0.0 / < 16.0.10417.20198（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server Subscription Edition", "range": ">= 16.0.0 / < 16.0.19725.20522（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-65660", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65660", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-11T17:04:55.666Z", "modifiedAt": "2026-10-21T20:52:28.070Z", "fetchedAt": "2026-10-23T02:43:49.912Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.5565.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.10417.20198", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.19725.20522", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-65660", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "fetchedAt": "2026-10-23T02:43:49.912Z", "publishedAt": "2026-08-11T17:04:55.666Z", "modifiedAt": "2026-10-21T20:52:28.070Z", "state": "published", "provider": "microsoft", "title": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.0", "lessThan": "16.0.5565.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.0", "lessThan": "16.0.10417.20198", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "16.0.19725.20522", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en-US", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "label": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://blog.previdian.com/cve-2026-65660-previdian-observes-two-stage-sharepoint-exploitation-attempts/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-65660", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5565.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20198\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20522\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-94: Improper Control of Generation of Code ('Code Injection')\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-94\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-21T20:52:28.070Z", "fetchedAt": "2026-10-23T02:43:49.912Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-25T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:36.057Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "769dbd5f05dff12fe44ab73b719f4068169f5a00cfb0bf5741eee3e5976e4c55", "sourceModifiedAt": "2026-10-21T20:52:28.070Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office SharePoint においてコード生成の制御が不適切であり、認可された攻撃者がネットワーク越しにコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft SharePoint Enterprise Server 2016（x64） のバージョン 16.0.0 から 16.0.5565.1001 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Microsoft SharePoint Server 2019（x64） のバージョン 16.0.0 から 16.0.10417.20198 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Microsoft SharePoint Server Subscription Edition（x64） のバージョン 16.0.0 から 16.0.19725.20522 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5565.1001未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20198未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20522未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-65660", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-65660" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-65660", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-65660" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-65660", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-65660" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-65660", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65660", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65660", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft SharePoint Server Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5565.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20198\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/65xxx/CVE-2026-65660.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20522\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-65660", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-65660\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-65660（Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft SharePoint Enterprise Server 2016（x64） のバージョン 16.0.0 から 16.0.5565.1001 未満が影響を受ける。\n・Microsoft SharePoint Server 2019（x64） のバージョン 16.0.0 から 16.0.10417.20198 未満が影響を受ける。\n・Microsoft SharePoint Server Subscription Edition（x64） のバージョン 16.0.0 から 16.0.19725.20522 未満が影響を受ける。\n・公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5565.1001未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20198未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20522未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-65660", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:36.057Z", "lastSuccess": "2026-10-23T03:21:36.057Z", "sourceCheckedAt": "2026-10-23T02:43:49.912Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-67279", "aliases": [], "title": "RouterOS：脆弱性情報", "summary": "RouterOS の SSH は、クライアントが再鍵化（rekey）を要求した後、認証が一度も行われていなくても接続プロトコルに進み、認証されていないクライアントがセッションチャンネルを開いて exec リクエストを送信できるようになります。影響を受けたビルドではサーバーがそのコマンドを実行し、認証されていない状態で RouterOS が管理するファイル名前空間内のファイル（設定や診断データを含むサポートファイル）を作成、上書き、再構築できるようになります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "risk": "認証されていない攻撃者が RouterOS のファイル名前空間にファイルを作成・上書き・再構築でき、設定情報や診断データが不正に書き換えられる可能性があります。", "product": "RouterOS", "category": "other", "component": "package", "severity": "medium", "cvss": 6.9, "cvssVersion": "4.0", "cvssSource": "CERT-PL", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "RouterOS", "range": ">= 7.24 / < 7.24.2" }, { "product": "RouterOS", "range": ">= 7.0.0 / < 7.23.4" }, { "product": "RouterOS", "range": ">= 6.0.0 / < 6.49.21" } ], "fixed": [], "steps": [ "RouterOS をバージョン 6.49.21（Long‑term）または 7.23.4（Long‑term）または 7.24.2（Stable）にアップデートして脆弱性を修正してください。", "「CVE-2026-67279」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-67279", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67279", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-05T20:00:57.894Z", "modifiedAt": "2026-09-26T03:55:45.145Z", "fetchedAt": "2026-10-23T02:43:50.059Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourceTitle": "SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Mikrotik", "product": "RouterOS", "versions": [ { "status": "affected", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom" }, { "status": "affected", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-67279", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "fetchedAt": "2026-10-23T02:43:50.059Z", "publishedAt": "2026-09-05T20:00:57.894Z", "modifiedAt": "2026-09-26T03:55:45.145Z", "state": "published", "provider": "CERT-PL", "title": "SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS", "descriptions": [ { "lang": "en", "value": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Mikrotik", "product": "RouterOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-841", "lang": "en", "description": "CWE-841 Improper enforcement of behavioral workflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM", "provider": "CERT-PL", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CERT-PL", "tags": [ "third-party-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/0" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CERT-PL", "tags": [ "technical-description" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/1" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CERT-PL", "tags": [ "exploit" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/2" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CERT-PL", "tags": [ "vendor-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/3" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/4" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/5" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/6" }, { "url": "https://bishopfox.com/blog/mikrotrick-inside-the-routeros-takeover-chain", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67279", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-841\",\"description\":\"CWE-841 Improper enforcement of behavioral workflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.9,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-26T03:55:45.145Z", "fetchedAt": "2026-10-23T02:43:50.059Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-25T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "RouterOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:36.307Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6e4873a3c423f46a7a9af08d01ce5f2b982509cef7757db9a478baaa7a21c125", "sourceModifiedAt": "2026-09-26T03:55:45.145Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "RouterOS の SSH は、クライアントが再鍵化（rekey）を要求した後、認証が一度も行われていなくても接続プロトコルに進み、認証されていないクライアントがセッションチャンネルを開いて exec リクエストを送信できるようになります。影響を受けたビルドではサーバーがそのコマンドを実行し、認証されていない状態で RouterOS が管理するファイル名前空間内のファイル（設定や診断データを含むサポートファイル）を作成、上書き、再構築できるようになります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "risk": "認証されていない攻撃者が RouterOS のファイル名前空間にファイルを作成・上書き・再構築でき、設定情報や診断データが不正に書き換えられる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "SSH 接続時にクライアントが再鍵化を要求し、認証が行われていない状態でプロトコルが進行する場合に脆弱性が発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 6.0.0 以上 6.49.21 未満の RouterOS が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 7.0.0 以上 7.23.4 未満の RouterOS が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 7.24 以上 7.24.2 未満の RouterOS が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3" ] }, { "text": "「RouterOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-67279", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67279" ] } ], "actions": [ { "text": "RouterOS をバージョン 6.49.21（Long‑term）または 7.23.4（Long‑term）または 7.24.2（Stable）にアップデートして脆弱性を修正してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-67279」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-67279", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67279" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-67279", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67279" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-67279", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67279" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-67279", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67279" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-67279", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67279", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourceField": "/containers/cna/title", "excerpt": "SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67279.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67279", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-67279\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-67279（RouterOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SSH 接続時にクライアントが再鍵化を要求し、認証が行われていない状態でプロトコルが進行する場合に脆弱性が発生します。\n・バージョン 6.0.0 以上 6.49.21 未満の RouterOS が影響を受けます。\n・バージョン 7.0.0 以上 7.23.4 未満の RouterOS が影響を受けます。\n・バージョン 7.24 以上 7.24.2 未満の RouterOS が影響を受けます。\n・公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-67279", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:36.307Z", "lastSuccess": "2026-10-23T03:21:36.307Z", "sourceCheckedAt": "2026-10-23T02:43:50.059Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-87902", "aliases": [], "title": "WordPress：コード実行", "summary": "認証されていない攻撃者が `get_page_template()` のページテンプレート解決時に、アクティブテーマディレクトリ外にある任意の読み取り可能な .php ファイルを読み込ませることができ、サーバーや機器に攻撃者の命令を実行させられる可能性があります。", "risk": "この脆弱性が利用されると、サーバーや機器に攻撃者の命令を実行させられる（リモートコード実行）可能性があります。", "product": "WordPress", "category": "wordpress", "component": "core", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "hackerone", "cvssVector": null, "affected": [ { "product": "WordPress", "range": "< 7.1.2" } ], "fixed": [], "steps": [ "WordPress 7.1.2 がリリースされており、本脆弱性の修正が含まれています。また、古いブランチでも 4.7 まで遡って修正がバックポートされています。", "「CVE-2026-87902」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "label": "CVE：hackerone" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87902", "label": "CVE公式レコード" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902", "label": "CISAが示す関連情報" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-09-22T16:44:15.048Z", "modifiedAt": "2026-09-26T03:55:51.560Z", "fetchedAt": "2026-10-23T02:43:51.770Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "vendor": "WordPress", "product": "WordPress", "versions": [ { "version": "0", "status": "affected", "lessThan": "7.1.2", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-87902", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "fetchedAt": "2026-10-23T02:43:51.770Z", "publishedAt": "2026-09-22T16:44:15.048Z", "modifiedAt": "2026-09-26T03:55:51.560Z", "state": "published", "provider": "hackerone", "title": "", "descriptions": [ { "lang": "en", "value": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "WordPress", "product": "WordPress", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.1.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [ { "lang": "en", "value": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-98", "lang": "en", "description": "CWE-98 Remote File Inclusion", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "label": "hackerone", "tags": [], "provider": "hackerone", "sourcePath": "/containers/cna/references/0" }, { "url": "https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87902", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"7.1.2\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"lang\":\"en\",\"cweId\":\"CWE-98\",\"description\":\"CWE-98 Remote File Inclusion\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.1,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-26T03:55:51.560Z", "fetchedAt": "2026-10-23T02:43:51.770Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-25T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "WordPressにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:36.680Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a407be472afbe52b52136a4696a78da9e2cf33b4bb3d74f40643cfc40a7a0cbb", "sourceModifiedAt": "2026-09-26T03:55:51.560Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "認証されていない攻撃者が `get_page_template()` のページテンプレート解決時に、アクティブテーマディレクトリ外にある任意の読み取り可能な .php ファイルを読み込ませることができ、サーバーや機器に攻撃者の命令を実行させられる可能性があります。", "risk": "この脆弱性が利用されると、サーバーや機器に攻撃者の命令を実行させられる（リモートコード実行）可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証されていない攻撃者が対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E1" ] }, { "text": "`get_page_template()` 関数がページテンプレートの解決に使用される必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者が読み取り可能なローカルの .php ファイルを、アクティブテーマディレクトリ外に配置できることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E1" ] }, { "text": "サーバーとアクティブテーマの両方が、脆弱性を引き起こす特定の前提条件を満たしている必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：WordPress / WordPress。影響ありとして記載：7.1.2未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E2" ] }, { "text": "WordPressの管理画面で「ツール」→「サイトヘルス」→「情報」→「WordPress」を開き、本体のバージョンを控えます。プラグインやPHPの番号とは別です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "WordPress 7.1.2 がリリースされており、本脆弱性の修正が含まれています。また、古いブランチでも 4.7 まで遡って修正がバックポートされています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E3" ] }, { "text": "「CVE-2026-87902」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-87902", "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87902" ] }, { "text": "ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/", "https://wordpress.org/documentation/article/manage-plugins/" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-87902", "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87902" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "label": "CVE：hackerone" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87902", "label": "CVE公式レコード" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87902", "label": "CISAが示す関連情報" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"7.1.2\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87902.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.", "language": "en", "representation": "source_excerpt" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-87902\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-87902（WordPress）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証されていない攻撃者が対象となります。\n・`get_page_template()` 関数がページテンプレートの解決に使用される必要があります。\n・攻撃者が読み取り可能なローカルの .php ファイルを、アクティブテーマディレクトリ外に配置できることが前提です。\n・サーバーとアクティブテーマの両方が、脆弱性を引き起こす特定の前提条件を満たしている必要があります。\n・公式の対象表：WordPress / WordPress。影響ありとして記載：7.1.2未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-87902", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:36.680Z", "lastSuccess": "2026-10-23T03:21:36.680Z", "sourceCheckedAt": "2026-10-23T02:43:51.770Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-93682", "aliases": [ "GHSA-7875-c8px-7q5f" ], "title": "PHP：外部URLの転送先を誤って選ぶことがある", "summary": "PHPで外部のWebページを取得し、その相手が空の転送先を返した場合に起きる問題です。サイトを表示する全利用者が直ちに攻撃できる種類の問題ではなく、外部URLを読み込む機能を確認します。", "risk": "外部サイトへのリクエスト先が意図せず変わるおそれがあります。公式説明では読み出したメモリー自体が相手へ送られるわけではなく、通常のZendメモリー管理下ではこの1バイトの読み出しでクラッシュしません。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.8, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "外部URL取得機能を担当する開発者に、このCVEと利用している取得処理を伝え、更新後も意図した転送先だけに接続することを確認してもらいます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93682", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.http.php", "label": "PHP公式：HTTP自動転送の設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:07:25.000Z", "modifiedAt": "2026-09-25T20:38:14.346Z", "fetchedAt": "2026-10-23T02:43:52.936Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.", "sourceTitle": "Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-standard", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93682", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93682.json", "fetchedAt": "2026-10-23T02:43:52.936Z", "publishedAt": "2026-09-25T20:02:11.467Z", "modifiedAt": "2026-09-25T20:38:14.346Z", "state": "published", "provider": "php", "title": "Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header", "descriptions": [ { "lang": "en", "value": "When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nWhen the HTTP stream wrapper follows a redirect and the response carries a `Location` header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.\n\n### Details\r\n\r\nSince the fix for GHSA-52jp-hrpf-2jff (CVE-2025-1861), `php_stream_http_response_headers_parse()` stores the `Location` value in a heap buffer of exactly `location_len + 1` bytes:\r\n\r\nhttps://github.com/php/php-src/blob/a66f30d78e10773048720b4b5f279136fdd0a433/ext/standard/http_fopen_wrapper.c#L295-L301\r\n\r\nFor an empty header value that is a single byte holding only the NUL terminator. The redirect handling in `php_stream_url_wrap_http_ex()` treats any location that does not start with `/` as a relative path and dereferences the second byte to decide whether to join it with the directory of the current request path:\r\n\r\nhttps://github.com/php/php-src/blob/a66f30d78e10773048720b4b5f279136fdd0a433/ext/standard/http_fopen_wrapper.c#L1055-L1063\r\n\r\n`*(header_info.location+1)` is one byte after the allocation.\r\n\r\nBefore CVE-2025-1861 was fixed, the location lived in a fixed-size `char location[HTTP_HEADER_BLOCK_SIZE]` stack buffer and the same read stayed in bounds. The bug therefore exists only in 8.1.32+, 8.2.28+, 8.3.18+, 8.4.5+ and all 8.5 releases.\r\n\r\nThe fix replaces `strlen(header_info.location)` with `header_info.location_len` and guards the second-byte read with the length, so an empty `Location` deterministically redirects to the host root. It was submitted and merged publicly, outside the security process, in https://github.com/php/php-src/pull/23467. A follow-up in https://github.com/php/php-src/pull/23521 corrected the guard from `location_len > 0` to `location_len > 1`, restoring the long-standing resolution of a single-character relative `Location`.\n\n### Impact\r\n\r\nAn attacker who controls a server that a PHP application fetches from, or who can redirect such a request there, triggers a one-byte heap over-read. The byte is never returned to the attacker; it only selects between two redirect targets, so at most one bit, whether the byte is zero, is observable through the request path the server sees. Under the Zend memory manager the one-byte allocation sits in an 8-byte bin, so the read does not crash the process. The practical effect is a non-deterministic redirect target and undefined behaviour reported by ASan and Valgrind.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-standard", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds read", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93682.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-standard\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93682.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93682.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds read\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93682.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7875-c8px-7q5f:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "sourcePath": "/description", "text": "### Summary\r\n\r\nWhen the HTTP stream wrapper follows a redirect and the response carries a `Location` header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.\n\n### Details\r\n\r\nSince the fix for GHSA-52jp-hrpf-2jff (CVE-2025-1861), `php_stream_http_response_headers_parse()` stores the `Location` value in a heap buffer of exactly `location_len + 1` bytes:\r\n\r\nhttps://github.com/php/php-src/blob/a66f30d78e10773048720b4b5f279136fdd0a433/ext/standard/http_fopen_wrapper.c#L295-L301\r\n\r\nFor an empty header value that is a single byte holding only the NUL terminator. The redirect handling in `php_stream_url_wrap_http_ex()` treats any location that does not start with `/` as a relative path and dereferences the second byte to decide whether to join it with the directory of the current request path:\r\n\r\nhttps://github.com/php/php-src/blob/a66f30d78e10773048720b4b5f279136fdd0a433/ext/standard/http_fopen_wrapper.c#L1055-L1063\r\n\r\n`*(header_info.location+1)` is one byte after the allocation.\r\n\r\nBefore CVE-2025-1861 was fixed, the location lived in a fixed-size `char location[HTTP_HEADER_BLOCK_SIZE]` stack buffer and the same read stayed in bounds. The bug therefore exists only in 8.1.32+, 8.2.28+, 8.3.18+, 8.4.5+ and all 8.5 releases.\r\n\r\nThe fix replaces `strlen(header_info.location)` with `header_info.location_len` and guards the second-byte read with the length, so an empty `Location` deterministically redirects to the host root. It was submitted and merged publicly, outside the security process, in https://github.com/php/php-src/pull/23467. A follow-up in https://github.com/php/php-src/pull/23521 corrected the guard from `location_len > 0` to `location_len > 1`, restoring the long-standing resolution of a single-character relative `Location`.\n\n### Impact\r\n\r\nAn attacker who controls a server that a PHP application fetches from, or who can redirect such a request there, triggers a one-byte heap over-read. The byte is never returned to the attacker; it only selects between two redirect targets, so at most one bit, whether the byte is zero, is observable through the request path the server sees. Under the Zend memory manager the one-byte allocation sits in an 8-byte bin, so the read does not crash the process. The practical effect is a non-deterministic redirect target and undefined behaviour reported by ASan and Valgrind.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-7875-c8px-7q5f:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7875-c8px-7q5f:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7875-c8px-7q5f:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7875-c8px-7q5f:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-25T20:38:14.346Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7875-c8px-7q5f", "modifiedAt": "2026-09-25T19:54:11.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T20:38:14.346Z", "fetchedAt": "2026-10-23T02:43:52.936Z", "state": "published" }, { "source": "CVE", "modifiedAt": "2026-09-25T20:38:14.346Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T20:38:14.346Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPで外部のWebページを取得し、その相手が空の転送先を返した場合に起きる問題です。サイトを表示する全利用者が直ちに攻撃できる種類の問題ではなく、外部URLを読み込む機能を確認します。", "risk": "外部サイトへのリクエスト先が意図せず変わるおそれがあります。公式説明では読み出したメモリー自体が相手へ送られるわけではなく、通常のZendメモリー管理下ではこの1バイトの読み出しでクラッシュしません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "HTTPストリームで外部URLを読み、自動転送を追跡するアプリが対象です。攻撃者が取得先のサーバーを操作できる、またはそこへ転送できる必要があります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "制作担当者へ「file_get_contents()やfopen()で外部URLを取得する機能と、自動リダイレクトの有無」を確認します。外部情報の取り込み・画像取得・URLプレビュー機能が確認先の例です。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-93682", "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "外部URL取得機能を担当する開発者に、このCVEと利用している取得処理を伝え、更新後も意図した転送先だけに接続することを確認してもらいます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "自動転送が不要な機能では、開発者がHTTPコンテキストのfollow_locationを0にする方法を検討します。転送が必要な機能は動作が変わるため、運営者が設定値だけを一律変更しないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f", "https://www.php.net/manual/en/context.http.php" ] } ], "verification": [ { "text": "更新後、普段利用する外部URLの取得と、正規の転送があるURLの取得を試し、期待する宛先・内容になっていることを確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-93682（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-93682について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93682", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93682", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.http.php", "label": "PHP公式：HTTP自動転送の設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:a89b32f414cd88d5bd1f9bb906d5057c34076ae875d037bfa0f8b272f7c36774", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-92842", "aliases": [ "GHSA-88hq-2827-7pg6" ], "title": "PHP：文字列変換の特殊な設定で内部メモリーが漏れるおそれ", "summary": "Base64やQuoted-Printableの変換処理に、利用者が決めた「改行文字」を渡す特殊な実装で起きます。Base64を使っているだけで全て対象になるわけではありません。", "risk": "変換結果へ本来含まれないメモリーの断片が混ざり、その結果を相手へ返すと情報が漏れるおそれがあります。構成によっては処理が停止する可能性もあります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを更新し、変換用オプションへ利用者が自由に値を入れられる実装も見直します。変換結果を表示・ダウンロードする機能を確認対象にします。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-92842", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:07:21.000Z", "modifiedAt": "2026-09-28T13:31:31.256Z", "fetchedAt": "2026-10-23T02:43:52.694Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.", "sourceTitle": "OOB read / info leak in convert.* stream filters when line-break-chars contains NUL", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-standard", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-92842", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "fetchedAt": "2026-10-23T02:43:52.694Z", "publishedAt": "2026-09-25T21:11:57.236Z", "modifiedAt": "2026-09-28T13:31:31.256Z", "state": "published", "provider": "php", "title": "OOB read / info leak in convert.* stream filters when line-break-chars contains NUL", "descriptions": [ { "lang": "en", "value": "The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nThe `convert.base64-encode`, `convert.quoted-printable-encode` and `convert.quoted-printable-decode` stream filters accept a `line-break-chars` option whose length is tracked separately from the string itself. The filter constructors duplicate the value with `pestrdup()`, which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.\n\n### Details\r\n\r\n`php_conv_base64_encode_ctor()` duplicates the option with `pestrdup()` but stores the untruncated length:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/filters.c#L237-L238\r\n\r\n`php_conv_qprint_encode_ctor()` and `php_conv_qprint_decode_ctor()` repeat the same pattern at lines 838 and 1051. The over-read happens when the encoder inserts a line break and copies `lbchars_len` bytes from that allocation:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/filters.c#L406\r\n\r\nWith `line-break-chars` set to `\"\\0X\"` the duplicate is a one-byte allocation holding only the NUL terminator, while `lbchars_len` is still 2, so one byte past the allocation is copied into the output. Extending the option after the NUL increases the number of bytes read out of bounds.\r\n\r\nThe fix replaces `pestrdup()` with `pestrndup(lbchars, lbchars_len, persistent)` in all three constructors, so the allocation always matches the recorded length.\n\n### Impact\r\n\r\nHeap memory adjacent to the `line-break-chars` allocation is copied into the filter output, so an application that returns the encoded result discloses those bytes to the requester. The attacker can enlarge the leak by lengthening the option value after the NUL byte. A crash is possible on some allocators and builds, but the practical risk is the information leak.\r\n\r\nExploitation requires the application to pass attacker-controlled bytes as `line-break-chars` and for those bytes to contain an embedded NUL, which is rare in practice, so the majority of applications are not affected.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-standard", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based buffer overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds read", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-standard\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"CWE-122 Heap-based buffer overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-125\",\"description\":\"CWE-125 Out-of-bounds read\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92842.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.9,\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-88hq-2827-7pg6:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "sourcePath": "/description", "text": "### Summary\r\n\r\nThe `convert.base64-encode`, `convert.quoted-printable-encode` and `convert.quoted-printable-decode` stream filters accept a `line-break-chars` option whose length is tracked separately from the string itself. The filter constructors duplicate the value with `pestrdup()`, which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.\n\n### Details\r\n\r\n`php_conv_base64_encode_ctor()` duplicates the option with `pestrdup()` but stores the untruncated length:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/filters.c#L237-L238\r\n\r\n`php_conv_qprint_encode_ctor()` and `php_conv_qprint_decode_ctor()` repeat the same pattern at lines 838 and 1051. The over-read happens when the encoder inserts a line break and copies `lbchars_len` bytes from that allocation:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/filters.c#L406\r\n\r\nWith `line-break-chars` set to `\"\\0X\"` the duplicate is a one-byte allocation holding only the NUL terminator, while `lbchars_len` is still 2, so one byte past the allocation is copied into the output. Extending the option after the NUL increases the number of bytes read out of bounds.\r\n\r\nThe fix replaces `pestrdup()` with `pestrndup(lbchars, lbchars_len, persistent)` in all three constructors, so the allocation always matches the recorded length.\n\n### Impact\r\n\r\nHeap memory adjacent to the `line-break-chars` allocation is copied into the filter output, so an application that returns the encoded result discloses those bytes to the requester. The attacker can enlarge the leak by lengthening the option value after the NUL byte. A crash is possible on some allocators and builds, but the practical risk is the information leak.\r\n\r\nExploitation requires the application to pass attacker-controlled bytes as `line-break-chars` and for those bytes to contain an embedded NUL, which is rare in practice, so the majority of applications are not affected.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-88hq-2827-7pg6:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-88hq-2827-7pg6:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-88hq-2827-7pg6:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-88hq-2827-7pg6:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:31.256Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-88hq-2827-7pg6", "modifiedAt": "2026-09-25T21:09:54.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.256Z", "fetchedAt": "2026-10-23T02:43:52.694Z", "state": "published" }, { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.256Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-28T13:31:31.256Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "Base64やQuoted-Printableの変換処理に、利用者が決めた「改行文字」を渡す特殊な実装で起きます。Base64を使っているだけで全て対象になるわけではありません。", "risk": "変換結果へ本来含まれないメモリーの断片が混ざり、その結果を相手へ返すと情報が漏れるおそれがあります。構成によっては処理が停止する可能性もあります。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "convert.base64-encode、convert.quoted-printable-encode、convert.quoted-printable-decodeのline-break-chars設定に、攻撃者が決めたNUL文字を含む値が入る必要があります。公式説明では一般的なアプリの多くはこの条件に該当しません。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "開発担当者に「stream_filter_append等のline-break-charsへ、フォーム・URL・外部データの値をそのまま渡していないか」を確認してもらいます。普通の文章の改行設定とは別のプログラム内部の設定です。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-92842", "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "PHPを更新し、変換用オプションへ利用者が自由に値を入れられる実装も見直します。変換結果を表示・ダウンロードする機能を確認対象にします。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "開発者が改行文字の設定をアプリ側の固定値にし、外部入力で上書きできないようにすることを検討します。これは今回の入力経路を減らす手当てで、PHP更新の代わりにはしません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] } ], "verification": [ { "text": "変換結果の表示・メール生成・ダウンロードが通常どおり動き、利用者が変換オプションを変更できなくなっていることを確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-92842（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-92842について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-92842", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-92842", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:b3c42296467f8daca895b4bd8d37a276c1ce7e5d04bc91fcb2062bc4c507eec0", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "GHSA-ch8v-r6jh-4vvr", "aliases": [], "title": "PHP：URL用の文字変換で一部の特殊文字の扱いが不安定", "summary": "FILTER_SANITIZE_ENCODEDを使うアプリで、0xFFという特殊なバイトが変換されたり、そのまま残ったりする問題です。開発元は影響を低いと説明しています。", "risk": "この処理の出力が必ず完全にURLエンコードされていると想定した後続処理に影響する可能性があります。この問題自体にクラッシュやメモリー破壊はありません。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 3.7, "cvssVersion": "3.1", "cvssSource": "PHP Security", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.25" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.10" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.25", "8.5.10" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.25 / 8.5.10 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新し、後続のURL処理で必要な文字の検証を行います。関数名に「SANITIZE」があっても、それだけで任意のURLが安全になるわけではありません。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:07:15.000Z", "modifiedAt": "2026-09-24T10:07:15.000Z", "fetchedAt": "2026-10-23T02:57:44.499Z", "exploitStatus": "unknown", "sources": [ "PHP Security" ], "originalText": "`php_filter_encode_url()` builds a 256-entry lookup table that decides which bytes `FILTER_SANITIZE_ENCODED` percent-encodes, but initialises only the first 255 entries. Entry 255 is read uninitialised, so whether the byte `0xFF` is encoded or passed through depends on whatever happened to be on the stack.", "sourceTitle": "ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "officialEvidence": { "schemaVersion": "1.0", "id": "GHSA-ch8v-r6jh-4vvr", "advisoryId": "GHSA-ch8v-r6jh-4vvr", "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "fetchedAt": "2026-10-23T02:57:44.499Z", "publishedAt": "2026-09-24T10:07:15.000Z", "modifiedAt": "2026-09-24T10:07:15.000Z", "state": "published", "provider": "The PHP Group", "title": "ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED", "descriptions": [ { "lang": "en", "value": "### Summary\n\n`php_filter_encode_url()` builds a 256-entry lookup table that decides which bytes `FILTER_SANITIZE_ENCODED` percent-encodes, but initialises only the first 255 entries. Entry 255 is read uninitialised, so whether the byte `0xFF` is encoded or passed through depends on whatever happened to be on the stack.\n\n### Details\n\nThe table is filled with `memset(tmp, 1, sizeof(tmp) - 1)`, which leaves `tmp[255]` untouched:\n\nhttps://github.com/php/php-src/blob/php-8.5.9/ext/filter/sanitizing_filters.c#L73\n\nThe filter then consults `tmp[*s]` for every input byte, so for `0xFF` the decision comes from uninitialised stack memory. Every other byte is handled deterministically.\n\nThe fix changes the `memset()` length to `sizeof(tmp)` so the whole table is initialised.\n\n### Impact\n\nThe impact is low. There is no crash and no memory corruption; the only effect is that the `0xFF` byte is sanitised inconsistently, depending on uninitialised stack contents. A downstream consumer that relies on `FILTER_SANITIZE_ENCODED` producing fully percent-encoded output could in principle be affected as part of a longer chain, but the filter provides no such guarantee on its own.\n\nThis issue was fixed publicly in 8.4.25 and 8.5.10 before it was recognised as security relevant, and is backported here to the branches that receive security fixes only.", "sourcePath": "/description", "representation": "defensive_sections" } ], "affected": [ { "vendor": "The PHP Group", "product": "ext-filter", "packageName": "ext-filter", "sourcePath": "/vulnerabilities/0", "vulnerableVersionRange": "<8.2.34", "patchedVersions": "8.2.34", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "ext-filter", "packageName": "ext-filter", "sourcePath": "/vulnerabilities/1", "vulnerableVersionRange": "<8.3.35", "patchedVersions": "8.3.35", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "ext-filter", "packageName": "ext-filter", "sourcePath": "/vulnerabilities/2", "vulnerableVersionRange": "<8.4.25", "patchedVersions": "8.4.25", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] }, { "vendor": "The PHP Group", "product": "ext-filter", "packageName": "ext-filter", "sourcePath": "/vulnerabilities/3", "vulnerableVersionRange": "<8.5.10", "patchedVersions": "8.5.10", "versions": [], "platforms": [], "modules": [], "programFiles": [], "programRoutines": [], "cpes": [] } ], "solutions": [ { "lang": "en", "value": "Package ext-filter; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package ext-filter; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package ext-filter; vulnerable range: <8.4.25; patched versions: 8.4.25", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary" }, { "lang": "en", "value": "Package ext-filter; vulnerable range: <8.5.10; patched versions: 8.5.10", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "provider": "PHP Security", "sourcePath": "/cvss" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.7, "provider": "PHP Security", "sourcePath": "/cvss" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "sourcePath": "/description", "text": "### Summary\n\n`php_filter_encode_url()` builds a 256-entry lookup table that decides which bytes `FILTER_SANITIZE_ENCODED` percent-encodes, but initialises only the first 255 entries. Entry 255 is read uninitialised, so whether the byte `0xFF` is encoded or passed through depends on whatever happened to be on the stack.\n\n### Details\n\nThe table is filled with `memset(tmp, 1, sizeof(tmp) - 1)`, which leaves `tmp[255]` untouched:\n\nhttps://github.com/php/php-src/blob/php-8.5.9/ext/filter/sanitizing_filters.c#L73\n\nThe filter then consults `tmp[*s]` for every input byte, so for `0xFF` the decision comes from uninitialised stack memory. Every other byte is handled deterministically.\n\nThe fix changes the `memset()` length to `sizeof(tmp)` so the whole table is initialised.\n\n### Impact\n\nThe impact is low. There is no crash and no memory corruption; the only effect is that the `0xFF` byte is sanitised inconsistently, depending on uninitialised stack contents. A downstream consumer that relies on `FILTER_SANITIZE_ENCODED` producing fully percent-encoded output could in principle be affected as part of a longer chain, but the filter provides no such guarantee on its own.\n\nThis issue was fixed publicly in 8.4.25 and 8.5.10 before it was recognised as security relevant, and is backported here to the branches that receive security fixes only.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "official:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"ext-filter\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"ext-filter\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"ext-filter\"},\"vulnerable_version_range\":\"<8.4.25\",\"patched_versions\":\"8.4.25\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-ch8v-r6jh-4vvr", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"ext-filter\"},\"vulnerable_version_range\":\"<8.5.10\",\"patched_versions\":\"8.5.10\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } }, "sourceSnapshots": [ { "source": "PHP Security", "modifiedAt": "2026-09-24T10:07:15.000Z", "fetchedAt": "2026-10-23T02:57:44.499Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-24T10:07:15.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "FILTER_SANITIZE_ENCODEDを使うアプリで、0xFFという特殊なバイトが変換されたり、そのまま残ったりする問題です。開発元は影響を低いと説明しています。", "risk": "この処理の出力が必ず完全にURLエンコードされていると想定した後続処理に影響する可能性があります。この問題自体にクラッシュやメモリー破壊はありません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.25未満、8.5系の8.5.10未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "FILTER_SANITIZE_ENCODEDへ0xFFを含む入力が渡る場合です。PHP 8.4.25と8.5.10には先に通常修正が入り、8.2・8.3系列にもセキュリティ修正が提供されています。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "開発担当者へ「FILTER_SANITIZE_ENCODEDの結果を、URLの完全な安全確認として使っていないか」を確認します。使っているPHP系列に対応する修正版を照合します。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.25 / 8.5.10 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "PHPを修正版へ更新し、後続のURL処理で必要な文字の検証を行います。関数名に「SANITIZE」があっても、それだけで任意のURLが安全になるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "該当する入力変換を使う箇所を開発者に絞ってもらい、必要な文字だけを受け付ける仕様にできるか検討します。低影響であっても、他のPHP脆弱性への更新と合わせて対応します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] } ], "verification": [ { "text": "URLや文字列を受け付ける通常のフォームが正しく動き、日本語や必要な記号が不必要に壊れないことを確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：GHSA-ch8v-r6jh-4vvr（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nGHSA-ch8v-r6jh-4vvrについて、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/GHSA-ch8v-r6jh-4vvr", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-ch8v-r6jh-4vvr", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:65581435c8620bb22c55f36f54eb4d3b5fc2cf15dc64d694e966410b19cc8f95", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-91768", "aliases": [ "GHSA-62xp-839h-2637" ], "title": "PHP-FPM：IPv6の接続元制限をすり抜けられるおそれ", "summary": "PHP-FPMへIPv6で接続し、listen.allowed_clientsだけで接続元を制限している構成が確認対象です。一般の閲覧者のIPv6設定ではなく、WebサーバーとPHP-FPMの間の接続方式が問題になります。", "risk": "許可したIPv6アドレスと先頭96ビットが同じ別のアドレスから、PHP-FPMへ接続されるおそれがあります。構成によってはPHPワーカーの権限でスクリプト実行につながります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHP-FPMを修正版へ更新し、FastCGIの待受先へ必要なWebサーバーだけが接続できる構成を管理者に確認してもらいます。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91768", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/install.fpm.configuration.php", "label": "PHP公式：FPMの接続設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:55.000Z", "modifiedAt": "2026-09-28T13:31:31.382Z", "fetchedAt": "2026-10-23T02:43:52.312Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.", "sourceTitle": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "PHP-FPM", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-91768", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91768.json", "fetchedAt": "2026-10-23T02:43:52.312Z", "publishedAt": "2026-09-25T21:07:30.950Z", "modifiedAt": "2026-09-28T13:31:31.382Z", "state": "published", "provider": "php", "title": "IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)", "descriptions": [ { "lang": "en", "value": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nThe IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so `listen.allowed_clients` matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.\n\n### Details\r\n\r\n`fcgi_is_allowed()` in `main/fastcgi.c` compares IPv6 client addresses with a hard-coded length of 12:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/main/fastcgi.c#L1334\r\n\r\nAn exact IPv6 comparison must cover all 16 bytes of `struct in6_addr`. The IPv4 branch above it compares its full 4 bytes correctly, and the `IN6_IS_ADDR_V4MAPPED` branch legitimately uses a 12-byte offset to reach the embedded IPv4 address, but that offset is not a valid length for a plain IPv6 comparison. Allowed addresses are parsed as full addresses with `inet_pton(AF_INET6, ...)`, so the truncated comparison silently widens every configured entry to a /96 network.\r\n\r\nThe fix compares `sizeof(client_sa.sa_inet6.sin6_addr)` bytes.\n\n### Impact\r\n\r\nThis is an access control bypass in deployments that use FastCGI over IPv6 TCP and rely on `listen.allowed_clients` as a security boundary. An attacker with network reachability who can source an address within the same /96 as an allowed client bypasses the ACL and reaches the FastCGI endpoint, which in many deployments means executing PHP scripts in the FPM worker context.\r\n\r\nDeployments using Unix sockets, IPv4 only, or an external firewall as the actual boundary are not affected.\n\n### Credit\r\n\r\nThis issue was originally reported in GHSA-r37j-mv37-rjpc. That advisory could not be used because the reporting account was deleted.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "PHP-FPM", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package PHP-FPM; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637" }, { "lang": "en", "value": "Package PHP-FPM; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-1023", "lang": "en", "description": "CWE-1023", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91768.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"PHP-FPM\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91768.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91768.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-1023\",\"description\":\"CWE-1023\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91768.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.5,\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-62xp-839h-2637:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "sourcePath": "/description", "text": "### Summary\r\n\r\nThe IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so `listen.allowed_clients` matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.\n\n### Details\r\n\r\n`fcgi_is_allowed()` in `main/fastcgi.c` compares IPv6 client addresses with a hard-coded length of 12:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/main/fastcgi.c#L1334\r\n\r\nAn exact IPv6 comparison must cover all 16 bytes of `struct in6_addr`. The IPv4 branch above it compares its full 4 bytes correctly, and the `IN6_IS_ADDR_V4MAPPED` branch legitimately uses a 12-byte offset to reach the embedded IPv4 address, but that offset is not a valid length for a plain IPv6 comparison. Allowed addresses are parsed as full addresses with `inet_pton(AF_INET6, ...)`, so the truncated comparison silently widens every configured entry to a /96 network.\r\n\r\nThe fix compares `sizeof(client_sa.sa_inet6.sin6_addr)` bytes.\n\n### Impact\r\n\r\nThis is an access control bypass in deployments that use FastCGI over IPv6 TCP and rely on `listen.allowed_clients` as a security boundary. An attacker with network reachability who can source an address within the same /96 as an allowed client bypasses the ACL and reaches the FastCGI endpoint, which in many deployments means executing PHP scripts in the FPM worker context.\r\n\r\nDeployments using Unix sockets, IPv4 only, or an external firewall as the actual boundary are not affected.\n\n### Credit\r\n\r\nThis issue was originally reported in GHSA-r37j-mv37-rjpc. That advisory could not be used because the reporting account was deleted.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-62xp-839h-2637:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-62xp-839h-2637:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-62xp-839h-2637:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-62xp-839h-2637:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"PHP-FPM\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:31.382Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-62xp-839h-2637", "modifiedAt": "2026-09-25T21:04:06.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.382Z", "fetchedAt": "2026-10-23T02:43:52.312Z", "state": "published" }, { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.382Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-28T13:31:31.382Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHP-FPMへIPv6で接続し、listen.allowed_clientsだけで接続元を制限している構成が確認対象です。一般の閲覧者のIPv6設定ではなく、WebサーバーとPHP-FPMの間の接続方式が問題になります。", "risk": "許可したIPv6アドレスと先頭96ビットが同じ別のアドレスから、PHP-FPMへ接続されるおそれがあります。構成によってはPHPワーカーの権限でスクリプト実行につながります。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "FastCGIをIPv6のTCPで待ち受け、listen.allowed_clientsをアクセス制御の境界として使う環境です。攻撃者が待受先へ到達でき、許可IPと同じ/96範囲の送信元IPを使える必要があります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "Unixソケットのみ、IPv4のみ、または外部ファイアウォールが実際の接続制限を担う構成は、公式説明上この攻撃経路の対象ではありません。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "サーバー管理者へ「FPMのlistenはUnixソケット・IPv4・IPv6のどれか。IPv6の場合、ファイアウォールでも接続元を制限しているか」を確認します。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-91768", "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "PHP-FPMを修正版へ更新し、FastCGIの待受先へ必要なWebサーバーだけが接続できる構成を管理者に確認してもらいます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "更新までの間は、管理者が外部ファイアウォールで必要な接続元だけを許可する、または構成に合えばUnixソケットへ変更することを検討します。listen.allowed_clientsだけを安全の根拠にしないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637", "https://www.php.net/manual/en/install.fpm.configuration.php" ] } ], "verification": [ { "text": "正規のWebサーバーからサイトが動き、許可していない接続元にはFPMの待受を公開していないことを、ネットワーク設定とファイアウォールの両方で確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-91768（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-91768について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-91768", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91768", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/install.fpm.configuration.php", "label": "PHP公式：FPMの接続設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:80c82f726d28625792f31a64a97d151c676acd2b87dbcb7368bb89231c41aeae", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-91769", "aliases": [ "GHSA-vvx9-73fr-5jjx" ], "title": "PHP：HTTPS接続先の証明書を誤って受け入れるおそれ", "summary": "PHPから外部サービスへHTTPSなどで接続するときの、相手の証明書の確認処理に問題があります。特に社内認証局や独自の証明書を利用するシステムを確認します。", "risk": "証明書内の正式な接続先一覧が一致していないのに、別の名前欄が一致すると受け入れることがあり、接続相手を偽装されるおそれがあります。任意の自己署名証明書だけで攻撃できるという意味ではありません。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新します。更新後に社内連携が失敗した場合は、相手側の証明書を正しい接続先名を含むものに直します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91769", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.ssl.php", "label": "PHP公式：証明書・接続先名の検証" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:51.000Z", "modifiedAt": "2026-10-04T16:10:05.639Z", "fetchedAt": "2026-10-23T02:43:52.325Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "sourceTitle": "TLS Hostname Verification Falls Back to CN After SAN Mismatch", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-openssl", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-91769", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91769.json", "fetchedAt": "2026-10-23T02:43:52.325Z", "publishedAt": "2026-09-25T20:59:39.727Z", "modifiedAt": "2026-10-04T16:10:05.639Z", "state": "published", "provider": "php", "title": "TLS Hostname Verification Falls Back to CN After SAN Mismatch", "descriptions": [ { "lang": "en", "value": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nPHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested `peer_name`. A certificate trusted by the client for one name can therefore be used to impersonate another.\n\n### Details\r\n\r\n`php_openssl_apply_peer_verification_policy()` tries the SAN list and then unconditionally falls back to the CN:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/openssl/xp_ssl.c#L635-L641\r\n\r\nIn the tested build a certificate with `CN=victim.test` and `SAN=DNS:attacker.test` was accepted for `peer_name=victim.test`. A control certificate with `CN=other.test` and the same SAN was rejected, confirming that acceptance came from the CN and that a SAN mismatch did not suppress the fallback.\r\n\r\nThe fix makes `php_openssl_matches_san_list()` report whether the certificate presented a service identity, meaning a DNS SAN, a URI SAN, or an SRV-ID `otherName` (OID 1.3.6.1.5.5.7.8.7). When one is present and none matched, verification now fails with `Peer certificate subjectAltName did not match expected name` instead of consulting the CN. Certificates with no service identity at all keep the CN fallback for backwards compatibility.\n\n### Impact\r\n\r\nA certificate that a client trusts for one hostname can be used to impersonate a different hostname, as long as the attacker's certificate carries the target name in its Common Name. This matters where certificates come from a private PKI, an internal CA, or any environment where an attacker can obtain a certificate whose CN it does not control the SAN for. It affects every client stream that relies on the default `verify_peer_name`, including `file_get_contents()`, `fopen()` and `stream_socket_client()` over `https://` and `tls://`.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-openssl", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-297", "lang": "en", "description": "CWE-297 Improper validation of certificate with host mismatch", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91769.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-openssl\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91769.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91769.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-297\",\"description\":\"CWE-297 Improper validation of certificate with host mismatch\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91769.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.3,\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vvx9-73fr-5jjx:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "sourcePath": "/description", "text": "### Summary\r\n\r\nPHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested `peer_name`. A certificate trusted by the client for one name can therefore be used to impersonate another.\n\n### Details\r\n\r\n`php_openssl_apply_peer_verification_policy()` tries the SAN list and then unconditionally falls back to the CN:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/openssl/xp_ssl.c#L635-L641\r\n\r\nIn the tested build a certificate with `CN=victim.test` and `SAN=DNS:attacker.test` was accepted for `peer_name=victim.test`. A control certificate with `CN=other.test` and the same SAN was rejected, confirming that acceptance came from the CN and that a SAN mismatch did not suppress the fallback.\r\n\r\nThe fix makes `php_openssl_matches_san_list()` report whether the certificate presented a service identity, meaning a DNS SAN, a URI SAN, or an SRV-ID `otherName` (OID 1.3.6.1.5.5.7.8.7). When one is present and none matched, verification now fails with `Peer certificate subjectAltName did not match expected name` instead of consulting the CN. Certificates with no service identity at all keep the CN fallback for backwards compatibility.\n\n### Impact\r\n\r\nA certificate that a client trusts for one hostname can be used to impersonate a different hostname, as long as the attacker's certificate carries the target name in its Common Name. This matters where certificates come from a private PKI, an internal CA, or any environment where an attacker can obtain a certificate whose CN it does not control the SAN for. It affects every client stream that relies on the default `verify_peer_name`, including `file_get_contents()`, `fopen()` and `stream_socket_client()` over `https://` and `tls://`.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-vvx9-73fr-5jjx:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vvx9-73fr-5jjx:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vvx9-73fr-5jjx:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vvx9-73fr-5jjx:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-10-04T16:10:05.639Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vvx9-73fr-5jjx", "modifiedAt": "2026-10-04T16:04:33.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-04T16:10:05.639Z", "fetchedAt": "2026-10-23T02:43:52.325Z", "state": "published" }, { "source": "CVE", "modifiedAt": "2026-10-04T16:10:05.639Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-10-04T16:10:05.639Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPから外部サービスへHTTPSなどで接続するときの、相手の証明書の確認処理に問題があります。特に社内認証局や独自の証明書を利用するシステムを確認します。", "risk": "証明書内の正式な接続先一覧が一致していないのに、別の名前欄が一致すると受け入れることがあり、接続相手を偽装されるおそれがあります。任意の自己署名証明書だけで攻撃できるという意味ではありません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "file_get_contents()、fopen()、stream_socket_client()等でHTTPS/TLSへ接続し、既定のverify_peer_nameを使うPHPストリームが対象です。攻撃者はPHP側が信頼する証明書で、Common Nameに標的名を持つものを用意できる必要があります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "制作・運用担当者へ「PHPの外部HTTPS通信に独自CAや社内証明書を使っているか」を確認します。証明書のSAN（接続先名の一覧）とCN（旧来の名前欄）の扱いを開発者に調べてもらいます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-91769", "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "PHPを修正版へ更新します。更新後に社内連携が失敗した場合は、相手側の証明書を正しい接続先名を含むものに直します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "証明書エラーを消すためにverify_peer_nameや証明書の検証自体を無効にしないでください。接続先・信頼する認証局を管理者が整理し、不要な外部接続を減らします。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "https://www.php.net/manual/en/context.ssl.php" ] } ], "verification": [ { "text": "外部API・メール・社内システム連携が正しい証明書で動くことを確認します。更新後の証明書エラーは、検証を無効化せず接続先名と証明書の内容を調べます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-91769（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-91769について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-91769", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91769", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.ssl.php", "label": "PHP公式：証明書・接続先名の検証" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:0a7229d96f34cbb57c692b3afc7a96afd55e25c0940aa334581b2c6d2e8f8619", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-91767", "aliases": [ "GHSA-xr7j-rvgx-xq5p" ], "title": "PHP：外部サイトの細工した証明書で処理が止まるおそれ", "summary": "PHPがHTTPS/TLSで外部サーバーへ接続し、相手の証明書の名前を確認する際の問題です。サイトの利用者が使うブラウザーの証明書確認とは別です。", "risk": "細工したワイルドカード名を持つ証明書によりPHP処理がクラッシュし、サービス停止につながるおそれがあります。公式説明では、読み出した内部メモリーの内容が攻撃者へ返されるわけではありません。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新します。接続先の証明書を検証する機能を切って問題を避ける対応はせず、外部接続の実装も確認します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91767", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.ssl.php", "label": "PHP公式：証明書・接続先名の検証" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:47.000Z", "modifiedAt": "2026-09-28T13:31:31.640Z", "fetchedAt": "2026-10-23T02:43:52.221Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.", "sourceTitle": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-openssl", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-91767", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91767.json", "fetchedAt": "2026-10-23T02:43:52.221Z", "publishedAt": "2026-09-25T20:53:42.587Z", "modifiedAt": "2026-09-28T13:31:31.640Z", "state": "published", "provider": "php", "title": "Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN", "descriptions": [ { "lang": "en", "value": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\n`php_openssl_matches_wildcard_name()` in `ext/openssl/xp_ssl.c` underflows the length argument passed to `memchr()` when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to `SIZE_MAX` bytes past the end of a heap allocation. The path is reachable from any default client stream, because `verify_peer_name` is enabled by default.\n\n### Details\r\n\r\nThe guard before the `memchr()` call only accounts for the suffix length:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/openssl/xp_ssl.c#L435-L441\r\n\r\nThe third argument is `subject_len - suffix_len - prefix_len`. `subject_len` and `suffix_len` are `size_t` while `prefix_len` is `ptrdiff_t`, so the usual arithmetic conversions promote the whole expression to `size_t`. With a certificate name of `aaa*aa` verified against `aaaa`, the prefix is 3 and the suffix is 2 against a 4-byte subject, so the length computes as `(size_t)(4 - 2 - 3)` and wraps to `SIZE_MAX`. `memchr()` then scans from `subjectname + prefix_len` until it finds a `.` or hits unmapped memory.\r\n\r\nThe fix makes `prefix_len` a `size_t` and changes the guard to `suffix_len + prefix_len <= subject_len`, so the subtraction can no longer wrap.\n\n### Impact\r\n\r\nA server that a PHP client connects to over TLS can cause an out-of-bounds read of unbounded length during hostname verification, crashing the process and producing a denial of service. The scan stops at the first `.` byte it encounters and its result only feeds the accept or reject decision, so no heap content is returned to the attacker.\r\n\r\nIt applies to any client stream using the default `verify_peer_name`, including `file_get_contents()`, `fopen()` and `stream_socket_client()` on `https://` and `tls://`. The attacker must be able to present the crafted certificate, either by controlling the server or by being trusted through the CA in use.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-openssl", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p" }, { "lang": "en", "value": "Package ext-openssl; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based buffer overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91767.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-openssl\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91767.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91767.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"CWE-122 Heap-based buffer overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91767.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.5,\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-xr7j-rvgx-xq5p:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "sourcePath": "/description", "text": "### Summary\r\n\r\n`php_openssl_matches_wildcard_name()` in `ext/openssl/xp_ssl.c` underflows the length argument passed to `memchr()` when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to `SIZE_MAX` bytes past the end of a heap allocation. The path is reachable from any default client stream, because `verify_peer_name` is enabled by default.\n\n### Details\r\n\r\nThe guard before the `memchr()` call only accounts for the suffix length:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/openssl/xp_ssl.c#L435-L441\r\n\r\nThe third argument is `subject_len - suffix_len - prefix_len`. `subject_len` and `suffix_len` are `size_t` while `prefix_len` is `ptrdiff_t`, so the usual arithmetic conversions promote the whole expression to `size_t`. With a certificate name of `aaa*aa` verified against `aaaa`, the prefix is 3 and the suffix is 2 against a 4-byte subject, so the length computes as `(size_t)(4 - 2 - 3)` and wraps to `SIZE_MAX`. `memchr()` then scans from `subjectname + prefix_len` until it finds a `.` or hits unmapped memory.\r\n\r\nThe fix makes `prefix_len` a `size_t` and changes the guard to `suffix_len + prefix_len <= subject_len`, so the subtraction can no longer wrap.\n\n### Impact\r\n\r\nA server that a PHP client connects to over TLS can cause an out-of-bounds read of unbounded length during hostname verification, crashing the process and producing a denial of service. The scan stops at the first `.` byte it encounters and its result only feeds the accept or reject decision, so no heap content is returned to the attacker.\r\n\r\nIt applies to any client stream using the default `verify_peer_name`, including `file_get_contents()`, `fopen()` and `stream_socket_client()` on `https://` and `tls://`. The attacker must be able to present the crafted certificate, either by controlling the server or by being trusted through the CA in use.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-xr7j-rvgx-xq5p:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-xr7j-rvgx-xq5p:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-xr7j-rvgx-xq5p:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-xr7j-rvgx-xq5p:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-openssl\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:31.640Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-xr7j-rvgx-xq5p", "modifiedAt": "2026-09-25T20:49:54.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.640Z", "fetchedAt": "2026-10-23T02:43:52.221Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T20:49:54.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPがHTTPS/TLSで外部サーバーへ接続し、相手の証明書の名前を確認する際の問題です。サイトの利用者が使うブラウザーの証明書確認とは別です。", "risk": "細工したワイルドカード名を持つ証明書によりPHP処理がクラッシュし、サービス停止につながるおそれがあります。公式説明では、読み出した内部メモリーの内容が攻撃者へ返されるわけではありません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "HTTPS/TLSのfile_get_contents()、fopen()、stream_socket_client()などで既定の接続先名検証を使う場合です。攻撃者は接続先サーバーを支配するなどして、問題の証明書を提示できる必要があります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "外部URLの取り込み、API連携、TLS通信を行う機能があるか、開発担当者へ確認します。対象はext-opensslを通るPHPストリームの処理です。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-91767", "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "PHPを修正版へ更新します。接続先の証明書を検証する機能を切って問題を避ける対応はせず、外部接続の実装も確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "更新までの間、外部URLを利用者が自由に指定できる機能を一時停止するか、必要な接続先だけに限定することを検討します。証明書検証を無効にする方法は使いません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p", "https://www.php.net/manual/en/context.ssl.php" ] } ], "verification": [ { "text": "通常の外部APIやHTTPSのデータ取得が動き、PHPワーカーが予期せず停止していないことを運用担当者に確認してもらいます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-91767（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-91767について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-91767", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91767", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.ssl.php", "label": "PHP公式：証明書・接続先名の検証" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:90c554f093e6ad5c330248ae5691c51b9c33ff1d125ab3725557fed80eea3e32", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2025-1218", "aliases": [ "GHSA-r6x9-5r99-36j7" ], "title": "PHP：不正なMySQLサーバーからの応答でサイト処理が停止するおそれ", "summary": "PHPのmysqlndでMySQLへ接続する際、接続先が不正な応答を返すと停止する問題です。一般の閲覧者がデータベースにログインできなくても攻撃できる、とする問題ではありません。", "risk": "攻撃者が管理・侵害したMySQLサーバーから短すぎる応答が返ると、PHP処理がクラッシュして利用できなくなるおそれがあります。公式説明では、読み出したメモリーの内容は相手サーバーへ返りません。", "product": "PHP", "category": "php", "component": "core", "severity": "low", "cvss": 3.4, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新し、接続先DBとその管理者を把握します。DB側への侵入が疑われる場合は、その調査と認証情報の見直しも管理者へ依頼します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1218", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:44.000Z", "modifiedAt": "2026-09-28T13:31:31.774Z", "fetchedAt": "2026-10-23T02:43:35.174Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.", "sourceTitle": "Various packet overreads in mysqlnd_writeprotocol.c", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-mysqlnd", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-1218", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1218.json", "fetchedAt": "2026-10-23T02:43:35.174Z", "publishedAt": "2026-09-25T20:48:21.777Z", "modifiedAt": "2026-09-28T13:31:31.774Z", "state": "published", "provider": "php", "title": "Various packet overreads in mysqlnd_writeprotocol.c", "descriptions": [ { "lang": "en", "value": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nThe mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.\n\n### Details\r\n\r\n`BAIL_IF_NO_MORE_DATA` only guarantees that a single byte remains, but several call sites then read two or more bytes before re-checking. For example, the 2-byte read here happens before the over-read is detected:\r\n\r\nhttps://github.com/php/php-src/blob/8b682743196e765debb5056e56a97a67304f5e62/ext/mysqlnd/mysqlnd_wireprotocol.c#L871-L877\r\n\r\nThe same pattern occurs in the greeting, OK, EOF, auth-switch, cached-sha2, change-user, result-set header, prepared-statement response and row packet handlers. In addition, `php_mysqlnd_net_field_length()` and `php_mysqlnd_net_field_length_ll()` decode a length-encoded integer whose first byte selects a 3, 4 or 9 byte form, and read that many bytes without confirming they are present, so they can read 1 to 9 bytes out of bounds.\r\n\r\nThe fix replaces the single-byte guard with `BAIL_IF_NOT_ENOUGH_DATA_EX(n)`, which checks the exact number of bytes each read needs, and gives both field-length helpers a `remaining_size` argument so they return `MYSQLND_INVALID_NET_FIELD_LENGTH` instead of reading beyond the packet.\n\n### Impact\r\n\r\nApplications connecting to an untrusted or compromised MySQL server can be crashed, giving a denial of service. The bytes read past the buffer influence parsed field values but are not returned to the server, and the reads stay within the process heap. Applications that only connect to trusted database servers are not exposed.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-mysqlnd", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-mysqlnd; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7" }, { "lang": "en", "value": "Package ext-mysqlnd; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7" }, { "lang": "en", "value": "Package ext-mysqlnd; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7" }, { "lang": "en", "value": "Package ext-mysqlnd; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based buffer overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "baseScore": 3.4, "baseSeverity": "LOW", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1218.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-mysqlnd\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1218.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1218.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"CWE-122 Heap-based buffer overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/1xxx/CVE-2025-1218.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"LOW\",\"baseScore\":3.4,\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r6x9-5r99-36j7:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "sourcePath": "/description", "text": "### Summary\r\n\r\nThe mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.\n\n### Details\r\n\r\n`BAIL_IF_NO_MORE_DATA` only guarantees that a single byte remains, but several call sites then read two or more bytes before re-checking. For example, the 2-byte read here happens before the over-read is detected:\r\n\r\nhttps://github.com/php/php-src/blob/8b682743196e765debb5056e56a97a67304f5e62/ext/mysqlnd/mysqlnd_wireprotocol.c#L871-L877\r\n\r\nThe same pattern occurs in the greeting, OK, EOF, auth-switch, cached-sha2, change-user, result-set header, prepared-statement response and row packet handlers. In addition, `php_mysqlnd_net_field_length()` and `php_mysqlnd_net_field_length_ll()` decode a length-encoded integer whose first byte selects a 3, 4 or 9 byte form, and read that many bytes without confirming they are present, so they can read 1 to 9 bytes out of bounds.\r\n\r\nThe fix replaces the single-byte guard with `BAIL_IF_NOT_ENOUGH_DATA_EX(n)`, which checks the exact number of bytes each read needs, and gives both field-length helpers a `remaining_size` argument so they return `MYSQLND_INVALID_NET_FIELD_LENGTH` instead of reading beyond the packet.\n\n### Impact\r\n\r\nApplications connecting to an untrusted or compromised MySQL server can be crashed, giving a denial of service. The bytes read past the buffer influence parsed field values but are not returned to the server, and the reads stay within the process heap. Applications that only connect to trusted database servers are not exposed.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-r6x9-5r99-36j7:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mysqlnd\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r6x9-5r99-36j7:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mysqlnd\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r6x9-5r99-36j7:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mysqlnd\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-r6x9-5r99-36j7:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-mysqlnd\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:31.774Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-r6x9-5r99-36j7", "modifiedAt": "2026-09-25T18:15:30.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.774Z", "fetchedAt": "2026-10-23T02:43:35.174Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T18:15:30.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPのmysqlndでMySQLへ接続する際、接続先が不正な応答を返すと停止する問題です。一般の閲覧者がデータベースにログインできなくても攻撃できる、とする問題ではありません。", "risk": "攻撃者が管理・侵害したMySQLサーバーから短すぎる応答が返ると、PHP処理がクラッシュして利用できなくなるおそれがあります。公式説明では、読み出したメモリーの内容は相手サーバーへ返りません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "mysqlndを使うアプリが、信頼できない、または侵害されたMySQLサーバーへ接続することが条件です。信頼できるデータベースだけに接続するアプリは、この攻撃経路にさらされないと開発元は説明しています。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "サーバー管理者へ「PHPの接続先DBは管理下のものだけか、利用者がDBホストを自由に指定できる機能はないか」を確認します。mysqliやPDO MySQLが内部でmysqlndを使う構成かも調べてもらいます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-1218", "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "PHPを修正版へ更新し、接続先DBとその管理者を把握します。DB側への侵入が疑われる場合は、その調査と認証情報の見直しも管理者へ依頼します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "利用者が自由にMySQL接続先を指定する機能は、更新まで停止または管理下の接続先だけに制限することを検討します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] } ], "verification": [ { "text": "普段のログイン、一覧表示、保存などDBを使う操作が成功し、PHPの異常終了が発生していないことを確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2025-1218（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2025-1218について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-1218", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1218", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:a0e083c6f9bb7571cc7ebad5a45e3836fc502cb3482baaff90e01c7ccc44d8ca", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-91766", "aliases": [ "GHSA-fpwc-w8rq-cr92" ], "title": "PHP：外部URLの転送先へ認証情報を送ってしまうおそれ", "summary": "PHPが認証トークンやCookieを付けて外部URLを読み、自動転送を追いかける機能を確認してください。転送先が別の会社のサイトでも、元の相手だけに渡すはずの情報を送る問題です。", "risk": "APIの認証トークン、セッションCookie、プロキシ認証情報が別の接続先へ漏れるおそれがあります。HTTPSからHTTPへの転送では、通信途中にも平文で露出します。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新します。過去に認証付き通信が外部の転送先へ送られた可能性があれば、その宛先と期間を調べ、漏れた可能性があるトークンやCookieを発行元で失効・再発行します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91766", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.http.php", "label": "PHP公式：HTTPヘッダーと転送設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:39.000Z", "modifiedAt": "2026-09-28T13:31:31.921Z", "fetchedAt": "2026-10-23T02:43:52.184Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).", "sourceTitle": "Cross-origin credential leak in HTTP stream wrapper redirects", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-standard", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-91766", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "fetchedAt": "2026-10-23T02:43:52.184Z", "publishedAt": "2026-09-25T20:40:25.040Z", "modifiedAt": "2026-09-28T13:31:31.921Z", "state": "published", "provider": "php", "title": "Cross-origin credential leak in HTTP stream wrapper redirects", "descriptions": [ { "lang": "en", "value": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nWhen the `http://` stream wrapper follows a redirect it forwards the user-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 (CVE-2018-1000007).\n\n### Details\r\n\r\nHeaders supplied through `stream_context_create()` are carried into the redirected request together with the rest of the context. Before the redirect is issued, the wrapper strips only `Content-Length` and `Content-Type`, and only when the method changes:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/http_fopen_wrapper.c#L703-L704\r\n\r\nThe flags handed to the recursive call carry no notion of the origin the credentials belong to:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/http_fopen_wrapper.c#L1133\r\n\r\nThe fix records the effective origin of the current request, being scheme, host and port with the default port filled in, and compares it with the parsed redirect target. When they differ, a new `HTTP_WRAPPER_STRIP_AUTH` flag is set and the three credential headers are removed from the user header bag before the next request is built. The flag is sticky, so credentials stay withheld for any further hops after a cross-origin one, matching libcurl's behaviour with `CURLOPT_UNRESTRICTED_AUTH` disabled.\r\n\r\nRemoving the last header from the bag also required `strip_header()` to drop the line break preceding it. Without that, the CRLF appended after the bag ends the header block early and the body of a body-preserving 307 or 308 redirect is corrupted. The same rewrite makes `strip_header()` scan line by line, so a repeated header, a folded continuation line, or the header name appearing inside another header's value can no longer leave the real header in place.\n\n### Impact\r\n\r\nAny application that uses `file_get_contents()`, `fopen()` or another `http://` stream with credential headers and leaves `follow_location` at its default is affected. An attacker who controls a redirect target, or a legitimate service that redirects to a third party, receives the bearer token, session cookie or proxy credentials of the caller. A redirect from HTTPS to HTTP additionally exposes them in cleartext on the network.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-standard", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92" }, { "lang": "en", "value": "Package ext-standard; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en", "description": "CWE-200", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-522", "lang": "en", "description": "CWE-522", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-standard\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-200\",\"description\":\"CWE-200\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-522\",\"description\":\"CWE-522\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91766.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.9,\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-fpwc-w8rq-cr92:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "sourcePath": "/description", "text": "### Summary\r\n\r\nWhen the `http://` stream wrapper follows a redirect it forwards the user-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 (CVE-2018-1000007).\n\n### Details\r\n\r\nHeaders supplied through `stream_context_create()` are carried into the redirected request together with the rest of the context. Before the redirect is issued, the wrapper strips only `Content-Length` and `Content-Type`, and only when the method changes:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/http_fopen_wrapper.c#L703-L704\r\n\r\nThe flags handed to the recursive call carry no notion of the origin the credentials belong to:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/standard/http_fopen_wrapper.c#L1133\r\n\r\nThe fix records the effective origin of the current request, being scheme, host and port with the default port filled in, and compares it with the parsed redirect target. When they differ, a new `HTTP_WRAPPER_STRIP_AUTH` flag is set and the three credential headers are removed from the user header bag before the next request is built. The flag is sticky, so credentials stay withheld for any further hops after a cross-origin one, matching libcurl's behaviour with `CURLOPT_UNRESTRICTED_AUTH` disabled.\r\n\r\nRemoving the last header from the bag also required `strip_header()` to drop the line break preceding it. Without that, the CRLF appended after the bag ends the header block early and the body of a body-preserving 307 or 308 redirect is corrupted. The same rewrite makes `strip_header()` scan line by line, so a repeated header, a folded continuation line, or the header name appearing inside another header's value can no longer leave the real header in place.\n\n### Impact\r\n\r\nAny application that uses `file_get_contents()`, `fopen()` or another `http://` stream with credential headers and leaves `follow_location` at its default is affected. An attacker who controls a redirect target, or a legitimate service that redirects to a third party, receives the bearer token, session cookie or proxy credentials of the caller. A redirect from HTTPS to HTTP additionally exposes them in cleartext on the network.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-fpwc-w8rq-cr92:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-fpwc-w8rq-cr92:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-fpwc-w8rq-cr92:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-fpwc-w8rq-cr92:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-standard\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:31.921Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-fpwc-w8rq-cr92", "modifiedAt": "2026-09-25T20:35:57.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:31.921Z", "fetchedAt": "2026-10-23T02:43:52.184Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T20:35:57.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPが認証トークンやCookieを付けて外部URLを読み、自動転送を追いかける機能を確認してください。転送先が別の会社のサイトでも、元の相手だけに渡すはずの情報を送る問題です。", "risk": "APIの認証トークン、セッションCookie、プロキシ認証情報が別の接続先へ漏れるおそれがあります。HTTPSからHTTPへの転送では、通信途中にも平文で露出します。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "file_get_contents()、fopen()等のHTTPストリームへAuthorization、Cookie、Proxy-Authorizationヘッダーを指定し、follow_locationが有効な場合です。相手側が別ホスト・別ポート・HTTPへ転送すると問題になります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "開発担当者へ「API通信で認証ヘッダーを付けたPHPストリームを使っているか、自動転送を許しているか」を確認します。PHPのcURL拡張とは区別して調べます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-91766", "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "PHPを修正版へ更新します。過去に認証付き通信が外部の転送先へ送られた可能性があれば、その宛先と期間を調べ、漏れた可能性があるトークンやCookieを発行元で失効・再発行します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "開発者が認証付き通信のfollow_locationを0にし、自動転送を止める方法を検討します。転送が必要な場合は宛先を確認し、別の接続先へ元の認証情報を渡さない実装にします。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92", "https://www.php.net/manual/en/context.http.php" ] } ], "verification": [ { "text": "API連携が動くことに加え、認証情報が許可した相手以外へ送られないことを開発者の管理する検証環境で確認します。本物のトークンを公開テストサイトへ送らないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-91766（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-91766について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-91766", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91766", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/context.http.php", "label": "PHP公式：HTTPヘッダーと転送設定" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:b2ee70af01e8e9237eb1b45c35d35e38ea10b5bfdbd86a49aaf287cf7d93a3bd", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-91765", "aliases": [ "GHSA-rgrp-mwpx-f6rm" ], "title": "PHP：SOAP連携の受付口へ1回の通信で処理停止を起こされるおそれ", "summary": "PHPのSoapServerで外部からのSOAP/XML通信を受け付けるシステムが対象です。SOAPを使っていない通常のページまで、この個別の条件に該当するとは限りません。", "risk": "深く入れ子になったXMLを送られるとPHP処理が止まります。繰り返されると対応できる処理プロセスが足りなくなり、連携機能が利用できなくなるおそれがあります。コード実行が実証された問題ではありません。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新し、SOAP連携が本当に必要な相手だけから届く構成にできるか確認します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91765", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:35.000Z", "modifiedAt": "2026-09-28T13:31:32.047Z", "fetchedAt": "2026-10-23T02:43:52.170Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.", "sourceTitle": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-soap", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-91765", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91765.json", "fetchedAt": "2026-10-23T02:43:52.170Z", "publishedAt": "2026-09-25T20:33:03.634Z", "modifiedAt": "2026-09-28T13:31:32.047Z", "state": "published", "provider": "php", "title": "SOAP: Unbounded Recursion in Server-Side cleanup_xml_node", "descriptions": [ { "lang": "en", "value": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\n`cleanup_xml_node()` in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any `SoapServer` endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.\n\n### Details\r\n\r\n`cleanup_xml_node()` walks the parsed document to remove blank text and comment nodes and descends into every child without a depth counter:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/soap/php_xml.c#L39-L67\r\n\r\nIt runs after libxml2 has finished parsing, on the path taken by `SoapServer::handle()`:\r\n\r\n\r\n\r\nlibxml2 applies its own limits while parsing, but this traversal is PHP's own post-parse step and had none. `soap_xmlParseMemory()` has the call commented out, so the reachable path is the `php://input` one used by the server.\r\n\r\nTwo further functions recurse on the same attacker-controlled structure: `master_to_zval_int()` in `ext/soap/php_encoding.c`, which follows `href` references and could also be driven into a cycle, and `get_node_with_attribute_recursive_ex()` in `ext/soap/php_xml.c`, which searches WSDL documents.\r\n\r\nThe fix introduces `SOAP_MAX_XML_DEPTH` (2048) and `SOAP_MAX_DECODE_DEPTH`, rewrites `cleanup_xml_node()` and the WSDL search as iterative traversals, and tracks a decode depth in the SOAP globals so `href` chains and cycles are rejected rather than followed indefinitely. Documents nested deeper than the limit are refused before traversal.\n\n### Impact\r\n\r\nAny PHP application exposing a `SoapServer` endpoint can be crashed by a single unauthenticated HTTP request. Under PHP-FPM the worker handling the request dies, and a stream of such requests exhausts the worker pool and takes the endpoint offline. This is a denial of service; the stack exhaustion does not give control over the crash.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-soap", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-674", "lang": "en", "description": "CWE-674", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91765.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91765.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91765.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-674\",\"description\":\"CWE-674\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/91xxx/CVE-2026-91765.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.5,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rgrp-mwpx-f6rm:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "sourcePath": "/description", "text": "### Summary\r\n\r\n`cleanup_xml_node()` in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any `SoapServer` endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.\n\n### Details\r\n\r\n`cleanup_xml_node()` walks the parsed document to remove blank text and comment nodes and descends into every child without a depth counter:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/soap/php_xml.c#L39-L67\r\n\r\nIt runs after libxml2 has finished parsing, on the path taken by `SoapServer::handle()`:\r\n\r\n\r\n\r\nlibxml2 applies its own limits while parsing, but this traversal is PHP's own post-parse step and had none. `soap_xmlParseMemory()` has the call commented out, so the reachable path is the `php://input` one used by the server.\r\n\r\nTwo further functions recurse on the same attacker-controlled structure: `master_to_zval_int()` in `ext/soap/php_encoding.c`, which follows `href` references and could also be driven into a cycle, and `get_node_with_attribute_recursive_ex()` in `ext/soap/php_xml.c`, which searches WSDL documents.\r\n\r\nThe fix introduces `SOAP_MAX_XML_DEPTH` (2048) and `SOAP_MAX_DECODE_DEPTH`, rewrites `cleanup_xml_node()` and the WSDL search as iterative traversals, and tracks a decode depth in the SOAP globals so `href` chains and cycles are rejected rather than followed indefinitely. Documents nested deeper than the limit are refused before traversal.\n\n### Impact\r\n\r\nAny PHP application exposing a `SoapServer` endpoint can be crashed by a single unauthenticated HTTP request. Under PHP-FPM the worker handling the request dies, and a stream of such requests exhausts the worker pool and takes the endpoint offline. This is a denial of service; the stack exhaustion does not give control over the crash.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-rgrp-mwpx-f6rm:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rgrp-mwpx-f6rm:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rgrp-mwpx-f6rm:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-rgrp-mwpx-f6rm:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-28T13:31:32.047Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-rgrp-mwpx-f6rm", "modifiedAt": "2026-09-24T11:26:56.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-28T13:31:32.047Z", "fetchedAt": "2026-10-23T02:43:52.170Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-24T11:26:56.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHPのSoapServerで外部からのSOAP/XML通信を受け付けるシステムが対象です。SOAPを使っていない通常のページまで、この個別の条件に該当するとは限りません。", "risk": "深く入れ子になったXMLを送られるとPHP処理が止まります。繰り返されると対応できる処理プロセスが足りなくなり、連携機能が利用できなくなるおそれがあります。コード実行が実証された問題ではありません。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "SoapServerの通信受付口へ、認証なしで細工したXMLを送れる場合に攻撃が成立します。PHP-FPMでは当該ワーカーが停止し、繰り返しの攻撃でワーカープールが使い果たされます。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "制作担当者へ「SoapServerを利用した外部連携のURLがあるか、インターネット全体から到達できるか」を確認します。SOAP拡張を入れているだけで、受付口があるとは限りません。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-91765", "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "PHPを修正版へ更新し、SOAP連携が本当に必要な相手だけから届く構成にできるか確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "使っていないSOAP受付口は停止します。取引先限定の連携であれば、Webサーバーやファイアウォールで必要な送信元だけに制限できるか管理者に依頼します。通信サイズ制限だけで完全対策とは判断しません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] } ], "verification": [ { "text": "通常のSOAP連携を実行し、成功することとPHPワーカーの異常終了がないことを確認します。公開中のサービスに攻撃用の深いXMLを送って試す必要はありません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-91765（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-91765について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-91765", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-91765", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:0326c44d63c1bc4afd05eebae01c61cb5d9792dacfe6ae7aab7f7b83945a735d", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2025-14181", "aliases": [ "GHSA-cj93-vc83-wgqv" ], "title": "PHP：SOAP連携先から極端に大きな応答を受けるとメモリーが壊れるおそれ", "summary": "SoapClientで外部のSOAPサーバーへ接続し、数GB規模の応答を受け取る構成が確認対象です。どのPHPビルドでも同じ条件で発生するわけではありません。", "risk": "悪意あるSOAPサーバー、または暗号化されていない通信を改変できる第三者により、PHPのクラッシュやメモリー破壊が起こるおそれがあります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新します。連携先を管理下のサーバーに限定できるか、業務上必要な最大応答サイズを決められるかも確認します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14181", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "label": "PHP公式：メモリー不足に関する別の脆弱性" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:31.000Z", "modifiedAt": "2026-09-25T20:44:13.720Z", "fetchedAt": "2026-10-23T02:43:35.499Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.", "sourceTitle": "Integer overflow to buffer overflow in soap HTTP parsing", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-soap", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-14181", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14181.json", "fetchedAt": "2026-10-23T02:43:35.499Z", "publishedAt": "2026-09-25T20:26:45.445Z", "modifiedAt": "2026-09-25T20:44:13.720Z", "state": "published", "provider": "php", "title": "Integer overflow to buffer overflow in soap HTTP parsing", "descriptions": [ { "lang": "en", "value": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.\n\n### Details\r\n\r\n`get_http_body()` in `ext/soap/php_http.c` accumulates chunked response data and checks for overflow like this:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/soap/php_http.c#L1494-L1499\r\n\r\n`http_buf_size` and `buf_size` are both `int`, so `http_buf_size + buf_size + 1 < 0` can only become true through signed integer overflow. That is undefined behaviour, and a compiler is free to assume it never happens and remove the branch. This was tested with Clang 20.1.7 and GCC 15.1.1, where the check did not trigger; other compilers and versions may behave differently, so the check cannot be relied upon.\r\n\r\nOnce the check is gone, `zend_string_realloc()` is reached with a length such as `18446744073709551614`. Adding the `zend_string` header overflows again, far too few bytes are allocated, and the following read loop writes past the end of the allocation.\r\n\r\nThe fix switches the accumulated size to `size_t`, bounds each growth step against `ZSTR_MAX_LEN` before allocating, and uses `zend_string_safe_realloc()` so the multiplication and addition are checked.\n\n### Impact\r\n\r\nA malicious SOAP server, or a man-in-the-middle on a plaintext SOAP connection, can overflow a heap buffer in a `SoapClient` that talks to it. The consequences depend on the heap layout and the compiler used to build PHP, ranging from a crash to memory corruption.\r\n\r\nThe bug only manifests on builds where the compiler discards the undefined signed-overflow check, and it requires the client to accept a multi-gigabyte response. Setting a low `memory_limit` causes an out-of-memory error before the overflow is reached and serves as a workaround.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-soap", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv" }, { "lang": "en", "value": "Package ext-soap; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer overflow or wraparound", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14181.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-soap\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14181.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14181.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-190\",\"description\":\"CWE-190 Integer overflow or wraparound\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/14xxx/CVE-2025-14181.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.5,\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-cj93-vc83-wgqv:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "sourcePath": "/description", "text": "### Summary\r\n\r\nThe SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.\n\n### Details\r\n\r\n`get_http_body()` in `ext/soap/php_http.c` accumulates chunked response data and checks for overflow like this:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/soap/php_http.c#L1494-L1499\r\n\r\n`http_buf_size` and `buf_size` are both `int`, so `http_buf_size + buf_size + 1 < 0` can only become true through signed integer overflow. That is undefined behaviour, and a compiler is free to assume it never happens and remove the branch. This was tested with Clang 20.1.7 and GCC 15.1.1, where the check did not trigger; other compilers and versions may behave differently, so the check cannot be relied upon.\r\n\r\nOnce the check is gone, `zend_string_realloc()` is reached with a length such as `18446744073709551614`. Adding the `zend_string` header overflows again, far too few bytes are allocated, and the following read loop writes past the end of the allocation.\r\n\r\nThe fix switches the accumulated size to `size_t`, bounds each growth step against `ZSTR_MAX_LEN` before allocating, and uses `zend_string_safe_realloc()` so the multiplication and addition are checked.\n\n### Impact\r\n\r\nA malicious SOAP server, or a man-in-the-middle on a plaintext SOAP connection, can overflow a heap buffer in a `SoapClient` that talks to it. The consequences depend on the heap layout and the compiler used to build PHP, ranging from a crash to memory corruption.\r\n\r\nThe bug only manifests on builds where the compiler discards the undefined signed-overflow check, and it requires the client to accept a multi-gigabyte response. Setting a low `memory_limit` causes an out-of-memory error before the overflow is reached and serves as a workaround.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-cj93-vc83-wgqv:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-cj93-vc83-wgqv:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-cj93-vc83-wgqv:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-cj93-vc83-wgqv:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-soap\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-25T20:44:13.720Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-cj93-vc83-wgqv", "modifiedAt": "2026-09-25T20:22:43.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T20:44:13.720Z", "fetchedAt": "2026-10-23T02:43:35.499Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T20:22:43.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "SoapClientで外部のSOAPサーバーへ接続し、数GB規模の応答を受け取る構成が確認対象です。どのPHPビルドでも同じ条件で発生するわけではありません。", "risk": "悪意あるSOAPサーバー、または暗号化されていない通信を改変できる第三者により、PHPのクラッシュやメモリー破壊が起こるおそれがあります。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "SoapClientが数GB規模の応答を受け取り、PHPを作成したコンパイラーが特定の整数検査を最適化で除くビルドの場合に発生します。単にSOAP拡張が有効というだけでは全条件を満たしません。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "開発担当者へ「SoapClientの接続先、HTTPSの利用、応答サイズ上限、PHP配布元」を確認します。コンパイラーの違いで自己判断して更新を省かず、修正済みパッケージを選びます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-14181", "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "PHPを修正版へ更新します。連携先を管理下のサーバーに限定できるか、業務上必要な最大応答サイズを決められるかも確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "更新まで、不要なSOAP連携を止めるか、接続先と応答サイズを制限することを検討します。個別アドバイザリにはmemory_limitを低くする回避策がありますが、未修正のCVE-2026-109618ではメモリー不足が別の危険につながるため、その設定だけを万能な対策として採用しないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w" ] } ], "verification": [ { "text": "通常サイズのSOAP応答が正しく処理されることを確認し、業務に不要な極端に大きい応答を受け付ける状態が残っていないか開発者に確認してもらいます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2025-14181（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2025-14181について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-14181", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14181", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "label": "PHP公式：メモリー不足に関する別の脆弱性" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:47f931df4c39267f03e305f439c742611c045712bf7c9d47dd8b8a8628a3dd3c", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-6103", "aliases": [ "GHSA-j3wh-g957-2m85" ], "title": "PHP：圧縮ファイルの確認時と展開時で中身をすり替えられるおそれ", "summary": "PharDataやphar://を使い、外部から受け取ったTARファイルを開く・展開する機能を確認します。Composerが.tar.gz形式のパッケージを取り込む経路にも関係します。", "risk": "検査したと思ったものと違うファイルを展開先へ書き込まれるおそれがあります。公式説明では、細工したパッケージからvendor/へ別のファイルを入れられる例が示されています。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 4.3, "cvssVersion": "3.1", "cvssSource": "php", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "Webサイト用と、Composer・バッチ作業用のPHPをそれぞれ更新します。外部から受け取ったアーカイブを展開する機能の保存先と権限も確認します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6103", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:27.000Z", "modifiedAt": "2026-09-25T20:41:27.115Z", "fetchedAt": "2026-10-23T02:43:49.768Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.", "sourceTitle": "Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-6103", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6103.json", "fetchedAt": "2026-10-23T02:43:49.768Z", "publishedAt": "2026-09-25T20:08:49.333Z", "modifiedAt": "2026-09-25T20:41:27.115Z", "state": "published", "provider": "php", "title": "Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection", "descriptions": [ { "lang": "en", "value": "phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\n`phar_tar_number()` parses the octal size field of a TAR header into a `uint32_t` with no overflow check. The field is 11 octal digits wide and holds values up to `0x1FFFFFFFF`, so a size above `0xFFFFFFFF` silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that `PharData` reports and extracts as if they were genuine.\n\n### Details\r\n\r\nThe parser accumulates octal digits without bounding the result:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/phar/tar.c#L23-L38\r\n\r\n| Octal field | True value | `uint32_t` result | Effect |\r\n|---|---|---|---|\r\n| `37777777777` | 0xFFFFFFFF | 4294967295 | largest value that does not wrap |\r\n| `40000000000` | 0x100000000 | 0 | size wraps to 0 |\r\n| `40000000001` | 0x100000001 | 1 | size wraps to 1 |\r\n| `40000001000` | 0x100000200 | 512 | size wraps to 512 |\r\n\r\nWhen the size wraps to 0 the parser reads the size at line 275, rounds it up to a block boundary at line 585 where `(0 + 511) & ~511` stays 0, then skips the data because the `size > 0` condition at line 587 is false. The next 512 bytes read are the entry's own data, parsed as a TAR header.\r\n\r\nThe GNU long filename path has an overflow check, but it only rejects `UINT_MAX` and `0`:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/phar/tar.c#L368\r\n\r\nA size that wraps to 1 passes it and allocates a one-byte buffer for what the header declares as a filename of more than 4 GB.\r\n\r\nGNU `tar` rejects the same archive with `not stopped at a record boundary`, while `PharData` accepts it and exposes the injected entries.\r\n\r\nThe fix replaces the size parse with `phar_tar_size()`, which accumulates into a `uint64_t`, rejects the GNU base-256 encoding, requires the whole field to be consumed, and refuses any value above `UINT32_MAX - 511`. It also introduces `phar_tar_type_has_data()` so the data blocks of every entry type that carries data are skipped, and rejects the unsupported GNU long link record outright.\n\n### Impact\r\n\r\nAn application that opens an untrusted TAR archive with `PharData` or the `phar://` stream wrapper sees a set of entries that differs from what the archive actually contains, and `extractTo()` writes the injected entries to disk. Tooling that validates an archive before extracting it can be made to inspect one set of files and extract another.\r\n\r\nComposer's `TarDownloader` uses `new PharData($file)` followed by `extractTo()` for every `.tar.gz` package, so a crafted package can place files into `vendor/` that are not present in the archive as any other tool reads it.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer overflow or wraparound", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6103.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6103.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6103.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-190\",\"description\":\"CWE-190 Integer overflow or wraparound\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6103.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":4.3,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-j3wh-g957-2m85:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "sourcePath": "/description", "text": "### Summary\r\n\r\n`phar_tar_number()` parses the octal size field of a TAR header into a `uint32_t` with no overflow check. The field is 11 octal digits wide and holds values up to `0x1FFFFFFFF`, so a size above `0xFFFFFFFF` silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that `PharData` reports and extracts as if they were genuine.\n\n### Details\r\n\r\nThe parser accumulates octal digits without bounding the result:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/phar/tar.c#L23-L38\r\n\r\n| Octal field | True value | `uint32_t` result | Effect |\r\n|---|---|---|---|\r\n| `37777777777` | 0xFFFFFFFF | 4294967295 | largest value that does not wrap |\r\n| `40000000000` | 0x100000000 | 0 | size wraps to 0 |\r\n| `40000000001` | 0x100000001 | 1 | size wraps to 1 |\r\n| `40000001000` | 0x100000200 | 512 | size wraps to 512 |\r\n\r\nWhen the size wraps to 0 the parser reads the size at line 275, rounds it up to a block boundary at line 585 where `(0 + 511) & ~511` stays 0, then skips the data because the `size > 0` condition at line 587 is false. The next 512 bytes read are the entry's own data, parsed as a TAR header.\r\n\r\nThe GNU long filename path has an overflow check, but it only rejects `UINT_MAX` and `0`:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/ext/phar/tar.c#L368\r\n\r\nA size that wraps to 1 passes it and allocates a one-byte buffer for what the header declares as a filename of more than 4 GB.\r\n\r\nGNU `tar` rejects the same archive with `not stopped at a record boundary`, while `PharData` accepts it and exposes the injected entries.\r\n\r\nThe fix replaces the size parse with `phar_tar_size()`, which accumulates into a `uint64_t`, rejects the GNU base-256 encoding, requires the whole field to be consumed, and refuses any value above `UINT32_MAX - 511`. It also introduces `phar_tar_type_has_data()` so the data blocks of every entry type that carries data are skipped, and rejects the unsupported GNU long link record outright.\n\n### Impact\r\n\r\nAn application that opens an untrusted TAR archive with `PharData` or the `phar://` stream wrapper sees a set of entries that differs from what the archive actually contains, and `extractTo()` writes the injected entries to disk. Tooling that validates an archive before extracting it can be made to inspect one set of files and extract another.\r\n\r\nComposer's `TarDownloader` uses `new PharData($file)` followed by `extractTo()` for every `.tar.gz` package, so a crafted package can place files into `vendor/` that are not present in the archive as any other tool reads it.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-j3wh-g957-2m85:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-j3wh-g957-2m85:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-j3wh-g957-2m85:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-j3wh-g957-2m85:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-25T20:41:27.115Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-j3wh-g957-2m85", "modifiedAt": "2026-09-25T18:16:04.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T20:41:27.115Z", "fetchedAt": "2026-10-23T02:43:49.768Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T18:16:04.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PharDataやphar://を使い、外部から受け取ったTARファイルを開く・展開する機能を確認します。Composerが.tar.gz形式のパッケージを取り込む経路にも関係します。", "risk": "検査したと思ったものと違うファイルを展開先へ書き込まれるおそれがあります。公式説明では、細工したパッケージからvendor/へ別のファイルを入れられる例が示されています。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "信頼できないTARアーカイブをPharDataまたはphar://で解析することが条件です。サイズ欄の不正な値により、ファイル内容の一部が別のファイル見出しとして扱われます。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "ファイルの取り込み、バックアップ復元、プラグイン配布、Composer実行の担当者へ「TARをPharDataで開く・展開する箇所があるか」を確認します。Web側だけでなく、インストールや更新作業用のPHPも調べます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-6103", "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "Webサイト用と、Composer・バッチ作業用のPHPをそれぞれ更新します。外部から受け取ったアーカイブを展開する機能の保存先と権限も確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "修正されるまで、信頼できないTARの取り込み・展開を一時停止します。別の解凍ツールで中身を確認しただけで、未修正のPharDataによる展開まで安全になったとは判断しません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] } ], "verification": [ { "text": "修正済みのPHPで通常の取り込み・復元・Composer更新が動くことを確認します。既に不審なアーカイブを処理した場合は、展開先のファイル変更を担当者に確認してもらいます。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-6103（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-6103について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-6103", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6103", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:0bf43de1f088f7f91b0e95d5e1f7121e50655315fc5eb71d2818f11e8c8abb48", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-17545", "aliases": [ "GHSA-9f67-6fw4-hpfp" ], "title": "Windows版PHP：特殊なファイル名で処理が止まるおそれ", "summary": "WindowsサーバーのPHPで、利用者が指定した名前をファイルの保存・読み込みに使う機能が確認対象です。Linux上のPHPや、閲覧者のWindowsパソコンの問題ではありません。", "risk": "通常ファイルのつもりでWindowsの特殊な装置名を開いてしまい、処理が待ち続けたり異常な読み書きになったりするおそれがあります。繰り返されるとサイトの処理が埋まって利用できなくなります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 6.9, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.34" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.35" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.26" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.11" } ], "fixed": [ "8.2.34", "8.3.35", "8.4.26", "8.5.11" ], "steps": [ "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "Windows版PHPを修正版へ更新します。開発担当者は、利用者が送った名前をそのままサーバー上の保存名にしない設計も検討します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17545", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-09-24T10:06:19.000Z", "modifiedAt": "2026-09-25T20:43:34.157Z", "fetchedAt": "2026-10-23T02:43:46.903Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.", "sourceTitle": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-17545", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17545.json", "fetchedAt": "2026-10-23T02:43:46.903Z", "publishedAt": "2026-09-25T20:18:11.288Z", "modifiedAt": "2026-09-25T20:43:34.157Z", "state": "published", "provider": "php", "title": "PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS", "descriptions": [ { "lang": "en", "value": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "### Summary\r\n\r\nOn Windows, PHP's filesystem and stream APIs do not reject reserved device names such as `CON`, `PRN`, `AUX`, `NUL`, `COM1` to `COM9`, `LPT1` to `LPT9`, `CONIN$` and `CONOUT$` when they appear as a component of a path. An attacker-controlled filename therefore reaches `CreateFileW()` and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.\n\n### Details\r\n\r\nPaths from application code flow through the stream wrapper layer into the Windows I/O layer. `file_get_contents()` opens the requested path via `php_stream_open_wrapper_ex()`, and `move_uploaded_file()` reaches `VCWD_RENAME()` and `php_copy_file_ex()`, so paths built from user-controlled upload filenames arrive at the same place.\r\n\r\nThe Windows path validation macro checks only for trailing spaces and certain trailing dots:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/win32/ioutil.h#L156-L169\r\n\r\nThere is no check for reserved device names, and `php_win32_ioutil_open_w()` passes the path straight to `CreateFileW()`:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/win32/ioutil.c#L205\r\n\r\nThat device handles can result from ordinary file opening is visible further on, where a handle whose `GetFileType()` is `FILE_TYPE_CHAR` is marked as `S_IFCHR` in `win32/ioutil.c` and simply flagged as non-seekable in `main/streams/plain_wrapper.c`, rather than being rejected.\r\n\r\nThe fix adds `php_win32_ioutil_path_kind_w()` and `php_win32_ioutil_path_kind_a()`, which classify a path as ordinary, a bare device name, or a path containing a reserved component. Reserved components are rejected with `ERROR_INVALID_NAME` before any I/O, while bare device names such as `NUL` and `NUL:` keep working for backwards compatibility, and DOS device paths (`\\\\.\\`, `\\\\?\\` and `\\??\\`) are left alone because Windows does not map device names inside them. Variants such as `NUL.txt`, `aux:stream` and `NUL ` are resolved through `RtlIsDosDeviceName_U` so that PHP follows the behaviour of the Windows version it runs on.\n\n### Impact\r\n\r\nA PHP application on Windows that builds a path from user input, such as a download endpoint or an upload destination taken from the client-supplied filename, can be made to operate on a device instead of a file. Depending on the device and the operation this blocks or hangs the request, produces unexpected read and write behaviour, or returns errors from the native API. Under concurrency, repeated requests to a blocking device exhaust the worker pool and deny service.\r\n\r\nOnly Windows deployments are affected. Reserved names are a Windows filesystem concept, and paths like `CON.txt` are devices there rather than ordinary filenames, which is why application-level path joining and normalisation does not catch them. The same class of issue has required fixes in other language ecosystems.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.34", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.35", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.26", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package php-src; vulnerable range: <8.2.34; patched versions: 8.2.34", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp" }, { "lang": "en", "value": "Package php-src; vulnerable range: <8.3.35; patched versions: 8.3.35", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp" }, { "lang": "en", "value": "Package php-src; vulnerable range: <8.4.26; patched versions: 8.4.26", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp" }, { "lang": "en", "value": "Package php-src; vulnerable range: <8.5.11; patched versions: 8.5.11", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-67", "lang": "en", "description": "CWE-67 Improper handling of windows device names", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H", "baseScore": 6.9, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17545.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.34\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.35\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.26\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.11\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17545.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17545.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-67\",\"description\":\"CWE-67 Improper handling of windows device names\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17545.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":6.9,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9f67-6fw4-hpfp:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "sourcePath": "/description", "text": "### Summary\r\n\r\nOn Windows, PHP's filesystem and stream APIs do not reject reserved device names such as `CON`, `PRN`, `AUX`, `NUL`, `COM1` to `COM9`, `LPT1` to `LPT9`, `CONIN$` and `CONOUT$` when they appear as a component of a path. An attacker-controlled filename therefore reaches `CreateFileW()` and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.\n\n### Details\r\n\r\nPaths from application code flow through the stream wrapper layer into the Windows I/O layer. `file_get_contents()` opens the requested path via `php_stream_open_wrapper_ex()`, and `move_uploaded_file()` reaches `VCWD_RENAME()` and `php_copy_file_ex()`, so paths built from user-controlled upload filenames arrive at the same place.\r\n\r\nThe Windows path validation macro checks only for trailing spaces and certain trailing dots:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/win32/ioutil.h#L156-L169\r\n\r\nThere is no check for reserved device names, and `php_win32_ioutil_open_w()` passes the path straight to `CreateFileW()`:\r\n\r\nhttps://github.com/php/php-src/blob/php-8.5.10/win32/ioutil.c#L205\r\n\r\nThat device handles can result from ordinary file opening is visible further on, where a handle whose `GetFileType()` is `FILE_TYPE_CHAR` is marked as `S_IFCHR` in `win32/ioutil.c` and simply flagged as non-seekable in `main/streams/plain_wrapper.c`, rather than being rejected.\r\n\r\nThe fix adds `php_win32_ioutil_path_kind_w()` and `php_win32_ioutil_path_kind_a()`, which classify a path as ordinary, a bare device name, or a path containing a reserved component. Reserved components are rejected with `ERROR_INVALID_NAME` before any I/O, while bare device names such as `NUL` and `NUL:` keep working for backwards compatibility, and DOS device paths (`\\\\.\\`, `\\\\?\\` and `\\??\\`) are left alone because Windows does not map device names inside them. Variants such as `NUL.txt`, `aux:stream` and `NUL ` are resolved through `RtlIsDosDeviceName_U` so that PHP follows the behaviour of the Windows version it runs on.\n\n### Impact\r\n\r\nA PHP application on Windows that builds a path from user input, such as a download endpoint or an upload destination taken from the client-supplied filename, can be made to operate on a device instead of a file. Depending on the device and the operation this blocks or hangs the request, produces unexpected read and write behaviour, or returns errors from the native API. Under concurrency, repeated requests to a blocking device exhaust the worker pool and deny service.\r\n\r\nOnly Windows deployments are affected. Reserved names are a Windows filesystem concept, and paths like `CON.txt` are devices there rather than ordinary filenames, which is why application-level path joining and normalisation does not catch them. The same class of issue has required fixes in other language ecosystems.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-9f67-6fw4-hpfp:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"<8.2.34\",\"patched_versions\":\"8.2.34\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9f67-6fw4-hpfp:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"<8.3.35\",\"patched_versions\":\"8.3.35\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9f67-6fw4-hpfp:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"<8.4.26\",\"patched_versions\":\"8.4.26\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-9f67-6fw4-hpfp:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"other\",\"name\":\"php-src\"},\"vulnerable_version_range\":\"<8.5.11\",\"patched_versions\":\"8.5.11\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-09-25T20:43:34.157Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-9f67-6fw4-hpfp", "modifiedAt": "2026-09-25T18:16:20.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T20:43:34.157Z", "fetchedAt": "2026-10-23T02:43:46.903Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-09-25T18:16:20.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "WindowsサーバーのPHPで、利用者が指定した名前をファイルの保存・読み込みに使う機能が確認対象です。Linux上のPHPや、閲覧者のWindowsパソコンの問題ではありません。", "risk": "通常ファイルのつもりでWindowsの特殊な装置名を開いてしまい、処理が待ち続けたり異常な読み書きになったりするおそれがあります。繰り返されるとサイトの処理が埋まって利用できなくなります。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.34未満、8.3系の8.3.35未満、8.4系の8.4.26未満、8.5系の8.5.11未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "Windows上で、外部入力からファイルパスを作ってファイル・ストリーム操作する場合です。CONやNULなどの予約名は、拡張子付きでも通常ファイルとは限りません。Linux構成はこのWindows固有の問題の対象ではありません。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "サーバーOSがWindowsかを確認し、開発者へ「アップロード時の元の名前や、ダウンロードURLの指定値を保存先・読込先のパスへ使っていないか」を確認します。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-17545", "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.34 / 8.3.35 / 8.4.26 / 8.5.11 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "Windows版PHPを修正版へ更新します。開発担当者は、利用者が送った名前をそのままサーバー上の保存名にしない設計も検討します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "更新まで、利用者が自由なファイル名・パスを指定できる機能を制限します。パスを連結したり通常のパス正規化を行ったりするだけでは、Windows予約名への対策になりません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] } ], "verification": [ { "text": "正規のアップロード・ダウンロードが動き、処理待ちが増えていないことを確認します。公開サイトへ特殊な装置名を送信して試す必要はありません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-17545（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-17545について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-17545", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17545", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:197cc69e5b07a76629eadd75707c3544997b224dfb2009237fb3a9d48aaec158", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-5430", "aliases": [], "title": "WSO2 Universal Gateway / WSO2 Traffic Manager / WSO2 API Control Plane / WSO2 API Manager / WSO2 Carbon API Manager Rest API Utility：認証の回避", "summary": "JWT 認証機構が、明示的に設定またはサポートされているアルゴリズム以外で署名されたトークンを受け入れてしまいます。このため、攻撃者はサポート外のアルゴリズムで署名された JWT を作成でき、システムがそれを誤って検証してしまい、認可されていないアクセスが可能になります。", "risk": "この脆弱性が悪用されると、システムへの不正アクセスが可能となり、管理者アカウントが乗っ取られるなど、アカウント全体の乗っ取りが起こる恐れがあります。", "product": "WSO2 Universal Gateway / WSO2 Traffic Manager / WSO2 API Control Plane / WSO2 API Manager / WSO2 Carbon API Manager Rest API Utility", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "WSO2", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "WSO2 Universal Gateway", "range": ">= 4.5.0 / < 4.5.0.57" }, { "product": "WSO2 Universal Gateway", "range": ">= 4.6.0 / < 4.6.0.21" }, { "product": "WSO2 Traffic Manager", "range": ">= 4.5.0 / < 4.5.0.56" }, { "product": "WSO2 Traffic Manager", "range": ">= 4.6.0 / < 4.6.0.21" }, { "product": "WSO2 API Control Plane", "range": ">= 4.5.0 / < 4.5.0.58" }, { "product": "WSO2 API Control Plane", "range": ">= 4.6.0 / < 4.6.0.22" }, { "product": "WSO2 API Manager", "range": ">= 4.1.0 / < 4.1.0.257" }, { "product": "WSO2 API Manager", "range": ">= 4.2.0 / < 4.2.0.197" }, { "product": "WSO2 API Manager", "range": ">= 4.3.0 / < 4.3.0.108" }, { "product": "WSO2 API Manager", "range": ">= 4.4.0 / < 4.4.0.72" }, { "product": "WSO2 API Manager", "range": ">= 4.5.0 / < 4.5.0.57" }, { "product": "WSO2 API Manager", "range": ">= 4.6.0 / < 4.6.0.21" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.20.74 / < 9.20.74.401" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.28.116 / < 9.28.116.417" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.29.120 / < 9.29.120.236" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.30.67 / < 9.30.67.167" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.31.86 / < 9.31.86.158" }, { "product": "WSO2 Carbon API Manager Rest API Utility", "range": ">= 9.32.147 / < 9.32.147.59" } ], "fixed": [], "steps": [ "WSO2 のセキュリティアナウンス 2026/WSO2-2026-5328 に記載された手順に従ってください。", "「CVE-2026-5430」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "label": "CVE：WSO2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5430", "label": "CVE公式レコード" }, { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5430", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-06T07:33:28.156Z", "modifiedAt": "2026-09-25T03:55:16.285Z", "fetchedAt": "2026-10-23T02:43:49.455Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.", "sourceTitle": "Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [ { "status": "affected", "version": "4.5.0", "lessThan": "4.5.0.57", "versionType": "custom" }, { "status": "affected", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [ { "status": "affected", "version": "4.5.0", "lessThan": "4.5.0.56", "versionType": "custom" }, { "status": "affected", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [ { "status": "affected", "version": "4.5.0", "lessThan": "4.5.0.58", "versionType": "custom" }, { "status": "affected", "version": "4.6.0", "lessThan": "4.6.0.22", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "WSO2", "product": "WSO2 API Manager", "versions": [ { "status": "unknown", "version": "0", "lessThan": "4.1.0", "versionType": "custom" }, { "status": "affected", "version": "4.1.0", "lessThan": "4.1.0.257", "versionType": "custom" }, { "status": "affected", "version": "4.2.0", "lessThan": "4.2.0.197", "versionType": "custom" }, { "status": "affected", "version": "4.3.0", "lessThan": "4.3.0.108", "versionType": "custom" }, { "status": "affected", "version": "4.4.0", "lessThan": "4.4.0.72", "versionType": "custom" }, { "status": "affected", "version": "4.5.0", "lessThan": "4.5.0.57", "versionType": "custom" }, { "status": "affected", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom" } ], "defaultStatus": "unaffected" }, { "vendor": "WSO2", "product": "WSO2 Carbon API Manager Rest API Utility", "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util", "versions": [ { "status": "affected", "version": "9.20.74", "lessThan": "9.20.74.401", "versionType": "custom" }, { "status": "affected", "version": "9.28.116", "lessThan": "9.28.116.417", "versionType": "custom" }, { "status": "affected", "version": "9.29.120", "lessThan": "9.29.120.236", "versionType": "custom" }, { "status": "affected", "version": "9.30.67", "lessThan": "9.30.67.167", "versionType": "custom" }, { "status": "affected", "version": "9.31.86", "lessThan": "9.31.86.158", "versionType": "custom" }, { "status": "affected", "version": "9.32.147", "lessThan": "9.32.147.59", "versionType": "custom" }, { "status": "unaffected", "version": "9.33.106", "lessThanOrEqual": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-5430", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "fetchedAt": "2026-10-23T02:43:49.455Z", "publishedAt": "2026-08-06T07:33:28.156Z", "modifiedAt": "2026-09-25T03:55:16.285Z", "state": "published", "provider": "WSO2", "title": "Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover", "descriptions": [ { "lang": "en", "value": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "WSO2", "product": "WSO2 Universal Gateway", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.5.0", "lessThan": "4.5.0.57", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WSO2", "product": "WSO2 Traffic Manager", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "4.5.0", "lessThan": "4.5.0.56", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WSO2", "product": "WSO2 API Control Plane", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "4.5.0", "lessThan": "4.5.0.58", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "4.6.0", "lessThan": "4.6.0.22", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WSO2", "product": "WSO2 API Manager", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "4.1.0", "versionType": "custom", "status": "unknown" }, { "sourcePath": "/containers/cna/affected/3/versions/1", "version": "4.1.0", "lessThan": "4.1.0.257", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/2", "version": "4.2.0", "lessThan": "4.2.0.197", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/3", "version": "4.3.0", "lessThan": "4.3.0.108", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/4", "version": "4.4.0", "lessThan": "4.4.0.72", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/5", "version": "4.5.0", "lessThan": "4.5.0.57", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/6", "version": "4.6.0", "lessThan": "4.6.0.21", "versionType": "custom", "status": "affected" } ] }, { "vendor": "WSO2", "product": "WSO2 Carbon API Manager Rest API Utility", "sourcePath": "/containers/cna/affected/4", "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "9.20.74", "lessThan": "9.20.74.401", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/1", "version": "9.28.116", "lessThan": "9.28.116.417", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/2", "version": "9.29.120", "lessThan": "9.29.120.236", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/3", "version": "9.30.67", "lessThan": "9.30.67.167", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/4", "version": "9.31.86", "lessThan": "9.31.86.158", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/5", "version": "9.32.147", "lessThan": "9.32.147.59", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/6", "version": "9.33.106", "lessThanOrEqual": "*", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [ { "lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Validation of Certificate With Host Mismatch", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "WSO2", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "label": "WSO2", "tags": [ "vendor-advisory" ], "provider": "WSO2", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-5430", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Universal Gateway\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.57\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Traffic Manager\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.56\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Control Plane\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.58\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.22\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Manager\",\"versions\":[{\"status\":\"unknown\",\"version\":\"0\",\"lessThan\":\"4.1.0\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.1.0\",\"lessThan\":\"4.1.0.257\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.2.0\",\"lessThan\":\"4.2.0.197\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.3.0\",\"lessThan\":\"4.3.0.108\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.4.0\",\"lessThan\":\"4.4.0.72\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.57\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Carbon API Manager Rest API Utility\",\"packageName\":\"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.20.74\",\"lessThan\":\"9.20.74.401\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.28.116\",\"lessThan\":\"9.28.116.417\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.29.120\",\"lessThan\":\"9.29.120.236\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.30.67\",\"lessThan\":\"9.30.67.167\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.31.86\",\"lessThan\":\"9.31.86.158\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.32.147\",\"lessThan\":\"9.32.147.59\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"9.33.106\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-347\",\"description\":\"CWE-347: Improper Validation of Certificate With Host Mismatch\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":10,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T03:55:16.285Z", "fetchedAt": "2026-10-23T02:43:49.455Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-24T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "WSO2 Universal Gateway / WSO2 Traffic Manager / WSO2 API Control Plane / WSO2 API Manager / WSO2 Carbon API Manager Rest API Utilityに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:37.226Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7b7de6be6c7afadd89b78d42202a62c96c38e49b218942e73b7e36fa48ec2479", "sourceModifiedAt": "2026-09-25T03:55:16.285Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "JWT 認証機構が、明示的に設定またはサポートされているアルゴリズム以外で署名されたトークンを受け入れてしまいます。このため、攻撃者はサポート外のアルゴリズムで署名された JWT を作成でき、システムがそれを誤って検証してしまい、認可されていないアクセスが可能になります。", "risk": "この脆弱性が悪用されると、システムへの不正アクセスが可能となり、管理者アカウントが乗っ取られるなど、アカウント全体の乗っ取りが起こる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "WSO2 Universal Gateway のバージョン 4.5.0 から 4.5.0.57 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "WSO2 Universal Gateway のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "WSO2 Traffic Manager のバージョン 4.5.0 から 4.5.0.56 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "WSO2 Traffic Manager のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "WSO2 API Control Plane のバージョン 4.5.0 から 4.5.0.58 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "WSO2 API Control Plane のバージョン 4.6.0 から 4.6.0.22 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.1.0 から 4.1.0.257 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.2.0 から 4.2.0.197 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.3.0 から 4.3.0.108 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.4.0 から 4.4.0.72 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.5.0 から 4.5.0.57 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 API Manager のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.20.74 から 9.20.74.401 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.28.116 から 9.28.116.417 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.29.120 から 9.29.120.236 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.30.67 から 9.30.67.167 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.31.86 から 9.31.86.158 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.32.147 から 9.32.147.59 未満 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "WSO2 Carbon API Manager Rest API Utility のバージョン 9.33.106 以降は影響を受けません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "公式の対象表：WSO2 / WSO2 Universal Gateway。影響ありとして記載：4.5.0以上、4.5.0.57未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：WSO2 / WSO2 Traffic Manager。影響ありとして記載：4.5.0以上、4.5.0.56未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：WSO2 / WSO2 API Control Plane。影響ありとして記載：4.5.0以上、4.5.0.58未満。影響ありとして記載：4.6.0以上、4.6.0.22未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：WSO2 / WSO2 API Manager。影響は未確定として記載：4.1.0未満の版。影響ありとして記載：4.1.0以上、4.1.0.257未満。影響ありとして記載：4.2.0以上、4.2.0.197未満。影響ありとして記載：4.3.0以上、4.3.0.108未満。影響ありとして記載：4.4.0以上、4.4.0.72未満。影響ありとして記載：4.5.0以上、4.5.0.57未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：WSO2 / WSO2 Carbon API Manager Rest API Utility。影響ありとして記載：9.20.74以上、9.20.74.401未満。影響ありとして記載：9.28.116以上、9.28.116.417未満。影響ありとして記載：9.29.120以上、9.29.120.236未満。影響ありとして記載：9.30.67以上、9.30.67.167未満。影響ありとして記載：9.31.86以上、9.31.86.158未満。影響ありとして記載：9.32.147以上、9.32.147.59未満。影響なしとして記載：9.33.106以上（原資料の上限表記は「*」）。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430" ], "evidenceIds": [ "E9" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E3" ] }, { "text": "「WSO2 Universal Gateway / WSO2 Traffic Manager / WSO2 API Control Plane / WSO2 API Manager / WSO2 Carbon API Manager Rest API Utility」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-5430", "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-5430" ] } ], "actions": [ { "text": "WSO2 のセキュリティアナウンス 2026/WSO2-2026-5328 に記載された手順に従ってください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E8" ] }, { "text": "「CVE-2026-5430」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-5430", "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-5430" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-5430", "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-5430" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-5430", "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-5430" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-5430", "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-5430" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "label": "CVE：WSO2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5430", "label": "CVE公式レコード" }, { "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5430", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.\n\nSuccessful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/title", "excerpt": "Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Universal Gateway\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.57\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Traffic Manager\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.56\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Control Plane\",\"versions\":[{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.58\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.22\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Manager\",\"versions\":[{\"status\":\"unknown\",\"version\":\"0\",\"lessThan\":\"4.1.0\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.1.0\",\"lessThan\":\"4.1.0.257\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.2.0\",\"lessThan\":\"4.2.0.197\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.3.0\",\"lessThan\":\"4.3.0.108\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.4.0\",\"lessThan\":\"4.4.0.72\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.57\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"WSO2\",\"product\":\"WSO2 Carbon API Manager Rest API Utility\",\"packageName\":\"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.20.74\",\"lessThan\":\"9.20.74.401\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.28.116\",\"lessThan\":\"9.28.116.417\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.29.120\",\"lessThan\":\"9.29.120.236\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.30.67\",\"lessThan\":\"9.30.67.167\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.31.86\",\"lessThan\":\"9.31.86.158\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"9.32.147\",\"lessThan\":\"9.32.147.59\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"9.33.106\",\"lessThanOrEqual\":\"*\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/5xxx/CVE-2026-5430.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/#solution", "language": "en", "representation": "source_excerpt" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-5430", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-5430\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-5430（WSO2 Universal Gateway / WSO2 Traffic Manager / WSO2 API Control Plane / WSO2 API Manager / WSO2 Carbon API Manager Rest API Utility）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WSO2 Universal Gateway のバージョン 4.5.0 から 4.5.0.57 未満 が影響を受けます。\n・WSO2 Universal Gateway のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。\n・WSO2 Traffic Manager のバージョン 4.5.0 から 4.5.0.56 未満 が影響を受けます。\n・WSO2 Traffic Manager のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。\n・WSO2 API Control Plane のバージョン 4.5.0 から 4.5.0.58 未満 が影響を受けます。\n・WSO2 API Control Plane のバージョン 4.6.0 から 4.6.0.22 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.1.0 から 4.1.0.257 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.2.0 から 4.2.0.197 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.3.0 から 4.3.0.108 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.4.0 から 4.4.0.72 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.5.0 から 4.5.0.57 未満 が影響を受けます。\n・WSO2 API Manager のバージョン 4.6.0 から 4.6.0.21 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.20.74 から 9.20.74.401 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.28.116 から 9.28.116.417 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.29.120 から 9.29.120.236 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.30.67 から 9.30.67.167 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.31.86 から 9.31.86.158 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.32.147 から 9.32.147.59 未満 が影響を受けます。\n・WSO2 Carbon API Manager Rest API Utility のバージョン 9.33.106 以降は影響を受けません。\n・公式の対象表：WSO2 / WSO2 Universal Gateway。影響ありとして記載：4.5.0以上、4.5.0.57未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。\n・公式の対象表：WSO2 / WSO2 Traffic Manager。影響ありとして記載：4.5.0以上、4.5.0.56未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。\n・公式の対象表：WSO2 / WSO2 API Control Plane。影響ありとして記載：4.5.0以上、4.5.0.58未満。影響ありとして記載：4.6.0以上、4.6.0.22未満。\n・公式の対象表：WSO2 / WSO2 API Manager。影響は未確定として記載：4.1.0未満の版。影響ありとして記載：4.1.0以上、4.1.0.257未満。影響ありとして記載：4.2.0以上、4.2.0.197未満。影響ありとして記載：4.3.0以上、4.3.0.108未満。影響ありとして記載：4.4.0以上、4.4.0.72未満。影響ありとして記載：4.5.0以上、4.5.0.57未満。影響ありとして記載：4.6.0以上、4.6.0.21未満。\n・公式の対象表：WSO2 / WSO2 Carbon API Manager Rest API Utility。影響ありとして記載：9.20.74以上、9.20.74.401未満。影響ありとして記載：9.28.116以上、9.28.116.417未満。影響ありとして記載：9.29.120以上、9.29.120.236未満。影響ありとして記載：9.30.67以上、9.30.67.167未満。影響ありとして記載：9.31.86以上、9.31.86.158未満。影響ありとして記載：9.32.147以上、9.32.147.59未満。影響なしとして記載：9.33.106以上（原資料の上限表記は「*」）。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-5430", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:37.226Z", "lastSuccess": "2026-10-23T03:21:37.226Z", "sourceCheckedAt": "2026-10-23T02:43:49.455Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-71362", "aliases": [], "title": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source：権限の奪取", "summary": "Adobe Commerce は不適切な認可（CWE‑863）の脆弱性があり、攻撃者がユーザーの操作なしに権限を昇格させ、機密リソースへのアクセス権を取得できる可能性があります。", "risk": "攻撃者が権限昇格に成功すると、機密リソースへのアクセス権が得られます。", "product": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source", "category": "other", "component": "package", "severity": "critical", "cvss": 9.1, "cvssVersion": "3.1", "cvssSource": "adobe", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "affected": [ { "product": "Adobe Commerce", "range": "<= 2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug" }, { "product": "Adobe Commerce B2B", "range": "<= 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul" }, { "product": "Magento Open Source", "range": "<= 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-71362", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71362", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-11T17:52:48.311Z", "modifiedAt": "2026-09-25T03:55:15.266Z", "fetchedAt": "2026-10-23T02:43:50.185Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "sourceTitle": "Adobe Commerce | Incorrect Authorization (CWE-863)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Adobe Commerce", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Adobe Commerce B2B", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Magento Open Source", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-71362", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "fetchedAt": "2026-10-23T02:43:50.185Z", "publishedAt": "2026-08-11T17:52:48.311Z", "modifiedAt": "2026-09-25T03:55:15.266Z", "state": "published", "provider": "adobe", "title": "Adobe Commerce | Incorrect Authorization (CWE-863)", "descriptions": [ { "lang": "en", "value": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Adobe", "product": "Adobe Commerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Adobe Commerce B2B", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Magento Open Source", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-863", "lang": "en", "description": "Incorrect Authorization (CWE-863)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "provider": "adobe", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "label": "adobe", "tags": [ "vendor-advisory" ], "provider": "adobe", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-863\",\"description\":\"Incorrect Authorization (CWE-863)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"availabilityRequirement\":\"NOT_DEFINED\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"environmentalScore\":9.1,\"environmentalSeverity\":\"CRITICAL\",\"exploitCodeMaturity\":\"NOT_DEFINED\",\"integrityImpact\":\"HIGH\",\"integrityRequirement\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"LOW\",\"modifiedAttackVector\":\"NETWORK\",\"modifiedAvailabilityImpact\":\"NONE\",\"modifiedConfidentialityImpact\":\"HIGH\",\"modifiedIntegrityImpact\":\"HIGH\",\"modifiedPrivilegesRequired\":\"NONE\",\"modifiedScope\":\"UNCHANGED\",\"modifiedUserInteraction\":\"NONE\",\"privilegesRequired\":\"NONE\",\"remediationLevel\":\"NOT_DEFINED\",\"reportConfidence\":\"NOT_DEFINED\",\"scope\":\"UNCHANGED\",\"temporalScore\":9.1,\"temporalSeverity\":\"CRITICAL\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-25T03:55:15.266Z", "fetchedAt": "2026-10-23T02:43:50.185Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-24T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Adobe Commerce / Adobe Commerce B2B / Magento Open Sourceに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:38.197Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bc5c6e670ffbfd3e0701147cd718ffc04631808a5da98ca097c1de9017271f89", "sourceModifiedAt": "2026-09-25T03:55:15.266Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Commerce は不適切な認可（CWE‑863）の脆弱性があり、攻撃者がユーザーの操作なしに権限を昇格させ、機密リソースへのアクセス権を取得できる可能性があります。", "risk": "攻撃者が権限昇格に成功すると、機密リソースへのアクセス権が得られます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Adobe Commerce のバージョン 0（カスタム）で、2.4.9-2026-jul、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Adobe Commerce B2B のバージョン 0（カスタム）で、1.5.3-2026-jul、1.5.2-2026-jul、1.4.2-2026-jul、1.3.4-2026-jul、1.3.3-2026-jul 以下は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Magento Open Source のバージョン 0（カスタム）で、2.4.9-2026-jul、2.4.8-2026-jul、2.4.7-2026-jul、2.4.6-2026-jul 以下は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul以下の版。影響なしとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul以下の版。影響なしとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Commerce / Adobe Commerce B2B / Magento Open Source」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-71362", "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-71362" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-71362", "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-71362" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-71362", "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-71362" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-71362", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-92.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71362", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourceField": "/containers/cna/title", "excerpt": "Adobe Commerce | Incorrect Authorization (CWE-863)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71362.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-71362", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-71362\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-71362（Adobe Commerce / Adobe Commerce B2B / Magento Open Source）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Adobe Commerce のバージョン 0（カスタム）で、2.4.9-2026-jul、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下は影響があります。\n・Adobe Commerce B2B のバージョン 0（カスタム）で、1.5.3-2026-jul、1.5.2-2026-jul、1.4.2-2026-jul、1.3.4-2026-jul、1.3.3-2026-jul 以下は影響があります。\n・Magento Open Source のバージョン 0（カスタム）で、2.4.9-2026-jul、2.4.8-2026-jul、2.4.7-2026-jul、2.4.6-2026-jul 以下は影響があります。\n・公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-jul, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug。\n・公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul以下の版。影響なしとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug。\n・公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul以下の版。影響なしとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-71362", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:38.197Z", "lastSuccess": "2026-10-23T03:21:38.197Z", "sourceCheckedAt": "2026-10-23T02:43:50.185Z", "errorCode": null }, "glossary": [ { "term": "権限昇格", "meaning": "本来その利用者には許可されていない、より強い権限で操作できるようになることです。必要な元の権限と、得られる権限を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/269.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-85102", "aliases": [], "title": "Quantum Security Gateway：コード実行", "summary": "Check Point Quantum Security Gateway の VPN ネゴシエーション時に、証明書の信頼性検証が不適切に行われるため、認証されていないリモート攻撃者がゲートウェイ上で任意のコードを実行できる可能性があります。", "risk": "認証されていないリモート攻撃者がゲートウェイ上で任意のコードを実行できるため、システムが乗っ取られる危険があります。", "product": "Quantum Security Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "checkpoint", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Quantum Security Gateway", "range": "R82.10 with Jumbo Hotfix Take 43 or below" }, { "product": "Quantum Security Gateway", "range": "R82 with Jumbo Hotfix Take 125 or below" }, { "product": "Quantum Security Gateway", "range": "R81.20 with Jumbo Hotfix Take 165 or below" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85102", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk1000117", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85102", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-09T13:00:31.206Z", "modifiedAt": "2026-09-23T03:55:34.599Z", "fetchedAt": "2026-10-23T02:43:51.397Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "sourceTitle": "Improper Certificate Validation in Quantum Security Gateway", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Quantum Security Gateway", "vendor": "checkpoint", "versions": [ { "status": "affected", "version": "R82.10 with Jumbo Hotfix Take 43 or below" }, { "status": "affected", "version": "R82 with Jumbo Hotfix Take 125 or below" }, { "status": "affected", "version": "R81.20 with Jumbo Hotfix Take 165 or below" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-85102", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "fetchedAt": "2026-10-23T02:43:51.397Z", "publishedAt": "2026-09-09T13:00:31.206Z", "modifiedAt": "2026-09-23T03:55:34.599Z", "state": "published", "provider": "checkpoint", "title": "Improper Certificate Validation in Quantum Security Gateway", "descriptions": [ { "lang": "en", "value": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "checkpoint", "product": "Quantum Security Gateway", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "R82.10 with Jumbo Hotfix Take 43 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "R82 with Jumbo Hotfix Take 125 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "R81.20 with Jumbo Hotfix Take 165 or below", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "checkpoint", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.checkpoint.com/results/sk/sk1000117", "label": "checkpoint", "tags": [], "provider": "checkpoint", "sourcePath": "/containers/cna/references/0" }, { "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Quantum Security Gateway\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 43 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 125 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 165 or below\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-295\",\"description\":\"CWE-295: Improper Certificate Validation.\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-23T03:55:34.599Z", "fetchedAt": "2026-10-23T02:43:51.397Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Quantum Security Gatewayにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:41.294Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9665fe012c103585b7275061946ef250b4e42a1d20a10474ef6941acef596d6a", "sourceModifiedAt": "2026-09-23T03:55:34.599Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Check Point Quantum Security Gateway の VPN ネゴシエーション時に、証明書の信頼性検証が不適切に行われるため、認証されていないリモート攻撃者がゲートウェイ上で任意のコードを実行できる可能性があります。", "risk": "認証されていないリモート攻撃者がゲートウェイ上で任意のコードを実行できるため、システムが乗っ取られる危険があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Quantum Security Gateway のバージョン R82.10 に Jumbo Hotfix Take 43 まで（それ以下）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Gateway のバージョン R82 に Jumbo Hotfix Take 125 まで（それ以下）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Gateway のバージョン R81.20 に Jumbo Hotfix Take 165 まで（それ以下）が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Quantum Security Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85102", "https://support.checkpoint.com/results/sk/sk1000117", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85102" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-85102", "https://support.checkpoint.com/results/sk/sk1000117", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85102" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85102", "https://support.checkpoint.com/results/sk/sk1000117", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85102" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85102", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk1000117", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85102", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourceField": "/containers/cna/title", "excerpt": "Improper Certificate Validation in Quantum Security Gateway", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85102.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Quantum Security Gateway\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 43 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 125 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 165 or below\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85102", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-85102\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-85102（Quantum Security Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Quantum Security Gateway のバージョン R82.10 に Jumbo Hotfix Take 43 まで（それ以下）が影響を受けます。\n・Quantum Security Gateway のバージョン R82 に Jumbo Hotfix Take 125 まで（それ以下）が影響を受けます。\n・Quantum Security Gateway のバージョン R81.20 に Jumbo Hotfix Take 165 まで（それ以下）が影響を受けます。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-85102", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:41.294Z", "lastSuccess": "2026-10-23T03:21:41.294Z", "sourceCheckedAt": "2026-10-23T02:43:51.397Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-93616", "aliases": [], "title": "Quantum Security Management：ファイルへの不正アクセス", "summary": "ディレクトリトラバーサルとファイルアップロードの脆弱性により、認証されていない攻撃者がチェックポイントのManagement Serverに任意のスクリプトをアップロードし、実行できる。", "risk": "任意のスクリプトが実行され、サーバー上で攻撃者のコードが動く可能性がある。", "product": "Quantum Security Management", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "checkpoint", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Quantum Security Management", "range": "R82.20 with no Jumbo Hotfix" }, { "product": "Quantum Security Management", "range": "R82.10 with Jumbo Hotfix Take 44 or below" }, { "product": "Quantum Security Management", "range": "R82 with Jumbo Hotfix Take 126 or below" }, { "product": "Quantum Security Management", "range": "R81.20 with Jumbo Hotfix Take 166 or below" }, { "product": "Quantum Security Management", "range": "R81.10 (EOS) with Jumbo Hotfix Take 190 or below" }, { "product": "Quantum Security Management", "range": "R81 (EOS)" }, { "product": "Quantum Security Management", "range": "R80.40 (EOS)" }, { "product": "Quantum Security Management", "range": "R80.30 (EOS)" }, { "product": "Quantum Security Management", "range": "R80.20 (EOS)" }, { "product": "Quantum Security Management", "range": "R80.10 (EOS)" }, { "product": "Quantum Security Management", "range": "R80 (EOS)" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93616", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk1000171", "label": "CVE掲載の参考情報" }, { "url": "https://support.checkpoint.com/results/sk/sk1000171/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93616", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-22T12:59:01.057Z", "modifiedAt": "2026-09-23T03:55:59.259Z", "fetchedAt": "2026-10-23T02:43:52.882Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "sourceTitle": "Directory Traversal and File upload allows execution of arbitrary script on the Management Server", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Quantum Security Management", "vendor": "checkpoint", "versions": [ { "status": "affected", "version": "R82.20 with no Jumbo Hotfix" }, { "status": "affected", "version": "R82.10 with Jumbo Hotfix Take 44 or below" }, { "status": "affected", "version": "R82 with Jumbo Hotfix Take 126 or below" }, { "status": "affected", "version": "R81.20 with Jumbo Hotfix Take 166 or below" }, { "status": "affected", "version": "R81.10 (EOS) with Jumbo Hotfix Take 190 or below" }, { "status": "affected", "version": "R81 (EOS)" }, { "status": "affected", "version": "R80.40 (EOS)" }, { "status": "affected", "version": "R80.30 (EOS)" }, { "status": "affected", "version": "R80.20 (EOS)" }, { "status": "affected", "version": "R80.10 (EOS)" }, { "status": "affected", "version": "R80 (EOS)" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93616", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "fetchedAt": "2026-10-23T02:43:52.882Z", "publishedAt": "2026-09-22T12:59:01.057Z", "modifiedAt": "2026-09-23T03:55:59.259Z", "state": "published", "provider": "checkpoint", "title": "Directory Traversal and File upload allows execution of arbitrary script on the Management Server", "descriptions": [ { "lang": "en", "value": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "checkpoint", "product": "Quantum Security Management", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "R82.20 with no Jumbo Hotfix", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "R82.10 with Jumbo Hotfix Take 44 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "R82 with Jumbo Hotfix Take 126 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "R81.20 with Jumbo Hotfix Take 166 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "R81.10 (EOS) with Jumbo Hotfix Take 190 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "R81 (EOS)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "R80.40 (EOS)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "R80.30 (EOS)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "R80.20 (EOS)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "R80.10 (EOS)", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "R80 (EOS)", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "checkpoint", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.checkpoint.com/results/sk/sk1000171", "label": "checkpoint", "tags": [], "provider": "checkpoint", "sourcePath": "/containers/cna/references/0" }, { "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Quantum Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.20 with no Jumbo Hotfix\"},{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 44 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 126 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 166 or below\"},{\"status\":\"affected\",\"version\":\"R81.10 (EOS) with Jumbo Hotfix Take 190 or below\"},{\"status\":\"affected\",\"version\":\"R81 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.40 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.30 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.20 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.10 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80 (EOS)\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-23T03:55:59.259Z", "fetchedAt": "2026-10-23T02:43:52.882Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Quantum Security Managementにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:41.813Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4994d3931c09a586ee5fec78d8788341f9eb0eae8209dfdb60774d3cfb542b07", "sourceModifiedAt": "2026-09-23T03:55:59.259Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ディレクトリトラバーサルとファイルアップロードの脆弱性により、認証されていない攻撃者がチェックポイントのManagement Serverに任意のスクリプトをアップロードし、実行できる。", "risk": "任意のスクリプトが実行され、サーバー上で攻撃者のコードが動く可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Quantum Security Management R82.20 (Jumbo Hotfixなし) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R82.10 (Jumbo Hotfix Take 44 以下) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R82 (Jumbo Hotfix Take 126 以下) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R81.20 (Jumbo Hotfix Take 166 以下) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R81.10 (EOS) (Jumbo Hotfix Take 190 以下) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R81 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R80.40 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R80.30 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R80.20 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R80.10 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Quantum Security Management R80 (EOS) が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：checkpoint / Quantum Security Management。影響ありとして記載：R81 (EOS)。影響ありとして記載：R80.40 (EOS)。影響ありとして記載：R80.30 (EOS)。影響ありとして記載：R80.20 (EOS)。影響ありとして記載：R80.10 (EOS)。影響ありとして記載：R80 (EOS)。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Quantum Security Management」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93616" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93616" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "https://support.checkpoint.com/results/sk/sk1000171/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93616" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93616", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk1000171", "label": "CVE掲載の参考情報" }, { "url": "https://support.checkpoint.com/results/sk/sk1000171/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93616", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourceField": "/containers/cna/title", "excerpt": "Directory Traversal and File upload allows execution of arbitrary script on the Management Server", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93616.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Quantum Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.20 with no Jumbo Hotfix\"},{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 44 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 126 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 166 or below\"},{\"status\":\"affected\",\"version\":\"R81.10 (EOS) with Jumbo Hotfix Take 190 or below\"},{\"status\":\"affected\",\"version\":\"R81 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.40 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.30 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.20 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80.10 (EOS)\"},{\"status\":\"affected\",\"version\":\"R80 (EOS)\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93616", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-93616\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-93616（Quantum Security Management）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Quantum Security Management R82.20 (Jumbo Hotfixなし) が影響を受ける。\n・Quantum Security Management R82.10 (Jumbo Hotfix Take 44 以下) が影響を受ける。\n・Quantum Security Management R82 (Jumbo Hotfix Take 126 以下) が影響を受ける。\n・Quantum Security Management R81.20 (Jumbo Hotfix Take 166 以下) が影響を受ける。\n・Quantum Security Management R81.10 (EOS) (Jumbo Hotfix Take 190 以下) が影響を受ける。\n・Quantum Security Management R81 (EOS) が影響を受ける。\n・Quantum Security Management R80.40 (EOS) が影響を受ける。\n・Quantum Security Management R80.30 (EOS) が影響を受ける。\n・Quantum Security Management R80.20 (EOS) が影響を受ける。\n・Quantum Security Management R80.10 (EOS) が影響を受ける。\n・Quantum Security Management R80 (EOS) が影響を受ける。\n・公式の対象表：checkpoint / Quantum Security Management。影響ありとして記載：R81 (EOS)。影響ありとして記載：R80.40 (EOS)。影響ありとして記載：R80.30 (EOS)。影響ありとして記載：R80.20 (EOS)。影響ありとして記載：R80.10 (EOS)。影響ありとして記載：R80 (EOS)。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93616", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:41.813Z", "lastSuccess": "2026-10-23T03:21:41.813Z", "sourceCheckedAt": "2026-10-23T02:43:52.882Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-93952", "aliases": [], "title": "VeloCloud Orchestrator (VCO) On-Prem：脆弱性情報", "summary": "VeloCloud Orchestrator (VCO) のオンプレミス版に、リモートの攻撃者が特権的な内部機能にアクセスし、VCO ホストに影響を与える可能性があるセキュリティ問題があります。攻撃が成功すると、オーケストレータおよびオーケストレータが管理するデータの機密性・完全性・可用性が侵害される恐れがあります。また、ホスト型（Dedicated を含む）バージョンの VCO も影響を受けており、すでにパッチが提供されています。", "risk": "機密情報が漏洩したり、データが改ざんされたり、サービスが利用できなくなる可能性があります。", "product": "VeloCloud Orchestrator (VCO) On-Prem", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "Arista", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "VeloCloud Orchestrator (VCO) On-Prem", "range": ">= 5.2.0 / <= 5.2.3.15（環境: VeloCloud Orchestrator On-Prem）" }, { "product": "VeloCloud Orchestrator (VCO) On-Prem", "range": ">= 6.1.0 / <= 6.1.3.7（環境: VeloCloud Orchestrator On-Prem）" }, { "product": "VeloCloud Orchestrator (VCO) On-Prem", "range": ">= 6.4.0 / <= 6.4.2.7（環境: VeloCloud Orchestrator On-Prem）" }, { "product": "VeloCloud Orchestrator (VCO) On-Prem", "range": ">= 7.0.0 / <= 7.0.0.2（環境: VeloCloud Orchestrator On-Prem）" } ], "fixed": [], "steps": [ "できるだけ早く、影響が修正された VCO ソフトウェアにアップグレードしてください。修正は以下のリリースで提供されています：\n- 5.2.3 系列の VCO 5.2.3.16 以降\n- 6.4.2 系列の VCO 6.4.2.8 以降\n他のリリース系列でも順次修正が追加されます。サポート対象外のリリースを使用している場合は、TAC に問い合わせてアップグレードオプションを検討してください。", "「CVE-2026-93952」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "label": "CVE：Arista" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93952", "label": "CVE公式レコード" }, { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93952", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-22T07:37:24.300Z", "modifiedAt": "2026-09-23T03:55:40.823Z", "fetchedAt": "2026-10-23T02:43:52.971Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.", "sourceTitle": "Security Advisory 0183", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Arista Networks", "product": "VeloCloud Orchestrator (VCO) On-Prem", "platforms": [ "VeloCloud Orchestrator On-Prem" ], "defaultStatus": "unaffected", "versions": [ { "version": "5.2.0", "lessThanOrEqual": "5.2.3.15", "status": "affected", "versionType": "custom" }, { "version": "6.1.0", "lessThanOrEqual": "6.1.3.7", "status": "affected", "versionType": "custom" }, { "version": "6.4.0", "lessThanOrEqual": "6.4.2.7", "status": "affected", "versionType": "custom" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.0.2", "status": "affected", "versionType": "custom" } ] } ], "configurationNotes": "対象環境・機能: VeloCloud Orchestrator On-Prem。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-93952", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "fetchedAt": "2026-10-23T02:43:52.971Z", "publishedAt": "2026-09-22T07:37:24.300Z", "modifiedAt": "2026-09-23T03:55:40.823Z", "state": "published", "provider": "Arista", "title": "Security Advisory 0183", "descriptions": [ { "lang": "en", "value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Arista Networks", "product": "VeloCloud Orchestrator (VCO) On-Prem", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "VeloCloud Orchestrator On-Prem" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.2.0", "lessThanOrEqual": "5.2.3.15", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "6.1.0", "lessThanOrEqual": "6.1.3.7", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.4.0", "lessThanOrEqual": "6.4.2.7", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.0", "lessThanOrEqual": "7.0.0.2", "versionType": "custom", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The recommended resolution is to upgrade to a remediated VCO software version at your earliest convenience. These vulnerabilities have been fixed in the following releases:\n- VCO 5.2.3.16 and later in the 5.2.3 train\n- VCO 6.4.2.8 and later in the 6.4.2 train\n\nReleases in other release trains that fix this will be added over time. For VCOs not on a supported release train, customers can contact TAC to discuss possible upgrade options.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Until fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n- Restrict access to the VCO web interface to trusted administrative networks.\n- Monitor the VCO for accesses from known malicious source IPs.\n- Monitor for unexpected outbound network activity from the VCO host.\n- Consider blocking outbound ports not needed for normal activities.\n- Monitor for backdoor daemons and webshells.\n- Review recent administrator activity for unexpected changes.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "Arista", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 9.5, "baseSeverity": "CRITICAL", "provider": "Arista", "sourcePath": "/containers/cna/metrics/1/cvssV4_0" } ], "references": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "label": "Security Advisory 0183", "tags": [ "vendor-advisory" ], "provider": "Arista", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Arista Networks\",\"product\":\"VeloCloud Orchestrator (VCO) On-Prem\",\"platforms\":[\"VeloCloud Orchestrator On-Prem\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"5.2.0\",\"lessThanOrEqual\":\"5.2.3.15\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"6.1.0\",\"lessThanOrEqual\":\"6.1.3.7\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.2.7\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.0.2\",\"status\":\"affected\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The recommended resolution is to upgrade to a remediated VCO software version at your earliest convenience. These vulnerabilities have been fixed in the following releases:\n- VCO 5.2.3.16 and later in the 5.2.3 train\n- VCO 6.4.2.8 and later in the 6.4.2 train\n\nReleases in other release trains that fix this will be added over time. For VCOs not on a supported release train, customers can contact TAC to discuss possible upgrade options.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Until fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n- Restrict access to the VCO web interface to trusted administrative networks.\n- Monitor the VCO for accesses from known malicious source IPs.\n- Monitor for unexpected outbound network activity from the VCO host.\n- Consider blocking outbound ports not needed for normal activities.\n- Monitor for backdoor daemons and webshells.\n- Review recent administrator activity for unexpected changes.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"CWE\",\"cweId\":\"CWE-20\",\"lang\":\"en\",\"description\":\"CWE-20 Improper Input Validation\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\",\"baseScore\":9.5,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-23T03:55:40.823Z", "fetchedAt": "2026-10-23T02:43:52.971Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "VeloCloud Orchestrator (VCO) On-Premに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:43.026Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "628bf34f31b5134953c12b068f3307495fcd352343eda55ea985ae56cc394fe8", "sourceModifiedAt": "2026-09-23T03:55:40.823Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "VeloCloud Orchestrator (VCO) のオンプレミス版に、リモートの攻撃者が特権的な内部機能にアクセスし、VCO ホストに影響を与える可能性があるセキュリティ問題があります。攻撃が成功すると、オーケストレータおよびオーケストレータが管理するデータの機密性・完全性・可用性が侵害される恐れがあります。また、ホスト型（Dedicated を含む）バージョンの VCO も影響を受けており、すでにパッチが提供されています。", "risk": "機密情報が漏洩したり、データが改ざんされたり、サービスが利用できなくなる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 5.2.0 から 5.2.3.15（5.2.3.15 を含む）までが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 6.1.0 から 6.1.3.7（6.1.3.7 を含む）までが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 6.4.0 から 6.4.2.7（6.4.2.7 を含む）までが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 7.0.0 から 7.0.0.2（7.0.0.2 を含む）までが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Arista Networks / VeloCloud Orchestrator (VCO) On-Prem。影響ありとして記載：5.2.0以上、5.2.3.15以下。影響ありとして記載：6.1.0以上、6.1.3.7以下。影響ありとして記載：6.4.0以上、6.4.2.7以下。影響ありとして記載：7.0.0以上、7.0.0.2以下。対象の環境：VeloCloud Orchestrator On-Prem", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3" ] }, { "text": "「VeloCloud Orchestrator (VCO) On-Prem」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-93952", "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93952" ] } ], "actions": [ { "text": "できるだけ早く、影響が修正された VCO ソフトウェアにアップグレードしてください。修正は以下のリリースで提供されています：\n- 5.2.3 系列の VCO 5.2.3.16 以降\n- 6.4.2 系列の VCO 6.4.2.8 以降\n他のリリース系列でも順次修正が追加されます。サポート対象外のリリースを使用している場合は、TAC に問い合わせてアップグレードオプションを検討してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2026-93952」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-93952", "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93952" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-93952", "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93952" ] } ], "temporaryMitigations": [ { "text": "修正されたソフトウェアが導入できるまで、環境に適した防御層を適用してください：\n- VCO の Web インターフェースへのアクセスを信頼できる管理ネットワークに限定する。\n- 既知の悪意ある送信元 IP からのアクセスを監視する。\n- VCO ホストからの予期しない外部通信を監視する。\n- 通常の業務に不要な外部ポートをブロックすることを検討する。\n- バックドア用デーモンやウェブシェルの有無を監視する。\n- 最近の管理者操作を確認し、予期しない変更がないかチェックする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-93952", "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-93952" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "label": "CVE：Arista" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93952", "label": "CVE公式レコード" }, { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93952", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourceField": "/containers/cna/title", "excerpt": "Security Advisory 0183", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Arista Networks\",\"product\":\"VeloCloud Orchestrator (VCO) On-Prem\",\"platforms\":[\"VeloCloud Orchestrator On-Prem\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"5.2.0\",\"lessThanOrEqual\":\"5.2.3.15\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"6.1.0\",\"lessThanOrEqual\":\"6.1.3.7\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.2.7\",\"status\":\"affected\",\"versionType\":\"custom\"},{\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.0.2\",\"status\":\"affected\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "The recommended resolution is to upgrade to a remediated VCO software version at your earliest convenience. These vulnerabilities have been fixed in the following releases:\n- VCO 5.2.3.16 and later in the 5.2.3 train\n- VCO 6.4.2.8 and later in the 6.4.2 train\n\nReleases in other release trains that fix this will be added over time. For VCOs not on a supported release train, customers can contact TAC to discuss possible upgrade options.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93952.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Until fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n- Restrict access to the VCO web interface to trusted administrative networks.\n- Monitor the VCO for accesses from known malicious source IPs.\n- Monitor for unexpected outbound network activity from the VCO host.\n- Consider blocking outbound ports not needed for normal activities.\n- Monitor for backdoor daemons and webshells.\n- Review recent administrator activity for unexpected changes.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-93952", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-93952\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-93952（VeloCloud Orchestrator (VCO) On-Prem）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 5.2.0 から 5.2.3.15（5.2.3.15 を含む）までが影響を受けます。\n・バージョン 6.1.0 から 6.1.3.7（6.1.3.7 を含む）までが影響を受けます。\n・バージョン 6.4.0 から 6.4.2.7（6.4.2.7 を含む）までが影響を受けます。\n・バージョン 7.0.0 から 7.0.0.2（7.0.0.2 を含む）までが影響を受けます。\n・公式の対象表：Arista Networks / VeloCloud Orchestrator (VCO) On-Prem。影響ありとして記載：5.2.0以上、5.2.3.15以下。影響ありとして記載：6.1.0以上、6.1.3.7以下。影響ありとして記載：6.4.0以上、6.4.2.7以下。影響ありとして記載：7.0.0以上、7.0.0.2以下。対象の環境：VeloCloud Orchestrator On-Prem\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-93952", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:43.026Z", "lastSuccess": "2026-10-23T03:21:43.026Z", "sourceCheckedAt": "2026-10-23T02:43:52.971Z", "errorCode": null }, "glossary": [] } } ], "total": 2185, "limit": 20, "offset": 360, "filters": { "product": "all", "type": "all", "q": "", "page": 19 }, "pagination": { "page": 19, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 0, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T11:02:49.534Z 〜 2026-10-23T12:17:49.722Z、全製品の変更 0/0件まで確認、対象0件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }