{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-94127", "aliases": [], "title": "BIG-IP：コード実行", "summary": "BIG‑IP APM のアクセスポリシーと OAuth プロファイルが仮想サーバー上で設定されている場合、特定の悪意あるトラフィックによりサーバー上で攻撃者のコードが実行されるリモートコード実行（RCE）の脆弱性が発生します。この脆弱性は、BIG‑IP APM が OAuth 認可サーバーとして構成されているときにのみ存在します。APM を OAuth クライアント／リソースサーバーとしてのみ使用し（認可サーバープロファイルを設定しない）場合は影響を受けません。影響は認証されていない攻撃者がリモートでコードを実行できる点にあり、Appliance モードでも同様に脆弱です。この問題はデータプレーンに限られ、コントロールプレーンへの影響はありません。技術サポートが終了したバージョンは評価対象外です。", "risk": "認証されていない攻撃者がリモートでコードを実行できるため、システムが任意の操作をされる可能性があります。Appliance モードでも同様に脆弱です。", "product": "BIG-IP", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "f5", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "BIG-IP", "range": ">= 21.1.0 / < Hotfix-BIGIP-21.1.0.2.0.30.22-ENG（機能: APM）" }, { "product": "BIG-IP", "range": ">= 17.5.0 / < Hotfix-BIGIP-17.5.1.9.0.160.12-ENG（機能: APM）" }, { "product": "BIG-IP", "range": ">= 17.1.0 / < Hotfix-BIGIP-17.1.3.5.0.41.14-ENG（機能: APM）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94127", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000162605", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94127", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-22T14:17:42.730Z", "modifiedAt": "2026-09-23T03:55:44.614Z", "fetchedAt": "2026-10-23T02:43:53.020Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "sourceTitle": "BIG-IP APM OAuth vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "F5", "product": "BIG-IP", "modules": [ "APM" ], "versions": [ { "status": "affected", "version": "21.1.0", "lessThan": "Hotfix-BIGIP-21.1.0.2.0.30.22-ENG", "versionType": "custom" }, { "status": "affected", "version": "17.5.0", "lessThan": "Hotfix-BIGIP-17.5.1.9.0.160.12-ENG", "versionType": "custom" }, { "status": "affected", "version": "17.1.0", "lessThan": "Hotfix-BIGIP-17.1.3.5.0.41.14-ENG", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "configurationNotes": "対象環境・機能: APM。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-94127", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "fetchedAt": "2026-10-23T02:43:53.020Z", "publishedAt": "2026-09-22T14:17:42.730Z", "modifiedAt": "2026-09-23T03:55:44.614Z", "state": "published", "provider": "f5", "title": "BIG-IP APM OAuth vulnerability", "descriptions": [ { "lang": "en", "value": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "F5", "product": "BIG-IP", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [ "APM" ], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "21.1.0", "lessThan": "Hotfix-BIGIP-21.1.0.2.0.30.22-ENG", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "17.5.0", "lessThan": "Hotfix-BIGIP-17.5.1.9.0.160.12-ENG", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "17.1.0", "lessThan": "Hotfix-BIGIP-17.1.3.5.0.41.14-ENG", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [ { "lang": "en", "value": "An iRule is available upon request.\nOpen a ticket with F5 support to request this.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "f5", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "f5", "sourcePath": "/containers/cna/metrics/1/cvssV4_0" } ], "references": [ { "url": "https://my.f5.com/manage/s/article/K000162605", "label": "f5", "tags": [ "vendor-advisory" ], "provider": "f5", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-94127", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"F5\",\"product\":\"BIG-IP\",\"modules\":[\"APM\"],\"versions\":[{\"status\":\"affected\",\"version\":\"21.1.0\",\"lessThan\":\"Hotfix-BIGIP-21.1.0.2.0.30.22-ENG\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"17.5.0\",\"lessThan\":\"Hotfix-BIGIP-17.5.1.9.0.160.12-ENG\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"17.1.0\",\"lessThan\":\"Hotfix-BIGIP-17.1.3.5.0.41.14-ENG\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "An iRule is available upon request.\nOpen a ticket with F5 support to request this.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"CWE-122 Heap-based Buffer Overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-23T03:55:44.614Z", "fetchedAt": "2026-10-23T02:43:53.020Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "BIG-IPにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:43.574Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "eba21ab99c7afba518e97048b0f0d45838df8117b692916ba4e778678e39f6a7", "sourceModifiedAt": "2026-09-23T03:55:44.614Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "BIG‑IP APM のアクセスポリシーと OAuth プロファイルが仮想サーバー上で設定されている場合、特定の悪意あるトラフィックによりサーバー上で攻撃者のコードが実行されるリモートコード実行（RCE）の脆弱性が発生します。この脆弱性は、BIG‑IP APM が OAuth 認可サーバーとして構成されているときにのみ存在します。APM を OAuth クライアント／リソースサーバーとしてのみ使用し（認可サーバープロファイルを設定しない）場合は影響を受けません。影響は認証されていない攻撃者がリモートでコードを実行できる点にあり、Appliance モードでも同様に脆弱です。この問題はデータプレーンに限られ、コントロールプレーンへの影響はありません。技術サポートが終了したバージョンは評価対象外です。", "risk": "認証されていない攻撃者がリモートでコードを実行できるため、システムが任意の操作をされる可能性があります。Appliance モードでも同様に脆弱です。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：F5 / BIG-IP。影響ありとして記載：21.1.0以上、Hotfix-BIGIP-21.1.0.2.0.30.22-ENG未満。影響ありとして記載：17.5.0以上、Hotfix-BIGIP-17.5.1.9.0.160.12-ENG未満。影響ありとして記載：17.1.0以上、Hotfix-BIGIP-17.1.3.5.0.41.14-ENG未満。対象の機能：APM。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json" ], "evidenceIds": [ "E3" ] }, { "text": "「BIG-IP」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-94127", "https://my.f5.com/manage/s/article/K000162605", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-94127" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "F5 サポートにチケットを開き、iRule の提供を依頼してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json" ], "evidenceIds": [ "E4" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-94127", "https://my.f5.com/manage/s/article/K000162605", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-94127" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "label": "CVE：f5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94127", "label": "CVE公式レコード" }, { "url": "https://my.f5.com/manage/s/article/K000162605", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94127", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability.\n\nImpact:\nThis vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourceField": "/containers/cna/title", "excerpt": "BIG-IP APM OAuth vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"F5\",\"product\":\"BIG-IP\",\"modules\":[\"APM\"],\"versions\":[{\"status\":\"affected\",\"version\":\"21.1.0\",\"lessThan\":\"Hotfix-BIGIP-21.1.0.2.0.30.22-ENG\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"17.5.0\",\"lessThan\":\"Hotfix-BIGIP-17.5.1.9.0.160.12-ENG\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"17.1.0\",\"lessThan\":\"Hotfix-BIGIP-17.1.3.5.0.41.14-ENG\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/94xxx/CVE-2026-94127.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "An iRule is available upon request.\nOpen a ticket with F5 support to request this.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-94127", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-94127\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-94127（BIG-IP）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：F5 / BIG-IP。影響ありとして記載：21.1.0以上、Hotfix-BIGIP-21.1.0.2.0.30.22-ENG未満。影響ありとして記載：17.5.0以上、Hotfix-BIGIP-17.5.1.9.0.160.12-ENG未満。影響ありとして記載：17.1.0以上、Hotfix-BIGIP-17.1.3.5.0.41.14-ENG未満。対象の機能：APM。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-94127", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:43.574Z", "lastSuccess": "2026-10-23T03:21:43.574Z", "sourceCheckedAt": "2026-10-23T02:43:53.020Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-7273", "aliases": [], "title": "GS1900-48HPv2 firmware / GS1900-8 firmware / GS1900-8HP firmware / GS1900-10HP firmware / GS1900-16 firmware / GS1900-24 firmware / GS1900-24E firmware / GS1900-24EP firmware / GS1900-24HPv2 firmware / GS1900-48 firmware：脆弱性情報", "summary": "Zyxel の GS1900-48HPv2 ファームウェア（バージョン 2.90(ABTQ.1)C0 まで）に含まれる CGI プログラムにスタックベースのバッファオーバーフローの脆弱性があります。この脆弱性により、LAN 内にいる認証されていない攻撃者が細工した HTTP リクエストを送ることで、OS コマンドを実行させられる可能性があります。", "risk": "攻撃者が OS コマンドを実行できる可能性がある。", "product": "GS1900-48HPv2 firmware / GS1900-8 firmware / GS1900-8HP firmware / GS1900-10HP firmware / GS1900-16 firmware / GS1900-24 firmware / GS1900-24E firmware / GS1900-24EP firmware / GS1900-24HPv2 firmware / GS1900-48 firmware", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "Zyxel", "cvssVector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "GS1900-48HPv2 firmware", "range": "<= 2.90(ABTQ.1)C0" }, { "product": "GS1900-8 firmware", "range": "<= 2.90(AAHH.1)C0" }, { "product": "GS1900-8HP firmware", "range": "<= 2.90(AAHI.1)C0" }, { "product": "GS1900-10HP firmware", "range": "<= 2.90(AAZI.1)C0" }, { "product": "GS1900-16 firmware", "range": "<= 2.90(AAHJ.1)C0" }, { "product": "GS1900-24 firmware", "range": "<= 2.90(AAHL.1)C0" }, { "product": "GS1900-24E firmware", "range": "<= 2.90(AAHK.1)C0" }, { "product": "GS1900-24EP firmware", "range": "<= 2.90(ABTO.1)C0" }, { "product": "GS1900-24HPv2 firmware", "range": "<= 2.90(ABTP.1)C0" }, { "product": "GS1900-48 firmware", "range": "<= 2.90(AAHN.1)C0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7273", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7273", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-06-16T02:20:29.847Z", "modifiedAt": "2026-09-22T03:55:39.207Z", "fetchedAt": "2026-10-23T02:43:50.428Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Zyxel", "product": "GS1900-48HPv2 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(ABTQ.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-8 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHH.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-8HP firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHI.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-10HP firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAZI.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-16 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHJ.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-24 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHL.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-24E firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHK.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-24EP firmware", "versions": [ { "status": "affected", "version": "<= 2.90(ABTO.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-24HPv2 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(ABTP.1)C0" } ], "defaultStatus": "unaffected" }, { "vendor": "Zyxel", "product": "GS1900-48 firmware", "versions": [ { "status": "affected", "version": "<= 2.90(AAHN.1)C0" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7273", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "fetchedAt": "2026-10-23T02:43:50.428Z", "publishedAt": "2026-06-16T02:20:29.847Z", "modifiedAt": "2026-09-22T03:55:39.207Z", "state": "published", "provider": "Zyxel", "title": "", "descriptions": [ { "lang": "en", "value": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Zyxel", "product": "GS1900-48HPv2 firmware", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "<= 2.90(ABTQ.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-8 firmware", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "<= 2.90(AAHH.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-8HP firmware", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "<= 2.90(AAHI.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-10HP firmware", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "<= 2.90(AAZI.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-16 firmware", "sourcePath": "/containers/cna/affected/4", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "<= 2.90(AAHJ.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-24 firmware", "sourcePath": "/containers/cna/affected/5", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "<= 2.90(AAHL.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-24E firmware", "sourcePath": "/containers/cna/affected/6", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "<= 2.90(AAHK.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-24EP firmware", "sourcePath": "/containers/cna/affected/7", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "<= 2.90(ABTO.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-24HPv2 firmware", "sourcePath": "/containers/cna/affected/8", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "<= 2.90(ABTP.1)C0", "status": "affected" } ] }, { "vendor": "Zyxel", "product": "GS1900-48 firmware", "sourcePath": "/containers/cna/affected/9", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "<= 2.90(AAHN.1)C0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based buffer overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "Zyxel", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "label": "Zyxel", "tags": [ "vendor-advisory" ], "provider": "Zyxel", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7273", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-48HPv2 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTQ.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-8 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHH.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-8HP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHI.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-10HP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAZI.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-16 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHJ.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHL.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24E firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHK.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24EP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTO.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24HPv2 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTP.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-48 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHN.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-121\",\"description\":\"CWE-121 Stack-based buffer overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-22T03:55:39.207Z", "fetchedAt": "2026-10-23T02:43:50.428Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "GS1900-48HPv2 firmware / GS1900-8 firmware / GS1900-8HP firmware / GS1900-10HP firmware / GS1900-16 firmware / GS1900-24 firmware / GS1900-24E firmware / GS1900-24EP firmware / GS1900-24HPv2 firmware / GS1900-48 firmwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:44.559Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ca8ba2d740dea280112cadeb227f46e5f1efab4169480dc50fd16ed2098fd31b", "sourceModifiedAt": "2026-09-22T03:55:39.207Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zyxel の GS1900-48HPv2 ファームウェア（バージョン 2.90(ABTQ.1)C0 まで）に含まれる CGI プログラムにスタックベースのバッファオーバーフローの脆弱性があります。この脆弱性により、LAN 内にいる認証されていない攻撃者が細工した HTTP リクエストを送ることで、OS コマンドを実行させられる可能性があります。", "risk": "攻撃者が OS コマンドを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Zyxel の GS1900-48HPv2 ファームウェアはバージョン 2.90(ABTQ.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E2" ] }, { "text": "Zyxel の GS1900-8 ファームウェアはバージョン 2.90(AAHH.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E3" ] }, { "text": "Zyxel の GS1900-8HP ファームウェアはバージョン 2.90(AAHI.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E4" ] }, { "text": "Zyxel の GS1900-10HP ファームウェアはバージョン 2.90(AAZI.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E5" ] }, { "text": "Zyxel の GS1900-16 ファームウェアはバージョン 2.90(AAHJ.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E6" ] }, { "text": "Zyxel の GS1900-24 ファームウェアはバージョン 2.90(AAHL.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E7" ] }, { "text": "Zyxel の GS1900-24E ファームウェアはバージョン 2.90(AAHK.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E8" ] }, { "text": "Zyxel の GS1900-24EP ファームウェアはバージョン 2.90(ABTO.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E9" ] }, { "text": "Zyxel の GS1900-24HPv2 ファームウェアはバージョン 2.90(ABTP.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E10" ] }, { "text": "Zyxel の GS1900-48 ファームウェアはバージョン 2.90(AAHN.1)C0 以下が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Zyxel / GS1900-48HPv2 firmware。影響ありとして記載：<= 2.90(ABTQ.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Zyxel / GS1900-8 firmware。影響ありとして記載：<= 2.90(AAHH.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Zyxel / GS1900-8HP firmware。影響ありとして記載：<= 2.90(AAHI.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Zyxel / GS1900-10HP firmware。影響ありとして記載：<= 2.90(AAZI.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Zyxel / GS1900-16 firmware。影響ありとして記載：<= 2.90(AAHJ.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Zyxel / GS1900-24 firmware。影響ありとして記載：<= 2.90(AAHL.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Zyxel / GS1900-24E firmware。影響ありとして記載：<= 2.90(AAHK.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Zyxel / GS1900-24EP firmware。影響ありとして記載：<= 2.90(ABTO.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Zyxel / GS1900-24HPv2 firmware。影響ありとして記載：<= 2.90(ABTP.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Zyxel / GS1900-48 firmware。影響ありとして記載：<= 2.90(AAHN.1)C0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E11" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273" ], "evidenceIds": [ "E12" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E2" ] }, { "text": "「GS1900-48HPv2 firmware / GS1900-8 firmware / GS1900-8HP firmware / GS1900-10HP firmware / GS1900-16 firmware / GS1900-24 firmware / GS1900-24E firmware / GS1900-24EP firmware / GS1900-24HPv2 firmware / GS1900-48 firmware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-7273", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-7273" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7273", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-7273" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-7273", "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-7273" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "label": "CVE：Zyxel" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7273", "label": "CVE公式レコード" }, { "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-stack-based-buffer-overflow-vulnerability-in-gs1900-series-switches-06-16-2026", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7273", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-48HPv2 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTQ.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-8 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHH.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-8HP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHI.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-10HP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAZI.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-16 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHJ.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHL.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24E firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHK.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24EP firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTO.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-24HPv2 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(ABTP.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7273.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Zyxel\",\"product\":\"GS1900-48 firmware\",\"versions\":[{\"status\":\"affected\",\"version\":\"<= 2.90(AAHN.1)C0\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7273", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-7273\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-7273（GS1900-48HPv2 firmware / GS1900-8 firmware / GS1900-8HP firmware / GS1900-10HP firmware / GS1900-16 firmware / GS1900-24 firmware / GS1900-24E firmware / GS1900-24EP firmware / GS1900-24HPv2 firmware / GS1900-48 firmware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Zyxel の GS1900-48HPv2 ファームウェアはバージョン 2.90(ABTQ.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-8 ファームウェアはバージョン 2.90(AAHH.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-8HP ファームウェアはバージョン 2.90(AAHI.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-10HP ファームウェアはバージョン 2.90(AAZI.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-16 ファームウェアはバージョン 2.90(AAHJ.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-24 ファームウェアはバージョン 2.90(AAHL.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-24E ファームウェアはバージョン 2.90(AAHK.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-24EP ファームウェアはバージョン 2.90(ABTO.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-24HPv2 ファームウェアはバージョン 2.90(ABTP.1)C0 以下が影響を受ける。\n・Zyxel の GS1900-48 ファームウェアはバージョン 2.90(AAHN.1)C0 以下が影響を受ける。\n・公式の対象表：Zyxel / GS1900-48HPv2 firmware。影響ありとして記載：<= 2.90(ABTQ.1)C0。\n・公式の対象表：Zyxel / GS1900-8 firmware。影響ありとして記載：<= 2.90(AAHH.1)C0。\n・公式の対象表：Zyxel / GS1900-8HP firmware。影響ありとして記載：<= 2.90(AAHI.1)C0。\n・公式の対象表：Zyxel / GS1900-10HP firmware。影響ありとして記載：<= 2.90(AAZI.1)C0。\n・公式の対象表：Zyxel / GS1900-16 firmware。影響ありとして記載：<= 2.90(AAHJ.1)C0。\n・公式の対象表：Zyxel / GS1900-24 firmware。影響ありとして記載：<= 2.90(AAHL.1)C0。\n・公式の対象表：Zyxel / GS1900-24E firmware。影響ありとして記載：<= 2.90(AAHK.1)C0。\n・公式の対象表：Zyxel / GS1900-24EP firmware。影響ありとして記載：<= 2.90(ABTO.1)C0。\n・公式の対象表：Zyxel / GS1900-24HPv2 firmware。影響ありとして記載：<= 2.90(ABTP.1)C0。\n・公式の対象表：Zyxel / GS1900-48 firmware。影響ありとして記載：<= 2.90(AAHN.1)C0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7273", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:44.559Z", "lastSuccess": "2026-10-23T03:21:44.559Z", "sourceCheckedAt": "2026-10-23T02:43:50.428Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-39682", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの TLS 実装で、recvmsg() が処理するレコードは、連続した DATA レコードだけ、または 1 つの非 DATA レコードだけである必要があります。次のレコードのタイプが既に処理したものと異なる場合はメインループを抜け、TLS 1.3 のように復号後にタイプが判明した場合は保留中のレコードを rx_list にキューイングします。ゼロコピー復号後に skb が無いため rx_list へキューイングできず、データレコードのみがゼロコピー可能で、非データレコードの後でループを抜けます。見落としていたのは、最初のレコードが rx_list から来て長さが 0 の場合です。", "risk": "この脆弱性の説明には、影響や被害についての記述がありません。", "product": "Linux", "category": "linux", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "Linux", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Linux", "range": ">= 84c61fe1a75b4255df1e1e7c054c9e6d048da417 / < 2902c3ebcca52ca845c03182000e8d71d3a5196f" }, { "product": "Linux", "range": ">= 84c61fe1a75b4255df1e1e7c054c9e6d048da417 / < c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677" }, { "product": "Linux", "range": ">= 84c61fe1a75b4255df1e1e7c054c9e6d048da417 / < 3439c15ae91a517cf3c650ea15a8987699416ad9" }, { "product": "Linux", "range": ">= 84c61fe1a75b4255df1e1e7c054c9e6d048da417 / < 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e" }, { "product": "Linux", "range": ">= 84c61fe1a75b4255df1e1e7c054c9e6d048da417 / < 62708b9452f8eb77513115b17c4f8d1a22ebf843" }, { "product": "Linux", "range": "6.0" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-39682", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-09-05T17:20:48.657Z", "modifiedAt": "2026-10-07T17:56:14.826Z", "fetchedAt": "2026-10-23T02:43:38.138Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.", "sourceTitle": "tls: fix handling of zero-length records on the rx_list", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tls/tls_sw.c" ], "versions": [ { "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "2902c3ebcca52ca845c03182000e8d71d3a5196f", "status": "affected", "versionType": "git" }, { "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677", "status": "affected", "versionType": "git" }, { "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "3439c15ae91a517cf3c650ea15a8987699416ad9", "status": "affected", "versionType": "git" }, { "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e", "status": "affected", "versionType": "git" }, { "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "62708b9452f8eb77513115b17c4f8d1a22ebf843", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/tls/tls_sw.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-39682", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "fetchedAt": "2026-10-23T02:43:38.138Z", "publishedAt": "2025-09-05T17:20:48.657Z", "modifiedAt": "2026-10-07T17:56:14.826Z", "state": "published", "provider": "Linux", "title": "tls: fix handling of zero-length records on the rx_list", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "net/tls/tls_sw.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "2902c3ebcca52ca845c03182000e8d71d3a5196f", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "3439c15ae91a517cf3c650ea15a8987699416ad9", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417", "lessThan": "62708b9452f8eb77513115b17c4f8d1a22ebf843", "versionType": "git", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "net/tls/tls_sw.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "6.0", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "6.1.149", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "6.6.103", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "6.12.44", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.16.4", "lessThanOrEqual": "6.16.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "6.17", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "Linux", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/2/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"versions\":[{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"2902c3ebcca52ca845c03182000e8d71d3a5196f\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"3439c15ae91a517cf3c650ea15a8987699416ad9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"62708b9452f8eb77513115b17c4f8d1a22ebf843\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.149\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.44\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "sourcePath": "body:advisory", "text": "SSA-032379\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.0\n\nPublication Date:\n\n2026-05-12\n\nLast Update:\n\n2026-05-12\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n9.6\n\nCVSS v4.0 Base Score:\n8.8\n\nSUMMARY\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality.\n\nSiemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC CN 4100\n\nAll versions < V5.0\n\naffected by\n\nall CVEs\n\nCVE-2026-22924\n\nCVE-2026-22925\n\nCVE-2025-9820\n\nCVE-2025-14831\n\nCVE-2025-8916\n\nCVE-2025-55752\n\nCVE-2025-55754\n\nCVE-2025-61795\n\nCVE-2025-48989\n\nCVE-2025-43368\n\nCVE-2025-47219\n\nCVE-2025-6021\n\nCVE-2025-6052\n\nCVE-2025-7425\n\nCVE-2026-21925\n\nCVE-2026-21932\n\nCVE-2026-21933\n\nCVE-2026-21945\n\nCVE-2026-21947\n\nCVE-2025-31257\n\nCVE-2025-53057\n\nCVE-2025-53066\n\nCVE-2025-61748\n\nCVE-2024-47704\n\nCVE-2024-57924\n\nCVE-2024-58240\n\nCVE-2025-23143\n\nCVE-2025-23160\n\nCVE-2025-37931\n\nCVE-2025-37968\n\nCVE-2025-38322\n\nCVE-2025-38347\n\nCVE-2025-38491\n\nCVE-2025-38502\n\nCVE-2025-38552\n\nCVE-2025-38614\n\nCVE-2025-38670\n\nCVE-2025-38676\n\nCVE-2025-38677\n\nCVE-2025-38679\n\nCVE-2025-38680\n\nCVE-2025-38681\n\nCVE-2025-38683\n\nCVE-2025-38684\n\nCVE-2025-38685\n\nCVE-2025-38687\n\nCVE-2025-38691\n\nCVE-2025-38693\n\nCVE-2025-38694\n\nCVE-2025-38695\n\nCVE-2025-38696\n\nCVE-2025-38697\n\nCVE-2025-38698\n\nCVE-2025-38699\n\nCVE-2025-38700\n\nCVE-2025-38701\n\nCVE-2025-38702\n\nCVE-2025-38706\n\nCVE-2025-38707\n\nCVE-2025-38708\n\nCVE-2025-38711\n\nCVE-2025-38712\n\nCVE-2025-38713\n\nCVE-2025-38714\n\nCVE-2025-38715\n\nCVE-2025-38721\n\nCVE-2025-38723\n\nCVE-2025-38724\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38728\n\nCVE-2025-38729\n\nCVE-2025-38732\n\nCVE-2025-38735\n\nCVE-2025-38736\n\nCVE-2025-39673\n\nCVE-2025-39675\n\nCVE-2025-39676\n\nCVE-2025-39681\n\nCVE-2025-39682\n\nCVE-2025-39683\n\nCVE-2025-39684\n\nCVE-2025-39685\n\nCVE-2025-39686\n\nCVE-2025-39687\n\nCVE-2025-39689\n\nCVE-2025-39691\n\nCVE-2025-39692\n\nCVE-2025-39693\n\nCVE-2025-39694\n\nCVE-2025-39697\n\nCVE-2025-39701\n\nCVE-2025-39702\n\nCVE-2025-39703\n\nCVE-2025-39706\n\nCVE-2025-39709\n\nCVE-2025-39710\n\nCVE-2025-39713\n\nCVE-2025-39714\n\nCVE-2025-39715\n\nCVE-2025-39716\n\nCVE-2025-39718\n\nCVE-2025-39719\n\nCVE-2025-39724\n\nCVE-2025-39736\n\nCVE-2025-39737\n\nCVE-2025-39738\n\nCVE-2025-39742\n\nCVE-2025-39743\n\nCVE-2025-39749\n\nCVE-2025-39752\n\nCVE-2025-39756\n\nCVE-2025-39757\n\nCVE-2025-39759\n\nCVE-2025-39760\n\nCVE-2025-39766\n\nCVE-2025-39770\n\nCVE-2025-39772\n\nCVE-2025-39773\n\nCVE-2025-39776\n\nCVE-2025-39782\n\nCVE-2025-39783\n\nCVE-2025-39787\n\nCVE-2025-39788\n\nCVE-2025-39790\n\nCVE-2025-39794\n\nCVE-2025-39795\n\nCVE-2025-39798\n\nCVE-2025-39800\n\nCVE-2025-39801\n\nCVE-2025-39806\n\nCVE-2025-39808\n\nCVE-2025-39812\n\nCVE-2025-39813\n\nCVE-2025-39817\n\nCVE-2025-39819\n\nCVE-2025-39823\n\nCVE-2025-39824\n\nCVE-2025-39825\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39828\n\nCVE-2025-39835\n\nCVE-2025-39838\n\nCVE-2025-39839\n\nCVE-2025-39841\n\nCVE-2025-39842\n\nCVE-2025-39843\n\nCVE-2025-39844\n\nCVE-2025-39845\n\nCVE-2025-39846\n\nCVE-2025-39847\n\nCVE-2025-39848\n\nCVE-2025-39849\n\nCVE-2025-39853\n\nCVE-2025-39857\n\nCVE-2025-39860\n\nCVE-2025-39864\n\nCVE-2025-39865\n\nCVE-2025-39866\n\nCVE-2025-40300\n\nCVE-2025-9230\n\nCVE-2025-9231\n\nCVE-2025-9232\n\nCVE-2026-2673\n\nCVE-2026-28387\n\nCVE-2026-28388\n\nCVE-2026-28389\n\nCVE-2026-28390\n\nCVE-2026-31789\n\nCVE-2026-31790\n\nUpdate to V5.0 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n\nMITIGATIONS\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nThe SIMATIC CN 4100 is a communication node that allows connecting third-party systems helping to implement system concepts for process control technology.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-47704\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check link_res->hpo_dp_link_enc before using it\n\n[WHAT & HOW]\nFunctions dp_enable_link_phy and dp_disable_link_phy can pass link_res\nwithout initializing hpo_dp_link_enc and it is necessary to check for\nnull before dereferencing.\n\nThis fixes 2 FORWARD_NULL issues reported by Coverity.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-57924\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs: relax assertions on failure to encode file handles\n\nEncoding file handles is usually performed by a filesystem >encode_fh()\nmethod that may fail for various reasons.\n\nThe legacy users of exportfs_encode_fh(), namely, nfsd and\nname_to_handle_at(2) syscall are ready to cope with the possibility\nof failure to encode a file handle.\n\nThere are a few other users of exportfs_encode_{fh,fid}() that\ncurrently have a WARN_ON() assertion when ->encode_fh() fails.\nRelax those assertions because they are wrong.\n\nThe second linked bug report states commit 16aac5ad1fa9 (\"ovl: support\nencoding non-decodable file handles\") in v6.6 as the regressing commit,\nbut this is not accurate.\n\nThe aforementioned commit only increases the chances of the assertion\nand allows triggering the assertion with the reproducer using overlayfs,\ninotify and drop_caches.\n\nTriggering this assertion was always possible with other filesystems and\nother reasons of ->encode_fh() failures and more particularly, it was\nalso possible with the exact same reproducer using overlayfs that is\nmounted with options index=on,nfs_export=on also on kernels < v6.6.\nTherefore, I am not listing the aforementioned commit as a Fixes commit.\n\nBackport hint: this patch will have a trivial conflict applying to\nv6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-617: Reachable Assertion\n\nVulnerability CVE-2024-58240\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntls: separate no-async decryption request handling from async\n\nIf we're not doing async, the handling is much simpler. There's no\nreference counting, we just need to wait for the completion to wake us\nup and return its result.\n\nWe should preferably also use a separate crypto_wait. I'm not seeing a\nUAF as I did in the past, I think aec7961916f3 (\"tls: fix race between\nasync notify and socket close\") took care of it.\n\nThis will make the next fix easier.\n\nCVSS v3.1 Base Score\n7.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2025-6021\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2025-6052\n\nA flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nCVSS v3.1 Base Score\n3.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-190: Integer Overflow or Wraparound\n\nVulnerability CVE-2025-7425\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2025-8916\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java.\n\nThis issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCVSS v4.0 Base Score\n6.3\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\n\nCWE\nCWE-770: Allocation of Resources Without Limits or Throttling\n\nVulnerability CVE-2025-9230\n\nIssue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCVSS v4.0 Base Score\n7.7\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2025-9231\n\nIssue summary: A timing side-channel which could potentially allow remote\nrecovery of the private key exists in the SM2 algorithm implementation on 64 bit\nARM platforms.\n\nImpact summary: A timing side-channel in SM2 signature computations on 64 bit\nARM platforms could allow recovering the private key by an attacker..\n\nWhile remote key recovery over a network was not attempted by the reporter,\ntiming measurements revealed a timing signal which may allow such an attack.\n\nOpenSSL does not directly support certificates with SM2 keys in TLS, and so\nthis CVE is not relevant in most TLS contexts. However, given that it is\npossible to add support for such certificates via a custom provider, coupled\nwith the fact that in such a custom provider context the private key may be\nrecoverable via remote timing measurements, we consider this to be a Moderate\nseverity issue.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as SM2 is not an approved algorithm.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\nCWE\nCWE-385: Covert Timing Channel\n\nVulnerability CVE-2025-9232\n\nIssue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.\n\nCVSS v3.1 Base Score\n5.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2025-9820\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nCVSS v3.1 Base Score\n4.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-14831\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-407: Inefficient Algorithmic Complexity\n\nVulnerability CVE-2025-23143\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.\n\nWhen I ran the repro 0 and waited a few seconds, I observed two\nLOCKDEP splats: a warning immediately followed by a null-ptr-deref. 1\n\nReproduction Steps:\n\n1) Mount CIFS\n2) Add an iptables rule to drop incoming FIN packets for CIFS\n3) Unmount CIFS\n4) Unload the CIFS module\n5) Remove the iptables rule\n\nAt step 3), the CIFS module calls sock_release() for the underlying\nTCP socket, and it returns quickly. However, the socket remains in\nFIN_WAIT_1 because incoming FIN packets are dropped.\n\nAt this point, the module's refcnt is 0 while the socket is still\nalive, so the following rmmod command succeeds.\n\n# ss -tan\nState Recv-Q Send-Q Local Address:Port Peer Address:Port\nFIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445\n\n# lsmod | grep cifs\ncifs 1159168 0\n\nThis highlights a discrepancy between the lifetime of the CIFS module\nand the underlying TCP socket. Even after CIFS calls sock_release()\nand it returns, the TCP socket does not die immediately in order to\nclose the connection gracefully.\n\nWhile this is generally fine, it causes an issue with LOCKDEP because\nCIFS assigns a different lock class to the TCP socket's sk->sk_lock\nusing sock_lock_init_class_and_name().\n\nOnce an incoming packet is processed for the socket or a timer fires,\nsk->sk_lock is acquired.\n\nThen, LOCKDEP checks the lock context in check_wait_context(), where\nhlock_class() is called to retrieve the lock class. However, since\nthe module has already been unloaded, hlock_class() logs a warning\nand returns NULL, triggering the null-ptr-deref.\n\nIf LOCKDEP is enabled, we must ensure that a module calling\nsock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded\nwhile such a socket is still alive to prevent this issue.\n\nLet's hold the module reference in sock_lock_init_class_and_name()\nand release it when the socket is freed in sk_prot_free().\n\nNote that sock_lock_init() clears sk->sk_owner for svc_create_socket()\nthat calls sock_lock_init_class_and_name() for a listening socket,\nwhich clones a socket by sk_clone_lock() without GFP_ZERO.\n\nCIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\"\nDEV=\"enp0s3\"\nCRED=\"/root/WindowsCredential.txt\"\n\nMNT=$(mktemp -d /tmp/XXXXXX)\nmount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1\n\niptables -A INPUT -s ${CIFS_SERVER} -j DROP\n\nfor i in $(seq 10);\ndo\numount ${MNT}\nrmmod cifs\nsleep 1\ndone\n\nrm -r ${MNT}\n\niptables -D INPUT -s ${CIFS_SERVER} -j DROP\n\nWARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\nModules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs]\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223)\n...\nCall Trace:\n\n__lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178)\nlock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816)\n_raw_spin_lock_nested (kernel/locking/spinlock.c:379)\ntcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350)\n...\n\nBUG: kernel NULL pointer dereference, address: 00000000000000c4\nPF: supervisor read access in kernel mode\nPF: error_code(0x0000) - not-present page\nPGD 0\nOops: Oops: 0000 [#1] PREEMPT SMP NOPTI\nCPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36\nTainted: [W]=WARN\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nRIP: 0010:__lock_acquire (kernel/\n---truncated---\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2025-23160\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization\n\nOn Mediatek devices with a system companion processor (SCP) the mtk_scp\nstructure has to be removed explicitly to avoid a resource leak.\nFree the structure in case the allocation of the firmware structure fails\nduring the firmware initialization.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-401: Missing Release of Memory after Effective Lifetime\n\nVulnerability CVE-2025-31257\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\nCWE\nCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer\n\nVulnerability CVE-2025-37931\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: adjust subpage bit start based on sectorsize\n\nWhen running machines with 64k page size and a 16k nodesize we started\nseeing tree log corruption in production. This turned out to be because\nwe were not writing out dirty blocks sometimes, so this in fact affects\nall metadata writes.\n\nWhen writing out a subpage EB we scan the subpage bitmap for a dirty\nrange. If the range isn't dirty we do\n\nbit_start++;\n\nto move onto the next bit. The problem is the bitmap is based on the\nnumber of sectors that an EB has. So in this case, we have a 64k\npagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4\nbits for every node. With a 64k page size we end up with 4 nodes per\npage.\n\nTo make this easier this is how everything looks\n\n[0 16k 32k 48k ] logical address\n[0 4 8 12 ] radix tree offset\n[ 64k page ] folio\n[ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers\n[ | | | | | | | | | | | | | | | | ] bitmap\n\nNow we use all of our addressing based on fs_info->sectorsize_bits, so\nas you can see the above our 16k eb->start turns into radix entry 4.\n\nWhen we find a dirty range for our eb, we correctly do bit_start +=\nsectors_per_node, because if we start at bit 0, the next bit for the\nnext eb is 4, to correspond to eb->start 16k.\n\nHowever if our range is clean, we will do bit_start++, which will now\nput us offset from our radix tree entries.\n\nIn our case, assume that the first time we check the bitmap the block is\nnot dirty, we increment bit_start so now it == 1, and then we loop\naround and check again. This time it is dirty, and we go to find that\nstart using the following equation\n\nstart = folio_start + bit_start * fs_info->sectorsize;\n\nso in the case above, eb->start 0 is now dirty, and we calculate start\nas\n\n0 + 1 * fs_info->sectorsize = 4096\n4096 >> 12 = 1\n\nNow we're looking up the radix tree for 1, and we won't find an eb.\nWhat's worse is now we're using bit_start == 1, so we do bit_start +=\nsectors_per_node, which is now 5. If that eb is dirty we will run into\nthe same thing, we will look at an offset that is not populated in the\nradix tree, and now we're skipping the writeout of dirty extent buffers.\n\nThe best fix for this is to not use sectorsize_bits to address nodes,\nbut that's a larger change. Since this is a fs corruption problem fix\nit simply by always using sectors_per_node to increment the start bit.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2025-37968\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niio: light: opt3001: fix deadlock due to concurrent flag access\n\nThe threaded IRQ function in this driver is reading the flag twice: once to\nlock a mutex and once to unlock it. Even though the code setting the flag\nis designed to prevent it, there are subtle cases where the flag could be\ntrue at the mutex_lock stage and false at the mutex_unlock stage. This\nresults in the mutex not being unlocked, resulting in a deadlock.\n\nFix it by making the opt3001_irq() code generally more robust, reading the\nflag into a variable and using the variable value at both stages.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-667: Improper Locking\n\nVulnerability CVE-2025-38322\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Fix crash in icl_update_topdown_event()\n\nThe perf_fuzzer found a hard-lockup crash on a RaptorLake machine:\n\nOops: general protection fault, maybe for address 0xffff89aeceab400: 0000\nCPU: 23 UID: 0 PID: 0 Comm: swapper/23\nTainted: [W]=WARN\nHardware name: Dell Inc. Precision 9660/0VJ762\nRIP: 0010:native_read_pmc+0x7/0x40\nCode: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...\nRSP: 000:fffb03100273de8 EFLAGS: 00010046\n....\nCall Trace:\n\nicl_update_topdown_event+0x165/0x190\n? ktime_get+0x38/0xd0\nintel_pmu_read_event+0xf9/0x210\n__perf_event_read+0xf9/0x210\n\nCPUs 16-23 are E-core CPUs that don't support the perf metrics feature", "truncated": true, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-39682", "relatedCves": [ "CVE-2026-22924", "CVE-2026-22925", "CVE-2025-9820", "CVE-2025-14831", "CVE-2025-8916", "CVE-2025-55752", "CVE-2025-55754", "CVE-2025-61795", "CVE-2025-48989", "CVE-2025-43368", "CVE-2025-47219", "CVE-2025-6021", "CVE-2025-6052", "CVE-2025-7425", "CVE-2026-21925", "CVE-2026-21932", "CVE-2026-21933", "CVE-2026-21945", "CVE-2026-21947", "CVE-2025-31257", "CVE-2025-53057", "CVE-2025-53066", "CVE-2025-61748", "CVE-2024-47704", "CVE-2024-57924", "CVE-2024-58240", "CVE-2025-23143", "CVE-2025-23160", "CVE-2025-37931", "CVE-2025-37968", "CVE-2025-38322", "CVE-2025-38347", "CVE-2025-38491", "CVE-2025-38502", "CVE-2025-38552", "CVE-2025-38614", "CVE-2025-38670", "CVE-2025-38676", "CVE-2025-38677", "CVE-2025-38679", "CVE-2025-38680", "CVE-2025-38681", "CVE-2025-38683", "CVE-2025-38684", "CVE-2025-38685", "CVE-2025-38687", "CVE-2025-38691", "CVE-2025-38693", "CVE-2025-38694", "CVE-2025-38695", "CVE-2025-38696", "CVE-2025-38697", "CVE-2025-38698", "CVE-2025-38699", "CVE-2025-38700", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38706", "CVE-2025-38707", "CVE-2025-38708", "CVE-2025-38711", "CVE-2025-38712", "CVE-2025-38713", "CVE-2025-38714", "CVE-2025-38715", "CVE-2025-38721", "CVE-2025-38723", "CVE-2025-38724", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38728", "CVE-2025-38729", "CVE-2025-38732", "CVE-2025-38735", "CVE-2025-38736", "CVE-2025-39673", "CVE-2025-39675", "CVE-2025-39676", "CVE-2025-39681", "CVE-2025-39682", "CVE-2025-39683", "CVE-2025-39684", "CVE-2025-39685", "CVE-2025-39686", "CVE-2025-39687", "CVE-2025-39689", "CVE-2025-39691", "CVE-2025-39692", "CVE-2025-39693", "CVE-2025-39694", "CVE-2025-39697", "CVE-2025-39701", "CVE-2025-39702", "CVE-2025-39703", "CVE-2025-39706", "CVE-2025-39709", "CVE-2025-39710", "CVE-2025-39713", "CVE-2025-39714", "CVE-2025-39715", "CVE-2025-39716", "CVE-2025-39718", "CVE-2025-39719", "CVE-2025-39724", "CVE-2025-39736", "CVE-2025-39737", "CVE-2025-39738", "CVE-2025-39742", "CVE-2025-39743", "CVE-2025-39749", "CVE-2025-39752", "CVE-2025-39756", "CVE-2025-39757", "CVE-2025-39759", "CVE-2025-39760", "CVE-2025-39766", "CVE-2025-39770", "CVE-2025-39772", "CVE-2025-39773", "CVE-2025-39776", "CVE-2025-39782", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39788", "CVE-2025-39790", "CVE-2025-39794", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39800", "CVE-2025-39801", "CVE-2025-39806", "CVE-2025-39808", "CVE-2025-39812", "CVE-2025-39813", "CVE-2025-39817", "CVE-2025-39819", "CVE-2025-39823", "CVE-2025-39824", "CVE-2025-39825", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39828", "CVE-2025-39835", "CVE-2025-39838", "CVE-2025-39839", "CVE-2025-39841", "CVE-2025-39842", "CVE-2025-39843", "CVE-2025-39844", "CVE-2025-39845", "CVE-2025-39846", "CVE-2025-39847", "CVE-2025-39848", "CVE-2025-39849", "CVE-2025-39853", "CVE-2025-39857", "CVE-2025-39860", "CVE-2025-39864", "CVE-2025-39865", "CVE-2025-39866", "CVE-2025-40300", "CVE-2025-9230", "CVE-2025-9231", "CVE-2025-9232", "CVE-2026-2673", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31789", "CVE-2026-31790" ] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "SSA-032379", "relatedCves": [ "CVE-2026-22924", "CVE-2026-22925", "CVE-2025-9820", "CVE-2025-14831", "CVE-2025-8916", "CVE-2025-55752", "CVE-2025-55754", "CVE-2025-61795", "CVE-2025-48989", "CVE-2025-43368", "CVE-2025-47219", "CVE-2025-6021", "CVE-2025-6052", "CVE-2025-7425", "CVE-2026-21925", "CVE-2026-21932", "CVE-2026-21933", "CVE-2026-21945", "CVE-2026-21947", "CVE-2025-31257", "CVE-2025-53057", "CVE-2025-53066", "CVE-2025-61748", "CVE-2024-47704", "CVE-2024-57924", "CVE-2024-58240", "CVE-2025-23143", "CVE-2025-23160", "CVE-2025-37931", "CVE-2025-37968", "CVE-2025-38322", "CVE-2025-38347", "CVE-2025-38491", "CVE-2025-38502", "CVE-2025-38552", "CVE-2025-38614", "CVE-2025-38670", "CVE-2025-38676", "CVE-2025-38677", "CVE-2025-38679", "CVE-2025-38680", "CVE-2025-38681", "CVE-2025-38683", "CVE-2025-38684", "CVE-2025-38685", "CVE-2025-38687", "CVE-2025-38691", "CVE-2025-38693", "CVE-2025-38694", "CVE-2025-38695", "CVE-2025-38696", "CVE-2025-38697", "CVE-2025-38698", "CVE-2025-38699", "CVE-2025-38700", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38706", "CVE-2025-38707", "CVE-2025-38708", "CVE-2025-38711", "CVE-2025-38712", "CVE-2025-38713", "CVE-2025-38714", "CVE-2025-38715", "CVE-2025-38721", "CVE-2025-38723", "CVE-2025-38724", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38728", "CVE-2025-38729", "CVE-2025-38732", "CVE-2025-38735", "CVE-2025-38736", "CVE-2025-39673", "CVE-2025-39675", "CVE-2025-39676", "CVE-2025-39681", "CVE-2025-39682", "CVE-2025-39683", "CVE-2025-39684", "CVE-2025-39685", "CVE-2025-39686", "CVE-2025-39687", "CVE-2025-39689", "CVE-2025-39691", "CVE-2025-39692", "CVE-2025-39693", "CVE-2025-39694", "CVE-2025-39697", "CVE-2025-39701", "CVE-2025-39702", "CVE-2025-39703", "CVE-2025-39706", "CVE-2025-39709", "CVE-2025-39710", "CVE-2025-39713", "CVE-2025-39714", "CVE-2025-39715", "CVE-2025-39716", "CVE-2025-39718", "CVE-2025-39719", "CVE-2025-39724", "CVE-2025-39736", "CVE-2025-39737", "CVE-2025-39738", "CVE-2025-39742", "CVE-2025-39743", "CVE-2025-39749", "CVE-2025-39752", "CVE-2025-39756", "CVE-2025-39757", "CVE-2025-39759", "CVE-2025-39760", "CVE-2025-39766", "CVE-2025-39770", "CVE-2025-39772", "CVE-2025-39773", "CVE-2025-39776", "CVE-2025-39782", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39788", "CVE-2025-39790", "CVE-2025-39794", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39800", "CVE-2025-39801", "CVE-2025-39806", "CVE-2025-39808", "CVE-2025-39812", "CVE-2025-39813", "CVE-2025-39817", "CVE-2025-39819", "CVE-2025-39823", "CVE-2025-39824", "CVE-2025-39825", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39828", "CVE-2025-39835", "CVE-2025-39838", "CVE-2025-39839", "CVE-2025-39841", "CVE-2025-39842", "CVE-2025-39843", "CVE-2025-39844", "CVE-2025-39845", "CVE-2025-39846", "CVE-2025-39847", "CVE-2025-39848", "CVE-2025-39849", "CVE-2025-39853", "CVE-2025-39857", "CVE-2025-39860", "CVE-2025-39864", "CVE-2025-39865", "CVE-2025-39866", "CVE-2025-40300", "CVE-2025-9230", "CVE-2025-9231", "CVE-2025-9232", "CVE-2026-2673", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31789", "CVE-2026-31790" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "title": "SSA-032379", "relatedCves": [ "CVE-2026-22924", "CVE-2026-22925", "CVE-2025-9820", "CVE-2025-14831", "CVE-2025-8916", "CVE-2025-55752", "CVE-2025-55754", "CVE-2025-61795", "CVE-2025-48989", "CVE-2025-43368", "CVE-2025-47219", "CVE-2025-6021", "CVE-2025-6052", "CVE-2025-7425", "CVE-2026-21925", "CVE-2026-21932", "CVE-2026-21933", "CVE-2026-21945", "CVE-2026-21947", "CVE-2025-31257", "CVE-2025-53057", "CVE-2025-53066", "CVE-2025-61748", "CVE-2024-47704", "CVE-2024-57924", "CVE-2024-58240", "CVE-2025-23143", "CVE-2025-23160", "CVE-2025-37931", "CVE-2025-37968", "CVE-2025-38322", "CVE-2025-38347", "CVE-2025-38491", "CVE-2025-38502", "CVE-2025-38552", "CVE-2025-38614", "CVE-2025-38670", "CVE-2025-38676", "CVE-2025-38677", "CVE-2025-38679", "CVE-2025-38680", "CVE-2025-38681", "CVE-2025-38683", "CVE-2025-38684", "CVE-2025-38685", "CVE-2025-38687", "CVE-2025-38691", "CVE-2025-38693", "CVE-2025-38694", "CVE-2025-38695", "CVE-2025-38696", "CVE-2025-38697", "CVE-2025-38698", "CVE-2025-38699", "CVE-2025-38700", "CVE-2025-38701", "CVE-2025-38702", "CVE-2025-38706", "CVE-2025-38707", "CVE-2025-38708", "CVE-2025-38711", "CVE-2025-38712", "CVE-2025-38713", "CVE-2025-38714", "CVE-2025-38715", "CVE-2025-38721", "CVE-2025-38723", "CVE-2025-38724", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38728", "CVE-2025-38729", "CVE-2025-38732", "CVE-2025-38735", "CVE-2025-38736", "CVE-2025-39673", "CVE-2025-39675", "CVE-2025-39676", "CVE-2025-39681", "CVE-2025-39682", "CVE-2025-39683", "CVE-2025-39684", "CVE-2025-39685", "CVE-2025-39686", "CVE-2025-39687", "CVE-2025-39689", "CVE-2025-39691", "CVE-2025-39692", "CVE-2025-39693", "CVE-2025-39694", "CVE-2025-39697", "CVE-2025-39701", "CVE-2025-39702", "CVE-2025-39703", "CVE-2025-39706", "CVE-2025-39709", "CVE-2025-39710", "CVE-2025-39713", "CVE-2025-39714", "CVE-2025-39715", "CVE-2025-39716", "CVE-2025-39718", "CVE-2025-39719", "CVE-2025-39724", "CVE-2025-39736", "CVE-2025-39737", "CVE-2025-39738", "CVE-2025-39742", "CVE-2025-39743", "CVE-2025-39749", "CVE-2025-39752", "CVE-2025-39756", "CVE-2025-39757", "CVE-2025-39759", "CVE-2025-39760", "CVE-2025-39766", "CVE-2025-39770", "CVE-2025-39772", "CVE-2025-39773", "CVE-2025-39776", "CVE-2025-39782", "CVE-2025-39783", "CVE-2025-39787", "CVE-2025-39788", "CVE-2025-39790", "CVE-2025-39794", "CVE-2025-39795", "CVE-2025-39798", "CVE-2025-39800", "CVE-2025-39801", "CVE-2025-39806", "CVE-2025-39808", "CVE-2025-39812", "CVE-2025-39813", "CVE-2025-39817", "CVE-2025-39819", "CVE-2025-39823", "CVE-2025-39824", "CVE-2025-39825", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39828", "CVE-2025-39835", "CVE-2025-39838", "CVE-2025-39839", "CVE-2025-39841", "CVE-2025-39842", "CVE-2025-39843", "CVE-2025-39844", "CVE-2025-39845", "CVE-2025-39846", "CVE-2025-39847", "CVE-2025-39848", "CVE-2025-39849", "CVE-2025-39853", "CVE-2025-39857", "CVE-2025-39860", "CVE-2025-39864", "CVE-2025-39865", "CVE-2025-39866", "CVE-2025-40300", "CVE-2025-9230", "CVE-2025-9231", "CVE-2025-9232", "CVE-2026-2673", "CVE-2026-28387", "CVE-2026-28388", "CVE-2026-28389", "CVE-2026-28390", "CVE-2026-31789", "CVE-2026-31790" ], "truncated": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T17:56:14.826Z", "fetchedAt": "2026-10-23T02:43:38.138Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:44.645Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "497f567b7ca13c64641c67e6d460436c16920ffc45280408f454fe8633c9b0f8", "sourceModifiedAt": "2026-10-07T17:56:14.826Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの TLS 実装で、recvmsg() が処理するレコードは、連続した DATA レコードだけ、または 1 つの非 DATA レコードだけである必要があります。次のレコードのタイプが既に処理したものと異なる場合はメインループを抜け、TLS 1.3 のように復号後にタイプが判明した場合は保留中のレコードを rx_list にキューイングします。ゼロコピー復号後に skb が無いため rx_list へキューイングできず、データレコードのみがゼロコピー可能で、非データレコードの後でループを抜けます。見落としていたのは、最初のレコードが rx_list から来て長さが 0 の場合です。", "risk": "この脆弱性の説明には、影響や被害についての記述がありません。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Linux カーネルの TLS ソフトウェア実装 (net/tls/tls_sw.c) が使用されている環境で影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3", "E4", "E2" ] }, { "text": "カーネルバージョンが 6.0 未満、または 6.1.149 以前、6.6.103 以前、6.12.44 以前、6.16.4 以前、6.17 未満のバージョンで影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Git コミット 84c61fe1a75b4255df1e1e7c054c9e6d048da417 から、以下の lessThan コミットまでの範囲 (2902c3ebcca52ca845c03182000e8d71d3a5196f、c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677、3439c15ae91a517cf3c650ea15a8987699416ad9、29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e、62708b9452f8eb77513115b17c4f8d1a22ebf843) が影響対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、2902c3ebcca52ca845c03182000e8d71d3a5196f未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、3439c15ae91a517cf3c650ea15a8987699416ad9未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、62708b9452f8eb77513115b17c4f8d1a22ebf843未満。対象のファイル：net/tls/tls_sw.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.149以上、6.1.*以下。影響なしとして記載：6.6.103以上、6.6.*以下。影響なしとして記載：6.12.44以上、6.12.*以下。影響なしとして記載：6.16.4以上、6.16.*以下。影響なしとして記載：6.17以上（原資料の上限表記は「*」）。対象のファイル：net/tls/tls_sw.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-39682", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourceField": "/containers/cna/title", "excerpt": "tls: fix handling of zero-length records on the rx_list", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"versions\":[{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"2902c3ebcca52ca845c03182000e8d71d3a5196f\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"3439c15ae91a517cf3c650ea15a8987699416ad9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"84c61fe1a75b4255df1e1e7c054c9e6d048da417\",\"lessThan\":\"62708b9452f8eb77513115b17c4f8d1a22ebf843\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39682.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/tls/tls_sw.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.149\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.44\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-39682\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-39682（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Linux カーネルの TLS ソフトウェア実装 (net/tls/tls_sw.c) が使用されている環境で影響があります。\n・カーネルバージョンが 6.0 未満、または 6.1.149 以前、6.6.103 以前、6.12.44 以前、6.16.4 以前、6.17 未満のバージョンで影響があります。\n・Git コミット 84c61fe1a75b4255df1e1e7c054c9e6d048da417 から、以下の lessThan コミットまでの範囲 (2902c3ebcca52ca845c03182000e8d71d3a5196f、c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677、3439c15ae91a517cf3c650ea15a8987699416ad9、29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e、62708b9452f8eb77513115b17c4f8d1a22ebf843) が影響対象です。\n・公式の対象表：Linux / Linux。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、2902c3ebcca52ca845c03182000e8d71d3a5196f未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、3439c15ae91a517cf3c650ea15a8987699416ad9未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e未満。影響ありとして記載：84c61fe1a75b4255df1e1e7c054c9e6d048da417以上、62708b9452f8eb77513115b17c4f8d1a22ebf843未満。対象のファイル：net/tls/tls_sw.c\n・公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.149以上、6.1.*以下。影響なしとして記載：6.6.103以上、6.6.*以下。影響なしとして記載：6.12.44以上、6.12.*以下。影響なしとして記載：6.16.4以上、6.16.*以下。影響なしとして記載：6.17以上（原資料の上限表記は「*」）。対象のファイル：net/tls/tls_sw.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-39682", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:44.645Z", "lastSuccess": "2026-10-23T03:21:44.645Z", "sourceCheckedAt": "2026-10-23T02:43:38.138Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-39964", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの af_alg ソケットで同じソケットに対して同時に 2 回書き込むと、データが予測できない形で交錯し、内部ソケット状態に不整合が生じる可能性があります。この問題を防ぐため、書き込み専有を示す新しい ctx->write フィールドが追加されました。", "risk": "同時書き込みによりデータが予測不能に交錯し、内部ソケット状態が不整合になる可能性があります。", "product": "Linux", "category": "linux", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "Linux", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < e4c1ec11132ec466f7362a95f36a506ce4dc08c9" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 7c4491b5644e3a3708f3dbd7591be0a570135b84" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 9aee87da5572b3a14075f501752e209801160d3d" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 45bcf60fe49b37daab1acee57b27211ad1574042" }, { "product": "Linux", "range": ">= 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 / < 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285" }, { "product": "Linux", "range": "2.6.38" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-39964", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2025-10-13T13:48:30.334Z", "modifiedAt": "2026-10-15T01:08:42.257Z", "fetchedAt": "2026-10-23T02:43:38.156Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "sourceTitle": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "crypto/af_alg.c", "include/crypto/if_alg.h" ], "versions": [ { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "9aee87da5572b3a14075f501752e209801160d3d", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042", "status": "affected", "versionType": "git" }, { "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "crypto/af_alg.c", "include/crypto/if_alg.h" ], "versions": [ { "version": "2.6.38", "status": "affected" }, { "version": "0", "lessThan": "2.6.38", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.245", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.154", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.108", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.49", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.9", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-39964", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "fetchedAt": "2026-10-23T02:43:38.156Z", "publishedAt": "2025-10-13T13:48:30.334Z", "modifiedAt": "2026-10-15T01:08:42.257Z", "state": "published", "provider": "Linux", "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "crypto/af_alg.c", "include/crypto/if_alg.h" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "9aee87da5572b3a14075f501752e209801160d3d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2", "lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285", "versionType": "git", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "crypto/af_alg.c", "include/crypto/if_alg.h" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "2.6.38", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "2.6.38", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "5.10.245", "lessThanOrEqual": "5.10.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.15.194", "lessThanOrEqual": "5.15.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "6.1.154", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.6.108", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "6.12.49", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "6.16.9", "lessThanOrEqual": "6.16.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "6.17", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "Linux", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"crypto/af_alg.c\",\"include/crypto/if_alg.h\"],\"versions\":[{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"0f28c4adbc4a97437874c9b669fd7958a8c6d6ce\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"e4c1ec11132ec466f7362a95f36a506ce4dc08c9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"7c4491b5644e3a3708f3dbd7591be0a570135b84\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"9aee87da5572b3a14075f501752e209801160d3d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"45bcf60fe49b37daab1acee57b27211ad1574042\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"1b34cbbf4f011a121ef7b2d7d6e6920a036d5285\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"crypto/af_alg.c\",\"include/crypto/if_alg.h\"],\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.154\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.108\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.49\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.16.9\",\"lessThanOrEqual\":\"6.16.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "sourcePath": "body:advisory", "text": "SSA-019113\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6\n\nPublication Date:\n\n2026-07-14\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.2\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.\n\nSIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 is no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version.\n\nNote: This SSA advises vulnerabilities for firmware version V3.1.6 only; for version V3.1.7 refer to SSA-457936 .\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31682\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-3497\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-46174\n\nCVE-2026-46333\n\nCVE-2023-53292\n\nCVE-2025-21863\n\nCVE-2025-40196\n\nCVE-2026-23255\n\nCVE-2026-23399\n\nCVE-2026-31449\n\nCVE-2026-31681\n\nCVE-2026-31700\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.6 < V3.1.7\n\naffected by\n\nmultiple CVEs\n\nCVE-2026-31431\n\nCVE-2026-43284\n\nCVE-2026-46300\n\nUpdate to V3.1.7 or later version\n\nhttps://support.industry.siemens.com/cs/ww/en/view/109478459/\n\nSee further recommendations from section\nMitigations\n\nExpand children\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-20", "truncated": true, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-39964", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ] }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "sourcePath": "body:advisory", "text": "SSA-457936\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-457936: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.7\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.7 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nSIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants)\n\nShow more details\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2025-39827\n\nCVE-2025-39845\n\nCVE-2025-39866\n\nCVE-2025-39871\n\nCVE-2025-39931\n\nCVE-2025-39953\n\nCVE-2025-39955\n\nCVE-2025-39964\n\nCVE-2025-39977\n\nCVE-2025-39978\n\nCVE-2025-39980\n\nCVE-2025-40022\n\nCVE-2025-40070\n\nCVE-2025-40078\n\nCVE-2025-40080\n\nCVE-2025-40105\n\nCVE-2025-40135\n\nCVE-2025-40149\n\nCVE-2025-40196\n\nCVE-2025-40219\n\nCVE-2025-40261\n\nCVE-2025-40300\n\nCVE-2025-61984\n\nCVE-2025-61985\n\nCVE-2025-68206\n\nCVE-2025-68261\n\nCVE-2025-68264\n\nCVE-2025-68265\n\nCVE-2025-68266\n\nCVE-2025-68291\n\nCVE-2025-68337\n\nCVE-2025-68349\n\nCVE-2025-68363\n\nCVE-2025-68371\n\nCVE-2025-68724\n\nCVE-2025-68725\n\nCVE-2025-68742\n\nCVE-2025-68764\n\nCVE-2025-68773\n\nCVE-2025-68776\n\nCVE-2025-68782\n\nCVE-2025-68787\n\nCVE-2025-68788\n\nCVE-2025-68798\n\nCVE-2025-68803\n\nCVE-2025-68814\n\nCVE-2025-68816\n\nCVE-2025-68818\n\nCVE-2025-68820\n\nCVE-2025-71064\n\nCVE-2025-71075\n\nCVE-2025-71079\n\nCVE-2025-71085\n\nCVE-2025-71086\n\nCVE-2025-71088\n\nCVE-2025-71095\n\nCVE-2025-71097\n\nCVE-2025-71098\n\nCVE-2025-71104\n\nCVE-2025-71112\n\nCVE-2025-71113\n\nCVE-2025-71114\n\nCVE-2025-71120\n\nCVE-2025-71123\n\nCVE-2025-71131\n\nCVE-2025-71161\n\nCVE-2025-71162\n\nCVE-2025-71163\n\nCVE-2025-71185\n\nCVE-2025-71186\n\nCVE-2025-71189\n\nCVE-2025-71190\n\nCVE-2025-71191\n\nCVE-2025-71197\n\nCVE-2025-71221\n\nCVE-2025-71265\n\nCVE-2025-71266\n\nCVE-2025-71267\n\nCVE-2026-3497\n\nCVE-2026-22977\n\nCVE-2026-22979\n\nCVE-2026-22980\n\nCVE-2026-22982\n\nCVE-2026-22992\n\nCVE-2026-22994\n\nCVE-2026-23003\n\nCVE-2026-23005\n\nCVE-2026-23010\n\nCVE-2026-23011\n\nCVE-2026-23019\n\nCVE-2026-23026\n\nCVE-2026-23038\n\nCVE-2026-23054\n\nCVE-2026-23060\n\nCVE-2026-23083\n\nCVE-2026-23084\n\nCVE-2026-23086\n\nCVE-2026-23087\n\nCVE-2026-23095\n\nCVE-2026-23100\n\nCVE-2026-23103\n\nCVE-2026-23110\n\nCVE-2026-23111\n\nCVE-2026-23113\n\nCVE-2026-23154\n\nCVE-2026-23204\n\nCVE-2026-23231\n\nCVE-2026-23242\n\nCVE-2026-23243\n\nCVE-2026-23245\n\nCVE-2026-23255\n\nCVE-2026-23270\n\nCVE-2026-23271\n\nCVE-2026-23273\n\nCVE-2026-23274\n\nCVE-2026-23277\n\nCVE-2026-23284\n\nCVE-2026-23287\n\nCVE-2026-23290\n\nCVE-2026-23293\n\nCVE-2026-23300\n\nCVE-2026-23304\n\nCVE-2026-23319\n\nCVE-2026-23321\n\nCVE-2026-23335\n\nCVE-2026-23340\n\nCVE-2026-23343\n\nCVE-2026-23351\n\nCVE-2026-23359\n\nCVE-2026-23365\n\nCVE-2026-23368\n\nCVE-2026-23370\n\nCVE-2026-23378\n\nCVE-2026-23379\n\nCVE-2026-23381\n\nCVE-2026-23391\n\nCVE-2026-23392\n\nCVE-2026-23397\n\nCVE-2026-23398\n\nCVE-2026-23399\n\nCVE-2026-23414\n\nCVE-2026-23422\n\nCVE-2026-23434\n\nCVE-2026-23438\n\nCVE-2026-23439\n\nCVE-2026-23446\n\nCVE-2026-23449\n\nCVE-2026-23450\n\nCVE-2026-23452\n\nCVE-2026-23454\n\nCVE-2026-23455\n\nCVE-2026-23456\n\nCVE-2026-23457\n\nCVE-2026-23458\n\nCVE-2026-23463\n\nCVE-2026-23474\n\nCVE-2026-23475\n\nCVE-2026-27135\n\nCVE-2026-31389\n\nCVE-2026-31391\n\nCVE-2026-31396\n\nCVE-2026-31402\n\nCVE-2026-31403\n\nCVE-2026-31411\n\nCVE-2026-31414\n\nCVE-2026-31415\n\nCVE-2026-31416\n\nCVE-2026-31417\n\nCVE-2026-31418\n\nCVE-2026-31421\n\nCVE-2026-31422\n\nCVE-2026-31423\n\nCVE-2026-31424\n\nCVE-2026-31427\n\nCVE-2026-31428\n\nCVE-2026-31441\n\nCVE-2026-31446\n\nCVE-2026-31447\n\nCVE-2026-31448\n\nCVE-2026-31449\n\nCVE-2026-31450\n\nCVE-2026-31452\n\nCVE-2026-31466\n\nCVE-2026-31469\n\nCVE-2026-31485\n\nCVE-2026-31494\n\nCVE-2026-31495\n\nCVE-2026-31496\n\nCVE-2026-31503\n\nCVE-2026-31504\n\nCVE-2026-31507\n\nCVE-2026-31508\n\nCVE-2026-31515\n\nCVE-2026-31518\n\nCVE-2026-31521\n\nCVE-2026-31533\n\nCVE-2026-31546\n\nCVE-2026-31555\n\nCVE-2026-31563\n\nCVE-2026-31565\n\nCVE-2026-31628\n\nCVE-2026-31634\n\nCVE-2026-31649\n\nCVE-2026-31651\n\nCVE-2026-31658\n\nCVE-2026-31664\n\nCVE-2026-31665\n\nCVE-2026-31669\n\nCVE-2026-31670\n\nCVE-2026-31671\n\nCVE-2026-31674\n\nCVE-2026-31680\n\nCVE-2026-31681\n\nCVE-2026-31682\n\nCVE-2026-31700\n\nCVE-2026-31737\n\nCVE-2026-31752\n\nCVE-2026-31761\n\nCVE-2026-31768\n\nCVE-2026-40355\n\nCVE-2026-41989\n\nCVE-2026-43011\n\nCVE-2026-43024\n\nCVE-2026-43025\n\nCVE-2026-43026\n\nCVE-2026-43027\n\nCVE-2026-43028\n\nCVE-2026-43030\n\nCVE-2026-43033\n\nCVE-2026-43035\n\nCVE-2026-43038\n\nCVE-2026-43040\n\nCVE-2026-43057\n\nCVE-2026-43071\n\nCVE-2026-43085\n\nCVE-2026-43089\n\nCVE-2026-43116\n\nCVE-2026-43216\n\nCVE-2026-43303\n\nCVE-2026-43492\n\nCVE-2026-43499\n\nCVE-2026-43501\n\nCVE-2026-45841\n\nCVE-2026-46015\n\nCVE-2026-46021\n\nCVE-2026-46033\n\nCVE-2026-46037\n\nCVE-2026-46040\n\nCVE-2026-46046\n\nCVE-2026-46086\n\nCVE-2026-46101\n\nCVE-2026-46116\n\nCVE-2026-46132\n\nCVE-2026-46172\n\nCVE-2026-46173\n\nCVE-2026-46174\n\nCVE-2026-46193\n\nCVE-2026-46303\n\nCVE-2026-46306\n\nCVE-2026-46323\n\nCVE-2026-46333\n\nCVE-2026-52910\n\nCVE-2026-52912\n\nCVE-2026-52930\n\nCVE-2026-52933\n\nCVE-2026-52942\n\nCVE-2026-52943\n\nCVE-2026-52946\n\nCVE-2026-52970\n\nCVE-2026-52986\n\nCVE-2026-52998\n\nCVE-2026-52999\n\nCVE-2026-53001\n\nCVE-2026-53002\n\nCVE-2026-53006\n\nCVE-2026-53012\n\nCVE-2026-53050\n\nCVE-2026-53134\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53223\n\nCVE-2026-53236\n\nCVE-2026-53239\n\nCVE-2026-53249\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53295\n\nCVE-2026-53352\n\nCVE-2026-53400\n\nCVE-2026-63810\n\nCVE-2026-64279\n\nCVE-2026-64317\n\nCVE-2026-64370\n\nCVE-2026-64371\n\nCVE-2026-64375\n\nCVE-2026-64411\n\nCVE-2026-64412\n\nCVE-2026-64413\n\nCVE-2026-64422\n\nCVE-2026-64423\n\nCVE-2026-64425\n\nCVE-2026-64538\n\nCVE-2026-64545\n\nCVE-2026-64552\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)\n\nAll versions >= V3.1.7\n\naffected by\n\nall CVEs\n\nCVE-2021-41617\n\nCVE-2023-28531\n\nCVE-2023-51384\n\nCVE-2023-52927\n\nCVE-2023-53292\n\nCVE-2024-26783\n\nCVE-2024-27056\n\nCVE-2024-28956\n\nCVE-2024-36903\n\nCVE-2024-36927\n\nCVE-2024-42079\n\nCVE-2024-46786\n\nCVE-2024-47736\n\nCVE-2024-47809\n\nCVE-2024-49968\n\nCVE-2024-49994\n\nCVE-2024-49998\n\nCVE-2024-50014\n\nCVE-2024-50063\n\nCVE-2024-50164\n\nCVE-2024-50298\n\nCVE-2024-53124\n\nCVE-2024-53170\n\nCVE-2024-54458\n\nCVE-2024-56631\n\nCVE-2024-56703\n\nCVE-2024-56719\n\nCVE-2024-57917\n\nCVE-2024-57924\n\nCVE-2024-57973\n\nCVE-2024-57977\n\nCVE-2024-57979\n\nCVE-2024-58011\n\nCVE-2024-58016\n\nCVE-2024-58020\n\nCVE-2024-58056\n\nCVE-2024-58058\n\nCVE-2024-58061\n\nCVE-2024-58086\n\nCVE-2025-21645\n\nCVE-2025-21648\n\nCVE-2025-21655\n\nCVE-2025-21676\n\nCVE-2025-21682\n\nCVE-2025-21702\n\nCVE-2025-21705\n\nCVE-2025-21706\n\nCVE-2025-21707\n\nCVE-2025-21718\n\nCVE-2025-21731\n\nCVE-2025-21745\n\nCVE-2025-21758\n\nCVE-2025-21760\n\nCVE-2025-21764\n\nCVE-2025-21765\n\nCVE-2025-21780\n\nCVE-2025-21795\n\nCVE-2025-21796\n\nCVE-2025-21802\n\nCVE-2025-21814\n\nCVE-2025-21846\n\nCVE-2025-21853\n\nCVE-2025-21861\n\nCVE-2025-21863\n\nCVE-2025-21864\n\nCVE-2025-21867\n\nCVE-2025-21875\n\nCVE-2025-21887\n\nCVE-2025-21913\n\nCVE-2025-21919\n\nCVE-2025-21925\n\nCVE-2025-21926\n\nCVE-2025-21938\n\nCVE-2025-21959\n\nCVE-2025-21999\n\nCVE-2025-22005\n\nCVE-2025-22015\n\nCVE-2025-22055\n\nCVE-2025-22056\n\nCVE-2025-22060\n\nCVE-2025-22083\n\nCVE-2025-22090\n\nCVE-2025-22095\n\nCVE-2025-22107\n\nCVE-2025-22111\n\nCVE-2025-22121\n\nCVE-2025-23136\n\nCVE-2025-23143\n\nCVE-2025-37785\n\nCVE-2025-37909\n\nCVE-2025-37917\n\nCVE-2025-37945\n\nCVE-2025-37959\n\nCVE-2025-37964\n\nCVE-2025-37972\n\nCVE-2025-37980\n\nCVE-2025-38125\n\nCVE-2025-38162\n\nCVE-2025-38192\n\nCVE-2025-38201\n\nCVE-2025-38232\n\nCVE-2025-38322\n\nCVE-2025-38591\n\nCVE-2025-38614\n\nCVE-2025-38681\n\nCVE-2025-38704\n\nCVE-2025-38721\n\nCVE-2025-38725\n\nCVE-2025-38727\n\nCVE-2025-38732\n\nCVE-2025-38736\n\nCVE-2025-39681\n\nCVE-2025-39691\n\nCVE-2025-39721\n\nCVE-2025-39748\n\nCVE-2025-39756\n\nCVE-2025-39764\n\nCVE-2025-39770\n\nCVE-2025-39773\n\nCVE-2025-39782\n\nCVE-2025-39795\n\nCVE-2025-39826\n\nCVE-2", "truncated": true, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-39964", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "SSA-019113", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ] }, { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "SSA-457936", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "title": "SSA-019113", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31682", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-3497", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-46174", "CVE-2026-46333", "CVE-2023-53292", "CVE-2025-21863", "CVE-2025-40196", "CVE-2026-23255", "CVE-2026-23399", "CVE-2026-31449", "CVE-2026-31681", "CVE-2026-31700", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2026-31431", "CVE-2026-43284", "CVE-2026-46300", "CVE-2025-38617" ], "truncated": true }, { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "title": "SSA-457936", "relatedCves": [ "CVE-2021-41617", "CVE-2023-28531", "CVE-2023-51384", "CVE-2023-52927", "CVE-2023-53292", "CVE-2024-26783", "CVE-2024-27056", "CVE-2024-28956", "CVE-2024-36903", "CVE-2024-36927", "CVE-2024-42079", "CVE-2024-46786", "CVE-2024-47736", "CVE-2024-47809", "CVE-2024-49968", "CVE-2024-49994", "CVE-2024-49998", "CVE-2024-50014", "CVE-2024-50063", "CVE-2024-50164", "CVE-2024-50298", "CVE-2024-53124", "CVE-2024-53170", "CVE-2024-54458", "CVE-2024-56631", "CVE-2024-56703", "CVE-2024-56719", "CVE-2024-57917", "CVE-2024-57924", "CVE-2024-57973", "CVE-2024-57977", "CVE-2024-57979", "CVE-2024-58011", "CVE-2024-58016", "CVE-2024-58020", "CVE-2024-58056", "CVE-2024-58058", "CVE-2024-58061", "CVE-2024-58086", "CVE-2025-21645", "CVE-2025-21648", "CVE-2025-21655", "CVE-2025-21676", "CVE-2025-21682", "CVE-2025-21702", "CVE-2025-21705", "CVE-2025-21706", "CVE-2025-21707", "CVE-2025-21718", "CVE-2025-21731", "CVE-2025-21745", "CVE-2025-21758", "CVE-2025-21760", "CVE-2025-21764", "CVE-2025-21765", "CVE-2025-21780", "CVE-2025-21795", "CVE-2025-21796", "CVE-2025-21802", "CVE-2025-21814", "CVE-2025-21846", "CVE-2025-21853", "CVE-2025-21861", "CVE-2025-21863", "CVE-2025-21864", "CVE-2025-21867", "CVE-2025-21875", "CVE-2025-21887", "CVE-2025-21913", "CVE-2025-21919", "CVE-2025-21925", "CVE-2025-21926", "CVE-2025-21938", "CVE-2025-21959", "CVE-2025-21999", "CVE-2025-22005", "CVE-2025-22015", "CVE-2025-22055", "CVE-2025-22056", "CVE-2025-22060", "CVE-2025-22083", "CVE-2025-22090", "CVE-2025-22095", "CVE-2025-22107", "CVE-2025-22111", "CVE-2025-22121", "CVE-2025-23136", "CVE-2025-23143", "CVE-2025-37785", "CVE-2025-37909", "CVE-2025-37917", "CVE-2025-37945", "CVE-2025-37959", "CVE-2025-37964", "CVE-2025-37972", "CVE-2025-37980", "CVE-2025-38125", "CVE-2025-38162", "CVE-2025-38192", "CVE-2025-38201", "CVE-2025-38232", "CVE-2025-38322", "CVE-2025-38591", "CVE-2025-38614", "CVE-2025-38681", "CVE-2025-38704", "CVE-2025-38721", "CVE-2025-38725", "CVE-2025-38727", "CVE-2025-38732", "CVE-2025-38736", "CVE-2025-39681", "CVE-2025-39691", "CVE-2025-39721", "CVE-2025-39748", "CVE-2025-39756", "CVE-2025-39764", "CVE-2025-39770", "CVE-2025-39773", "CVE-2025-39782", "CVE-2025-39795", "CVE-2025-39826", "CVE-2025-39827", "CVE-2025-39845", "CVE-2025-39866", "CVE-2025-39871", "CVE-2025-39931", "CVE-2025-39953", "CVE-2025-39955", "CVE-2025-39964", "CVE-2025-39977", "CVE-2025-39978", "CVE-2025-39980", "CVE-2025-40022", "CVE-2025-40070", "CVE-2025-40078", "CVE-2025-40080", "CVE-2025-40105", "CVE-2025-40135", "CVE-2025-40149", "CVE-2025-40196", "CVE-2025-40219", "CVE-2025-40261", "CVE-2025-40300", "CVE-2025-61984", "CVE-2025-61985", "CVE-2025-68206", "CVE-2025-68261", "CVE-2025-68264", "CVE-2025-68265", "CVE-2025-68266", "CVE-2025-68291", "CVE-2025-68337", "CVE-2025-68349", "CVE-2025-68363", "CVE-2025-68371", "CVE-2025-68724", "CVE-2025-68725", "CVE-2025-68742", "CVE-2025-68764", "CVE-2025-68773", "CVE-2025-68776", "CVE-2025-68782", "CVE-2025-68787", "CVE-2025-68788", "CVE-2025-68798", "CVE-2025-68803", "CVE-2025-68814", "CVE-2025-68816", "CVE-2025-68818", "CVE-2025-68820", "CVE-2025-71064", "CVE-2025-71075", "CVE-2025-71079", "CVE-2025-71085", "CVE-2025-71086", "CVE-2025-71088", "CVE-2025-71095", "CVE-2025-71097", "CVE-2025-71098", "CVE-2025-71104", "CVE-2025-71112", "CVE-2025-71113", "CVE-2025-71114", "CVE-2025-71120", "CVE-2025-71123", "CVE-2025-71131", "CVE-2025-71161", "CVE-2025-71162", "CVE-2025-71163", "CVE-2025-71185", "CVE-2025-71186", "CVE-2025-71189", "CVE-2025-71190", "CVE-2025-71191", "CVE-2025-71197", "CVE-2025-71221", "CVE-2025-71265", "CVE-2025-71266", "CVE-2025-71267", "CVE-2026-3497", "CVE-2026-22977", "CVE-2026-22979", "CVE-2026-22980", "CVE-2026-22982", "CVE-2026-22992", "CVE-2026-22994", "CVE-2026-23003", "CVE-2026-23005", "CVE-2026-23010", "CVE-2026-23011", "CVE-2026-23019", "CVE-2026-23026", "CVE-2026-23038", "CVE-2026-23054", "CVE-2026-23060", "CVE-2026-23083", "CVE-2026-23084", "CVE-2026-23086", "CVE-2026-23087", "CVE-2026-23095", "CVE-2026-23100", "CVE-2026-23103", "CVE-2026-23110", "CVE-2026-23111", "CVE-2026-23113", "CVE-2026-23154", "CVE-2026-23204", "CVE-2026-23231", "CVE-2026-23242", "CVE-2026-23243", "CVE-2026-23245", "CVE-2026-23255", "CVE-2026-23270", "CVE-2026-23271", "CVE-2026-23273", "CVE-2026-23274", "CVE-2026-23277", "CVE-2026-23284", "CVE-2026-23287", "CVE-2026-23290", "CVE-2026-23293", "CVE-2026-23300", "CVE-2026-23304", "CVE-2026-23319", "CVE-2026-23321", "CVE-2026-23335", "CVE-2026-23340", "CVE-2026-23343", "CVE-2026-23351", "CVE-2026-23359", "CVE-2026-23365", "CVE-2026-23368", "CVE-2026-23370", "CVE-2026-23378", "CVE-2026-23379", "CVE-2026-23381", "CVE-2026-23391", "CVE-2026-23392", "CVE-2026-23397", "CVE-2026-23398", "CVE-2026-23399", "CVE-2026-23414", "CVE-2026-23422", "CVE-2026-23434", "CVE-2026-23438", "CVE-2026-23439", "CVE-2026-23446", "CVE-2026-23449", "CVE-2026-23450", "CVE-2026-23452", "CVE-2026-23454", "CVE-2026-23455", "CVE-2026-23456", "CVE-2026-23457", "CVE-2026-23458", "CVE-2026-23463", "CVE-2026-23474", "CVE-2026-23475", "CVE-2026-27135", "CVE-2026-31389", "CVE-2026-31391", "CVE-2026-31396", "CVE-2026-31402", "CVE-2026-31403", "CVE-2026-31411", "CVE-2026-31414", "CVE-2026-31415", "CVE-2026-31416", "CVE-2026-31417", "CVE-2026-31418", "CVE-2026-31421", "CVE-2026-31422", "CVE-2026-31423", "CVE-2026-31424", "CVE-2026-31427", "CVE-2026-31428", "CVE-2026-31441", "CVE-2026-31446", "CVE-2026-31447", "CVE-2026-31448", "CVE-2026-31449", "CVE-2026-31450", "CVE-2026-31452", "CVE-2026-31466", "CVE-2026-31469", "CVE-2026-31485", "CVE-2026-31494", "CVE-2026-31495", "CVE-2026-31496", "CVE-2026-31503", "CVE-2026-31504", "CVE-2026-31507", "CVE-2026-31508", "CVE-2026-31515", "CVE-2026-31518", "CVE-2026-31521", "CVE-2026-31533", "CVE-2026-31546", "CVE-2026-31555", "CVE-2026-31563", "CVE-2026-31565", "CVE-2026-31628", "CVE-2026-31634", "CVE-2026-31649", "CVE-2026-31651", "CVE-2026-31658", "CVE-2026-31664", "CVE-2026-31665", "CVE-2026-31669", "CVE-2026-31670", "CVE-2026-31671", "CVE-2026-31674", "CVE-2026-31680", "CVE-2026-31681", "CVE-2026-31682", "CVE-2026-31700", "CVE-2026-31737", "CVE-2026-31752", "CVE-2026-31761", "CVE-2026-31768", "CVE-2026-40355", "CVE-2026-41989", "CVE-2026-43011", "CVE-2026-43024", "CVE-2026-43025", "CVE-2026-43026", "CVE-2026-43027", "CVE-2026-43028", "CVE-2026-43030", "CVE-2026-43033", "CVE-2026-43035", "CVE-2026-43038", "CVE-2026-43040", "CVE-2026-43057", "CVE-2026-43071", "CVE-2026-43085", "CVE-2026-43089", "CVE-2026-43116", "CVE-2026-43216", "CVE-2026-43303", "CVE-2026-43492", "CVE-2026-43499", "CVE-2026-43501", "CVE-2026-45841", "CVE-2026-46015", "CVE-2026-46021", "CVE-2026-46033", "CVE-2026-46037", "CVE-2026-46040", "CVE-2026-46046", "CVE-2026-46086", "CVE-2026-46101", "CVE-2026-46116", "CVE-2026-46132", "CVE-2026-46172", "CVE-2026-46173", "CVE-2026-46174", "CVE-2026-46193", "CVE-2026-46303", "CVE-2026-46306", "CVE-2026-46323", "CVE-2026-46333", "CVE-2026-52910", "CVE-2026-52912", "CVE-2026-52930", "CVE-2026-52933", "CVE-2026-52942", "CVE-2026-52943", "CVE-2026-52946", "CVE-2026-52970", "CVE-2026-52986", "CVE-2026-52998", "CVE-2026-52999", "CVE-2026-53001", "CVE-2026-53002", "CVE-2026-53006", "CVE-2026-53012", "CVE-2026-53050", "CVE-2026-53134", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53223", "CVE-2026-53236", "CVE-2026-53239", "CVE-2026-53249", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53295", "CVE-2026-53352", "CVE-2026-53400", "CVE-2026-63810", "CVE-2026-64279", "CVE-2026-64317", "CVE-2026-64370", "CVE-2026-64371", "CVE-2026-64375", "CVE-2026-64411", "CVE-2026-64412", "CVE-2026-64413", "CVE-2026-64422", "CVE-2026-64423", "CVE-2026-64425", "CVE-2026-64538", "CVE-2026-64545", "CVE-2026-64552", "CVE-2026-64560", "CVE-2025-38617" ], "truncated": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-15T01:08:42.257Z", "fetchedAt": "2026-10-23T02:43:38.156Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:44.967Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "84eacaf67fb81d01aca886355810aca2a8c5e8f1a9653fdb578bd0dd4e285986", "sourceModifiedAt": "2026-10-15T01:08:42.257Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの af_alg ソケットで同じソケットに対して同時に 2 回書き込むと、データが予測できない形で交錯し、内部ソケット状態に不整合が生じる可能性があります。この問題を防ぐため、書き込み専有を示す新しい ctx->write フィールドが追加されました。", "risk": "同時書き込みによりデータが予測不能に交錯し、内部ソケット状態が不整合になる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "git リポジトリのコミット 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 から、以下の各 lessThan コミットまでの間は影響あり: 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce、e4c1ec11132ec466f7362a95f36a506ce4dc08c9、1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8、7c4491b5644e3a3708f3dbd7591be0a570135b84、9aee87da5572b3a14075f501752e209801160d3d、45bcf60fe49b37daab1acee57b27211ad1574042、1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 の各範囲は影響あり。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Linux カーネル 2.6.38 は影響あり。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 5.10.245（5.10.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 5.15.194（5.15.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 6.1.154（6.1.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 6.6.108（6.6.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 6.12.49（6.12.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 6.16.9（6.16.*）以前は影響なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "バージョン 6.17 以降は影響なし（original_commit_for_fix）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、0f28c4adbc4a97437874c9b669fd7958a8c6d6ce未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、e4c1ec11132ec466f7362a95f36a506ce4dc08c9未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、7c4491b5644e3a3708f3dbd7591be0a570135b84未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、9aee87da5572b3a14075f501752e209801160d3d未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、45bcf60fe49b37daab1acee57b27211ad1574042未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、1b34cbbf4f011a121ef7b2d7d6e6920a036d5285未満。対象のファイル：crypto/af_alg.c、include/crypto/if_alg.h", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：2.6.38。影響なしとして記載：2.6.38未満の版。影響なしとして記載：5.10.245以上、5.10.*以下。影響なしとして記載：5.15.194以上、5.15.*以下。影響なしとして記載：6.1.154以上、6.1.*以下。影響なしとして記載：6.6.108以上、6.6.*以下。影響なしとして記載：6.12.49以上、6.12.*以下。影響なしとして記載：6.16.9以上、6.16.*以下。影響なしとして記載：6.17以上（原資料の上限表記は「*」）。対象のファイル：crypto/af_alg.c、include/crypto/if_alg.h。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-39964", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx->write field that indiciates\nexclusive ownership for writing.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourceField": "/containers/cna/title", "excerpt": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"crypto/af_alg.c\",\"include/crypto/if_alg.h\"],\"versions\":[{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"0f28c4adbc4a97437874c9b669fd7958a8c6d6ce\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"e4c1ec11132ec466f7362a95f36a506ce4dc08c9\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"7c4491b5644e3a3708f3dbd7591be0a570135b84\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"9aee87da5572b3a14075f501752e209801160d3d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"45bcf60fe49b37daab1acee57b27211ad1574042\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"8ff590903d5fc7f5a0a988c38267a3d08e6393a2\",\"lessThan\":\"1b34cbbf4f011a121ef7b2d7d6e6920a036d5285\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/39xxx/CVE-2025-39964.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"crypto/af_alg.c\",\"include/crypto/if_alg.h\"],\"versions\":[{\"version\":\"2.6.38\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.38\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.245\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.194\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.154\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.108\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.49\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.16.9\",\"lessThanOrEqual\":\"6.16.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-39964\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-39964（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・git リポジトリのコミット 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 から、以下の各 lessThan コミットまでの間は影響あり: 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce、e4c1ec11132ec466f7362a95f36a506ce4dc08c9、1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8、7c4491b5644e3a3708f3dbd7591be0a570135b84、9aee87da5572b3a14075f501752e209801160d3d、45bcf60fe49b37daab1acee57b27211ad1574042、1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 の各範囲は影響あり。\n・Linux カーネル 2.6.38 は影響あり。\n・バージョン 5.10.245（5.10.*）以前は影響なし。\n・バージョン 5.15.194（5.15.*）以前は影響なし。\n・バージョン 6.1.154（6.1.*）以前は影響なし。\n・バージョン 6.6.108（6.6.*）以前は影響なし。\n・バージョン 6.12.49（6.12.*）以前は影響なし。\n・バージョン 6.16.9（6.16.*）以前は影響なし。\n・バージョン 6.17 以降は影響なし（original_commit_for_fix）。\n・公式の対象表：Linux / Linux。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、0f28c4adbc4a97437874c9b669fd7958a8c6d6ce未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、e4c1ec11132ec466f7362a95f36a506ce4dc08c9未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、7c4491b5644e3a3708f3dbd7591be0a570135b84未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、9aee87da5572b3a14075f501752e209801160d3d未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、45bcf60fe49b37daab1acee57b27211ad1574042未満。影響ありとして記載：8ff590903d5fc7f5a0a988c38267a3d08e6393a2以上、1b34cbbf4f011a121ef7b2d7d6e6920a036d5285未満。対象のファイル：crypto/af_alg.c、include/crypto/if_alg.h\n・公式の対象表：Linux / Linux。影響ありとして記載：2.6.38。影響なしとして記載：2.6.38未満の版。影響なしとして記載：5.10.245以上、5.10.*以下。影響なしとして記載：5.15.194以上、5.15.*以下。影響なしとして記載：6.1.154以上、6.1.*以下。影響なしとして記載：6.6.108以上、6.6.*以下。影響なしとして記載：6.12.49以上、6.12.*以下。影響なしとして記載：6.16.9以上、6.16.*以下。影響なしとして記載：6.17以上（原資料の上限表記は「*」）。対象のファイル：crypto/af_alg.c、include/crypto/if_alg.h。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-39964", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:44.967Z", "lastSuccess": "2026-10-23T03:21:44.967Z", "sourceCheckedAt": "2026-10-23T02:43:38.156Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-53266", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルのブリッジ netfilter にある ebtables の SNAT ターゲットは、ARP 送信元ハードウェアアドレスを書き換えるオプションが、skb_store_bits() によって書き込み可能であることが保証されていない領域に直接書き込まれる可能性があります。このため、非線形 skb フラグメントが splice でインポートされたファイルページを参照している場合、ARP SHA の書き換えが不正に行われる恐れがあります。", "risk": "記載されている情報には、具体的な被害や影響は明示されていません。", "product": "Linux", "category": "linux", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "Linux", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < 76280b78cc9f23bdc6438e10ad6dff148ef8375b" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < b7e91939ba9be805a62a257fa4e227dffbb88fa0" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < afd64b59c3de9bbbdd3759e834fdc55cda716e0b" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < 153ea96c806aea395daba907a4f88480b6ad5093" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < b18675263db1147c8e1cab625400c13a0d87bd2d" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5" }, { "product": "Linux", "range": ">= 63137bc5882a1882c553d389fdeeeace86ee1741 / < 67ba971ae02514d85818fe0c32549ab4bfa3bf49" }, { "product": "Linux", "range": "2f3839075a5f8dcf116c1abe35b36b018ac62445" }, { "product": "Linux", "range": "51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b" }, { "product": "Linux", "range": "b7d23c2c87584eb429f115c078ed511be8b18e29" }, { "product": "Linux", "range": ">= 5.4.73 / < 5.5" }, { "product": "Linux", "range": ">= 5.8.17 / < 5.9" }, { "product": "Linux", "range": ">= 5.9.2 / < 5.10" }, { "product": "Linux", "range": "5.10" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53266", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-06-25T08:39:53.190Z", "modifiedAt": "2026-09-19T03:56:22.274Z", "fetchedAt": "2026-10-23T02:43:49.420Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "sourceTitle": "netfilter: bridge: make ebt_snat ARP rewrite writable", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/netfilter/ebt_snat.c" ], "versions": [ { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "76280b78cc9f23bdc6438e10ad6dff148ef8375b", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "b7e91939ba9be805a62a257fa4e227dffbb88fa0", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "153ea96c806aea395daba907a4f88480b6ad5093", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "b18675263db1147c8e1cab625400c13a0d87bd2d", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "status": "affected", "versionType": "git" }, { "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "67ba971ae02514d85818fe0c32549ab4bfa3bf49", "status": "affected", "versionType": "git" }, { "version": "2f3839075a5f8dcf116c1abe35b36b018ac62445", "status": "affected", "versionType": "git" }, { "version": "51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b", "status": "affected", "versionType": "git" }, { "version": "b7d23c2c87584eb429f115c078ed511be8b18e29", "status": "affected", "versionType": "git" }, { "version": "5.4.73", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "5.8.17", "lessThan": "5.9", "status": "affected", "versionType": "semver" }, { "version": "5.9.2", "lessThan": "5.10", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bridge/netfilter/ebt_snat.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-53266", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "fetchedAt": "2026-10-23T02:43:49.420Z", "publishedAt": "2026-06-25T08:39:53.190Z", "modifiedAt": "2026-09-19T03:56:22.274Z", "state": "published", "provider": "Linux", "title": "netfilter: bridge: make ebt_snat ARP rewrite writable", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "net/bridge/netfilter/ebt_snat.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "76280b78cc9f23bdc6438e10ad6dff148ef8375b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "b7e91939ba9be805a62a257fa4e227dffbb88fa0", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "153ea96c806aea395daba907a4f88480b6ad5093", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "b18675263db1147c8e1cab625400c13a0d87bd2d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "63137bc5882a1882c553d389fdeeeace86ee1741", "lessThan": "67ba971ae02514d85818fe0c32549ab4bfa3bf49", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "2f3839075a5f8dcf116c1abe35b36b018ac62445", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "b7d23c2c87584eb429f115c078ed511be8b18e29", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "5.4.73", "lessThan": "5.5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "5.8.17", "lessThan": "5.9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "5.9.2", "lessThan": "5.10", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "net/bridge/netfilter/ebt_snat.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "5.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "5.10", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "5.10.259", "lessThanOrEqual": "5.10.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.15.210", "lessThanOrEqual": "5.15.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "6.1.176", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.6.143", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "6.12.94", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "6.18.36", "lessThanOrEqual": "6.18.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "7.0.13", "lessThanOrEqual": "7.0.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "7.1", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "Linux", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/6" }, { "url": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/7" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/bridge/netfilter/ebt_snat.c\"],\"versions\":[{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"76280b78cc9f23bdc6438e10ad6dff148ef8375b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"b7e91939ba9be805a62a257fa4e227dffbb88fa0\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"afd64b59c3de9bbbdd3759e834fdc55cda716e0b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"153ea96c806aea395daba907a4f88480b6ad5093\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"b18675263db1147c8e1cab625400c13a0d87bd2d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"67ba971ae02514d85818fe0c32549ab4bfa3bf49\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"2f3839075a5f8dcf116c1abe35b36b018ac62445\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b7d23c2c87584eb429f115c078ed511be8b18e29\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"5.4.73\",\"lessThan\":\"5.5\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.8.17\",\"lessThan\":\"5.9\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.9.2\",\"lessThan\":\"5.10\",\"status\":\"affected\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/bridge/netfilter/ebt_snat.c\"],\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-19T03:56:22.274Z", "fetchedAt": "2026-10-23T02:43:49.420Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.014Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2cd0463d310a215c74b62129520fae6e681cf870104be13909b1c86d7df7111b", "sourceModifiedAt": "2026-09-19T03:56:22.274Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルのブリッジ netfilter にある ebtables の SNAT ターゲットは、ARP 送信元ハードウェアアドレスを書き換えるオプションが、skb_store_bits() によって書き込み可能であることが保証されていない領域に直接書き込まれる可能性があります。このため、非線形 skb フラグメントが splice でインポートされたファイルページを参照している場合、ARP SHA の書き換えが不正に行われる恐れがあります。", "risk": "記載されている情報には、具体的な被害や影響は明示されていません。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Linux カーネルのブリッジ netfilter の ebt_snat.c に実装されている SNAT ターゲットで、ARP 送信元ハードウェアアドレスの書き換えオプションを使用すると影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "影響を受ける Git コミットは 63137bc5882a1882c553d389fdeeeace86ee1741 で、bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 未満のコミットまでです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "同様に、63137bc5882a1882c553d389fdeeeace86ee1741 から 76280b78cc9f23bdc6438e10ad6dff148ef8375b 未満、b7e91939ba9be805a62a257fa4e227dffbb88fa0 未満、afd64b59c3de9bbbdd3759e834fdc55cda716e0b 未満、153ea96c806aea395daba907a4f88480b6ad5093 未満、b18675263db1147c8e1cab625400c13a0d87bd2d 未満、c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 未満、67ba971ae02514d85818fe0c32549ab4bfa3bf49 未満のバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "セマンティックバージョンでの影響範囲は、5.4.73 以上 5.5 未満、5.8.17 以上 5.9 未満、5.9.2 以上 5.10 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "5.10 以降のカーネルは、5.10.259 以下、5.15.210 以下、6.1.176 以下、6.6.143 以下、6.12.94 以下、6.18.36 以下、7.0.13 以下のバージョンが影響を受けません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、76280b78cc9f23bdc6438e10ad6dff148ef8375b未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、b7e91939ba9be805a62a257fa4e227dffbb88fa0未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、afd64b59c3de9bbbdd3759e834fdc55cda716e0b未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、153ea96c806aea395daba907a4f88480b6ad5093未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、b18675263db1147c8e1cab625400c13a0d87bd2d未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、67ba971ae02514d85818fe0c32549ab4bfa3bf49未満。影響ありとして記載：2f3839075a5f8dcf116c1abe35b36b018ac62445。影響ありとして記載：51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b。影響ありとして記載：b7d23c2c87584eb429f115c078ed511be8b18e29。影響ありとして記載：5.4.73以上、5.5未満。影響ありとして記載：5.8.17以上、5.9未満。影響ありとして記載：5.9.2以上、5.10未満。対象のファイル：net/bridge/netfilter/ebt_snat.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：5.10。影響なしとして記載：5.10未満の版。影響なしとして記載：5.10.259以上、5.10.*以下。影響なしとして記載：5.15.210以上、5.15.*以下。影響なしとして記載：6.1.176以上、6.1.*以下。影響なしとして記載：6.6.143以上、6.6.*以下。影響なしとして記載：6.12.94以上、6.12.*以下。影響なしとして記載：6.18.36以上、6.18.*以下。影響なしとして記載：7.0.13以上、7.0.*以下。影響なしとして記載：7.1以上（原資料の上限表記は「*」）。対象のファイル：net/bridge/netfilter/ebt_snat.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53266", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5", "label": "CVE掲載の参考情報" }, { "url": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb->data:\n\n skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits().", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourceField": "/containers/cna/title", "excerpt": "netfilter: bridge: make ebt_snat ARP rewrite writable", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/bridge/netfilter/ebt_snat.c\"],\"versions\":[{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"76280b78cc9f23bdc6438e10ad6dff148ef8375b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"b7e91939ba9be805a62a257fa4e227dffbb88fa0\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"afd64b59c3de9bbbdd3759e834fdc55cda716e0b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"153ea96c806aea395daba907a4f88480b6ad5093\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"b18675263db1147c8e1cab625400c13a0d87bd2d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"63137bc5882a1882c553d389fdeeeace86ee1741\",\"lessThan\":\"67ba971ae02514d85818fe0c32549ab4bfa3bf49\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"2f3839075a5f8dcf116c1abe35b36b018ac62445\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"b7d23c2c87584eb429f115c078ed511be8b18e29\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"5.4.73\",\"lessThan\":\"5.5\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.8.17\",\"lessThan\":\"5.9\",\"status\":\"affected\",\"versionType\":\"semver\"},{\"version\":\"5.9.2\",\"lessThan\":\"5.10\",\"status\":\"affected\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53266.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/bridge/netfilter/ebt_snat.c\"],\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.94\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.36\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-53266\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-53266（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Linux カーネルのブリッジ netfilter の ebt_snat.c に実装されている SNAT ターゲットで、ARP 送信元ハードウェアアドレスの書き換えオプションを使用すると影響があります。\n・影響を受ける Git コミットは 63137bc5882a1882c553d389fdeeeace86ee1741 で、bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 未満のコミットまでです。\n・同様に、63137bc5882a1882c553d389fdeeeace86ee1741 から 76280b78cc9f23bdc6438e10ad6dff148ef8375b 未満、b7e91939ba9be805a62a257fa4e227dffbb88fa0 未満、afd64b59c3de9bbbdd3759e834fdc55cda716e0b 未満、153ea96c806aea395daba907a4f88480b6ad5093 未満、b18675263db1147c8e1cab625400c13a0d87bd2d 未満、c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 未満、67ba971ae02514d85818fe0c32549ab4bfa3bf49 未満のバージョンが影響を受けます。\n・セマンティックバージョンでの影響範囲は、5.4.73 以上 5.5 未満、5.8.17 以上 5.9 未満、5.9.2 以上 5.10 未満です。\n・5.10 以降のカーネルは、5.10.259 以下、5.15.210 以下、6.1.176 以下、6.6.143 以下、6.12.94 以下、6.18.36 以下、7.0.13 以下のバージョンが影響を受けません。\n・公式の対象表：Linux / Linux。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、76280b78cc9f23bdc6438e10ad6dff148ef8375b未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、b7e91939ba9be805a62a257fa4e227dffbb88fa0未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、afd64b59c3de9bbbdd3759e834fdc55cda716e0b未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、153ea96c806aea395daba907a4f88480b6ad5093未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、b18675263db1147c8e1cab625400c13a0d87bd2d未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5未満。影響ありとして記載：63137bc5882a1882c553d389fdeeeace86ee1741以上、67ba971ae02514d85818fe0c32549ab4bfa3bf49未満。影響ありとして記載：2f3839075a5f8dcf116c1abe35b36b018ac62445。影響ありとして記載：51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b。影響ありとして記載：b7d23c2c87584eb429f115c078ed511be8b18e29。影響ありとして記載：5.4.73以上、5.5未満。影響ありとして記載：5.8.17以上、5.9未満。影響ありとして記載：5.9.2以上、5.10未満。対象のファイル：net/bridge/netfilter/ebt_snat.c\n・公式の対象表：Linux / Linux。影響ありとして記載：5.10。影響なしとして記載：5.10未満の版。影響なしとして記載：5.10.259以上、5.10.*以下。影響なしとして記載：5.15.210以上、5.15.*以下。影響なしとして記載：6.1.176以上、6.1.*以下。影響なしとして記載：6.6.143以上、6.6.*以下。影響なしとして記載：6.12.94以上、6.12.*以下。影響なしとして記載：6.18.36以上、6.18.*以下。影響なしとして記載：7.0.13以上、7.0.*以下。影響なしとして記載：7.1以上（原資料の上限表記は「*」）。対象のファイル：net/bridge/netfilter/ebt_snat.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-53266", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.014Z", "lastSuccess": "2026-10-23T03:37:42.014Z", "sourceCheckedAt": "2026-10-23T02:43:49.420Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-58704", "aliases": [], "title": "Android：脆弱性情報", "summary": "Cellular Modem においてコードの論理エラーにより権限バイパスが可能となる欠陥があります。この欠陥を利用すると、追加の実行権限を必要とせずに、近接または隣接した場所からリモートで権限昇格が行われます。攻撃の実行にはユーザーの操作は不要です。", "risk": "権限が昇格される可能性があります。", "product": "Android", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Google_Devices", "cvssVector": null, "affected": [ { "product": "Android", "range": "Android kernel" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "label": "CVE：Google_Devices" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58704", "label": "CVE公式レコード" }, { "url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58704", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-15T18:34:37.966Z", "modifiedAt": "2026-10-07T18:14:21.429Z", "fetchedAt": "2026-10-23T02:43:49.682Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Android", "versions": [ { "version": "Android kernel", "status": "affected" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-58704", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "fetchedAt": "2026-10-23T02:43:49.682Z", "publishedAt": "2026-09-15T18:34:37.966Z", "modifiedAt": "2026-10-07T18:14:21.429Z", "state": "published", "provider": "Google_Devices", "title": "", "descriptions": [ { "lang": "en", "value": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Android", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "Android kernel", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Elevation of privilege", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "label": "Google_Devices", "tags": [], "provider": "Google_Devices", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58704", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Android\",\"versions\":[{\"version\":\"Android kernel\",\"status\":\"affected\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Elevation of privilege\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"ADJACENT_NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T18:14:21.429Z", "fetchedAt": "2026-10-23T02:43:49.682Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Androidに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:46.082Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ae5992931ec66c54293276683fd3bb50ee8200132127abb439dfb919f775ba38", "sourceModifiedAt": "2026-10-07T18:14:21.429Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cellular Modem においてコードの論理エラーにより権限バイパスが可能となる欠陥があります。この欠陥を利用すると、追加の実行権限を必要とせずに、近接または隣接した場所からリモートで権限昇格が行われます。攻撃の実行にはユーザーの操作は不要です。", "risk": "権限が昇格される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Android カーネルが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Google / Android。影響ありとして記載：Android kernel。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Android」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-58704", "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58704" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-58704", "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58704" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-58704", "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58704" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "label": "CVE：Google_Devices" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58704", "label": "CVE公式レコード" }, { "url": "https://source.android.com/docs/security/bulletin/pixel/2026/2026-09-01", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58704", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"Elevation of privilege\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58704.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Android\",\"versions\":[{\"version\":\"Android kernel\",\"status\":\"affected\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58704", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-58704\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-58704（Android）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Android カーネルが影響を受けます。\n・公式の対象表：Google / Android。影響ありとして記載：Android kernel。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-58704", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:46.082Z", "lastSuccess": "2026-10-23T03:21:46.082Z", "sourceCheckedAt": "2026-10-23T02:43:49.682Z", "errorCode": null }, "glossary": [ { "term": "権限昇格", "meaning": "本来その利用者には許可されていない、より強い権限で操作できるようになることです。必要な元の権限と、得られる権限を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/269.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-76460", "aliases": [], "title": "Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connector：認証の回避", "summary": "Cisco Identity Services Engine の API に認証制御が不十分で、認証されていないリモート攻撃者が認証を回避できる可能性があります。攻撃者は細工したリクエストを送信することで、この脆弱な API エンドポイントを利用し、ウェブベースの管理インターフェイスをバイパスしてデバイスに不正にアクセスできるようになります。", "risk": "攻撃が成功すると、攻撃者はウェブベースの管理インターフェイスをバイパスして、対象デバイスへ不正にアクセスできる可能性があります。", "product": "Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connector", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Identity Services Engine Software", "range": "3.1.0 p8" }, { "product": "Cisco Identity Services Engine Software", "range": "3.1.0 p9" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 2" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 1" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 3" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4.0" }, { "product": "Cisco Identity Services Engine Software", "range": "3.2.0 p7" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 4" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 1" }, { "product": "Cisco Identity Services Engine Software", "range": "3.1.0 p10" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 5" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 6" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 2" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 7" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 3" }, { "product": "Cisco Identity Services Engine Software", "range": "3.5.0" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 4" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 8" }, { "product": "Cisco Identity Services Engine Software", "range": "3.2 Patch 8" }, { "product": "Cisco Identity Services Engine Software", "range": "3.5 Patch 1" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 9" }, { "product": "Cisco Identity Services Engine Software", "range": "3.2 Patch 9" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 5" }, { "product": "Cisco Identity Services Engine Software", "range": "3.5 Patch 3" }, { "product": "Cisco Identity Services Engine Software", "range": "3.5 Patch 2" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 10" }, { "product": "Cisco Identity Services Engine Software", "range": "3.3 Patch 11" }, { "product": "Cisco Identity Services Engine Software", "range": "3.4 Patch 6" }, { "product": "Cisco Identity Services Engine Software", "range": "3.2 Patch 10" }, { "product": "Cisco Identity Services Engine Software", "range": "3.1.0 p11" }, { "product": "Cisco ISE Passive Identity Connector", "range": "3.4.0" }, { "product": "Cisco ISE Passive Identity Connector", "range": "3.5.0" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76460", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76460", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-16T20:12:02.131Z", "modifiedAt": "2026-10-07T18:27:47.551Z", "fetchedAt": "2026-10-23T02:43:50.855Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "sourceTitle": "Cisco Identity Services Engine Authentication Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "versions": [ { "version": "3.1.0 p8", "status": "affected" }, { "version": "3.1.0 p9", "status": "affected" }, { "version": "3.3 Patch 2", "status": "affected" }, { "version": "3.3 Patch 1", "status": "affected" }, { "version": "3.3 Patch 3", "status": "affected" }, { "version": "3.4.0", "status": "affected" }, { "version": "3.2.0 p7", "status": "affected" }, { "version": "3.3 Patch 4", "status": "affected" }, { "version": "3.4 Patch 1", "status": "affected" }, { "version": "3.1.0 p10", "status": "affected" }, { "version": "3.3 Patch 5", "status": "affected" }, { "version": "3.3 Patch 6", "status": "affected" }, { "version": "3.4 Patch 2", "status": "affected" }, { "version": "3.3 Patch 7", "status": "affected" }, { "version": "3.4 Patch 3", "status": "affected" }, { "version": "3.5.0", "status": "affected" }, { "version": "3.4 Patch 4", "status": "affected" }, { "version": "3.3 Patch 8", "status": "affected" }, { "version": "3.2 Patch 8", "status": "affected" }, { "version": "3.5 Patch 1", "status": "affected" }, { "version": "3.3 Patch 9", "status": "affected" }, { "version": "3.2 Patch 9", "status": "affected" }, { "version": "3.4 Patch 5", "status": "affected" }, { "version": "3.5 Patch 3", "status": "affected" }, { "version": "3.5 Patch 2", "status": "affected" }, { "version": "3.3 Patch 10", "status": "affected" }, { "version": "3.3 Patch 11", "status": "affected" }, { "version": "3.4 Patch 6", "status": "affected" }, { "version": "3.2 Patch 10", "status": "affected" }, { "version": "3.1.0 p11", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco ISE Passive Identity Connector", "versions": [ { "version": "3.4.0", "status": "affected" }, { "version": "3.5.0", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-76460", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "fetchedAt": "2026-10-23T02:43:50.855Z", "publishedAt": "2026-09-16T20:12:02.131Z", "modifiedAt": "2026-10-07T18:27:47.551Z", "state": "published", "provider": "cisco", "title": "Cisco Identity Services Engine Authentication Bypass Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Identity Services Engine Software", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "3.1.0 p8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "3.1.0 p9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "3.3 Patch 2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "3.3 Patch 1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "3.3 Patch 3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "3.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "3.2.0 p7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "3.3 Patch 4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "3.4 Patch 1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "3.1.0 p10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "3.3 Patch 5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "3.3 Patch 6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "3.4 Patch 2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "3.3 Patch 7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "3.4 Patch 3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "3.5.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "3.4 Patch 4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "3.3 Patch 8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "3.2 Patch 8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "3.5 Patch 1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "3.3 Patch 9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "3.2 Patch 9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "3.4 Patch 5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "3.5 Patch 3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "3.5 Patch 2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "3.3 Patch 10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "3.3 Patch 11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "3.4 Patch 6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "3.2 Patch 10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "3.1.0 p11", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco ISE Passive Identity Connector", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "3.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "3.5.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-648", "lang": "en", "description": "Incorrect Use of Privileged APIs", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "label": "cisco-sa-ISE-ABP-VNSW7Tn5", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76460", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Identity Services Engine Software\",\"versions\":[{\"version\":\"3.1.0 p8\",\"status\":\"affected\"},{\"version\":\"3.1.0 p9\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"status\":\"affected\"},{\"version\":\"3.2.0 p7\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 4\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.1.0 p10\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 5\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 6\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 7\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 4\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 8\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 8\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 9\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 9\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 5\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 10\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 11\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 6\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 10\",\"status\":\"affected\"},{\"version\":\"3.1.0 p11\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco ISE Passive Identity Connector\",\"versions\":[{\"version\":\"3.4.0\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Incorrect Use of Privileged APIs\",\"type\":\"cwe\",\"cweId\":\"CWE-648\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T18:27:47.551Z", "fetchedAt": "2026-10-23T02:43:50.855Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connectorに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:46.130Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "1ae3086c41d192c4b4c41b63ff21c679d3b2ea5dc22011533c40ca4f9318f26b", "sourceModifiedAt": "2026-10-07T18:27:47.551Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Identity Services Engine の API に認証制御が不十分で、認証されていないリモート攻撃者が認証を回避できる可能性があります。攻撃者は細工したリクエストを送信することで、この脆弱な API エンドポイントを利用し、ウェブベースの管理インターフェイスをバイパスしてデバイスに不正にアクセスできるようになります。", "risk": "攻撃が成功すると、攻撃者はウェブベースの管理インターフェイスをバイパスして、対象デバイスへ不正にアクセスできる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Identity Services Engine Software の以下のバージョンが影響を受けます: 3.1.0 p8, 3.1.0 p9, 3.3 Patch 2, 3.3 Patch 1, 3.3 Patch 3, 3.4.0, 3.2.0 p7, 3.3 Patch 4, 3.4 Patch 1, 3.1.0 p10, 3.3 Patch 5, 3.3 Patch 6, 3.4 Patch 2, 3.3 Patch 7, 3.4 Patch 3, 3.5.0, 3.4 Patch 4, 3.3 Patch 8, 3.2 Patch 8, 3.5 Patch 1, 3.3 Patch 9, 3.2 Patch 9, 3.4 Patch 5, 3.5 Patch 3, 3.5 Patch 2, 3.3 Patch 10, 3.3 Patch 11, 3.4 Patch 6, 3.2 Patch 10, 3.1.0 p11", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Cisco ISE Passive Identity Connector の以下のバージョンが影響を受けます: 3.4.0, 3.5.0", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Identity Services Engine Software。影響ありとして記載：3.1.0 p8。影響ありとして記載：3.1.0 p9。影響ありとして記載：3.3 Patch 2。影響ありとして記載：3.3 Patch 1。影響ありとして記載：3.3 Patch 3。影響ありとして記載：3.4.0。影響ありとして記載：3.2.0 p7。影響ありとして記載：3.3 Patch 4。影響ありとして記載：3.4 Patch 1。影響ありとして記載：3.1.0 p10。影響ありとして記載：3.3 Patch 5。影響ありとして記載：3.3 Patch 6。影響ありとして記載：3.4 Patch 2。影響ありとして記載：3.3 Patch 7。影響ありとして記載：3.4 Patch 3。影響ありとして記載：3.5.0。影響ありとして記載：3.4 Patch 4。影響ありとして記載：3.3 Patch 8。影響ありとして記載：3.2 Patch 8。影響ありとして記載：3.5 Patch 1。影響ありとして記載：3.3 Patch 9。影響ありとして記載：3.2 Patch 9。影響ありとして記載：3.4 Patch 5。影響ありとして記載：3.5 Patch 3。影響ありとして記載：3.5 Patch 2。影響ありとして記載：3.3 Patch 10。影響ありとして記載：3.3 Patch 11。影響ありとして記載：3.4 Patch 6。影響ありとして記載：3.2 Patch 10。影響ありとして記載：3.1.0 p11。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Cisco / Cisco ISE Passive Identity Connector。影響ありとして記載：3.4.0。影響ありとして記載：3.5.0。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connector」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-76460", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76460" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-76460", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76460" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-76460", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76460" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76460", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76460", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication.\r\n\r\nThis vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Identity Services Engine Authentication Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Identity Services Engine Software\",\"versions\":[{\"version\":\"3.1.0 p8\",\"status\":\"affected\"},{\"version\":\"3.1.0 p9\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.4.0\",\"status\":\"affected\"},{\"version\":\"3.2.0 p7\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 4\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.1.0 p10\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 5\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 6\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 7\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 4\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 8\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 8\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 1\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 9\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 9\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 5\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 3\",\"status\":\"affected\"},{\"version\":\"3.5 Patch 2\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 10\",\"status\":\"affected\"},{\"version\":\"3.3 Patch 11\",\"status\":\"affected\"},{\"version\":\"3.4 Patch 6\",\"status\":\"affected\"},{\"version\":\"3.2 Patch 10\",\"status\":\"affected\"},{\"version\":\"3.1.0 p11\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76460.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco ISE Passive Identity Connector\",\"versions\":[{\"version\":\"3.4.0\",\"status\":\"affected\"},{\"version\":\"3.5.0\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76460", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-76460\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-76460（Cisco Identity Services Engine Software / Cisco ISE Passive Identity Connector）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Identity Services Engine Software の以下のバージョンが影響を受けます: 3.1.0 p8, 3.1.0 p9, 3.3 Patch 2, 3.3 Patch 1, 3.3 Patch 3, 3.4.0, 3.2.0 p7, 3.3 Patch 4, 3.4 Patch 1, 3.1.0 p10, 3.3 Patch 5, 3.3 Patch 6, 3.4 Patch 2, 3.3 Patch 7, 3.4 Patch 3, 3.5.0, 3.4 Patch 4, 3.3 Patch 8, 3.2 Patch 8, 3.5 Patch 1, 3.3 Patch 9, 3.2 Patch 9, 3.4 Patch 5, 3.5 Patch 3, 3.5 Patch 2, 3.3 Patch 10, 3.3 Patch 11, 3.4 Patch 6, 3.2 Patch 10, 3.1.0 p11\n・Cisco ISE Passive Identity Connector の以下のバージョンが影響を受けます: 3.4.0, 3.5.0\n・公式の対象表：Cisco / Cisco Identity Services Engine Software。影響ありとして記載：3.1.0 p8。影響ありとして記載：3.1.0 p9。影響ありとして記載：3.3 Patch 2。影響ありとして記載：3.3 Patch 1。影響ありとして記載：3.3 Patch 3。影響ありとして記載：3.4.0。影響ありとして記載：3.2.0 p7。影響ありとして記載：3.3 Patch 4。影響ありとして記載：3.4 Patch 1。影響ありとして記載：3.1.0 p10。影響ありとして記載：3.3 Patch 5。影響ありとして記載：3.3 Patch 6。影響ありとして記載：3.4 Patch 2。影響ありとして記載：3.3 Patch 7。影響ありとして記載：3.4 Patch 3。影響ありとして記載：3.5.0。影響ありとして記載：3.4 Patch 4。影響ありとして記載：3.3 Patch 8。影響ありとして記載：3.2 Patch 8。影響ありとして記載：3.5 Patch 1。影響ありとして記載：3.3 Patch 9。影響ありとして記載：3.2 Patch 9。影響ありとして記載：3.4 Patch 5。影響ありとして記載：3.5 Patch 3。影響ありとして記載：3.5 Patch 2。影響ありとして記載：3.3 Patch 10。影響ありとして記載：3.3 Patch 11。影響ありとして記載：3.4 Patch 6。影響ありとして記載：3.2 Patch 10。影響ありとして記載：3.1.0 p11。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco ISE Passive Identity Connector。影響ありとして記載：3.4.0。影響ありとして記載：3.5.0。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-76460", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:46.130Z", "lastSuccess": "2026-10-23T03:21:46.130Z", "sourceCheckedAt": "2026-10-23T02:43:50.855Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-87886", "aliases": [], "title": "Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdmin：権限の奪取", "summary": "ローカル特権昇格が、ファイル権限が不適切であるために発生します。影響を受ける製品は、Linux 上の Acronis Backup plugin for cPanel & WHM（ビルド 1.9.3.1021 未満）、Acronis Backup extension for Plesk（ビルド 1.8.11.638 未満）、Acronis Backup plugin for DirectAdmin（ビルド 1.2.3.238 未満）です。", "risk": "攻撃者がローカルで特権ユーザーとして実行できるようになる可能性があります。", "product": "Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdmin", "category": "other", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.0", "cvssSource": "Acronis", "cvssVector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Acronis Backup plugin for cPanel & WHM", "range": ">= unspecified / < 1.9.3.1021（環境: Linux）" }, { "product": "Acronis Backup extension for Plesk", "range": ">= unspecified / < 1.8.11.638（環境: Linux）" }, { "product": "Acronis Backup plugin for DirectAdmin", "range": ">= unspecified / < 1.2.3.238（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "label": "CVE：Acronis" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87886", "label": "CVE公式レコード" }, { "url": "https://security-advisory.acronis.com/advisories/SEC-10986", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87886", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-17T22:57:18.089Z", "modifiedAt": "2026-09-18T14:33:42.532Z", "fetchedAt": "2026-10-23T02:43:51.756Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Acronis", "product": "Acronis Backup plugin for cPanel & WHM", "platforms": [ "Linux" ], "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "1.9.3.1021", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "Acronis", "product": "Acronis Backup extension for Plesk", "platforms": [ "Linux" ], "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "1.8.11.638", "versionType": "semver" } ], "defaultStatus": "unaffected" }, { "vendor": "Acronis", "product": "Acronis Backup plugin for DirectAdmin", "platforms": [ "Linux" ], "versions": [ { "version": "unspecified", "status": "affected", "lessThan": "1.2.3.238", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-87886", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "fetchedAt": "2026-10-23T02:43:51.756Z", "publishedAt": "2026-09-17T22:57:18.089Z", "modifiedAt": "2026-09-18T14:33:42.532Z", "state": "published", "provider": "Acronis", "title": "", "descriptions": [ { "lang": "en", "value": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Acronis", "product": "Acronis Backup plugin for cPanel & WHM", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "unspecified", "lessThan": "1.9.3.1021", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Acronis", "product": "Acronis Backup extension for Plesk", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "unspecified", "lessThan": "1.8.11.638", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Acronis", "product": "Acronis Backup plugin for DirectAdmin", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "unspecified", "lessThan": "1.2.3.238", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-276", "lang": "en", "description": "CWE-276", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.0", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "Acronis", "sourcePath": "/containers/cna/metrics/0/cvssV3_0" } ], "references": [ { "url": "https://security-advisory.acronis.com/advisories/SEC-10986", "label": "SEC-10986", "tags": [ "vendor-advisory" ], "provider": "Acronis", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87886", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for cPanel & WHM\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.9.3.1021\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup extension for Plesk\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.8.11.638\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for DirectAdmin\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.2.3.238\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-276\",\"description\":\"CWE-276\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-18T14:33:42.532Z", "fetchedAt": "2026-10-23T02:43:51.756Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdminに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:47.191Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "802dc57f628059ade85dd8355a06898b289b5e0cd21946d596e221e407db178c", "sourceModifiedAt": "2026-09-18T14:33:42.532Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ローカル特権昇格が、ファイル権限が不適切であるために発生します。影響を受ける製品は、Linux 上の Acronis Backup plugin for cPanel & WHM（ビルド 1.9.3.1021 未満）、Acronis Backup extension for Plesk（ビルド 1.8.11.638 未満）、Acronis Backup plugin for DirectAdmin（ビルド 1.2.3.238 未満）です。", "risk": "攻撃者がローカルで特権ユーザーとして実行できるようになる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Acronis Backup plugin for cPanel & WHM（Linux）で、ビルド 1.9.3.1021 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E2" ] }, { "text": "Acronis Backup extension for Plesk（Linux）で、ビルド 1.8.11.638 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E3" ] }, { "text": "Acronis Backup plugin for DirectAdmin（Linux）で、ビルド 1.2.3.238 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Acronis / Acronis Backup plugin for cPanel & WHM。影響ありとして記載：1.9.3.1021未満（原資料では開始版が未指定）。対象の環境：Linux", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Acronis / Acronis Backup extension for Plesk。影響ありとして記載：1.8.11.638未満（原資料では開始版が未指定）。対象の環境：Linux", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Acronis / Acronis Backup plugin for DirectAdmin。影響ありとして記載：1.2.3.238未満（原資料では開始版が未指定）。対象の環境：Linux", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdmin」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87886", "https://security-advisory.acronis.com/advisories/SEC-10986", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87886" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-87886", "https://security-advisory.acronis.com/advisories/SEC-10986", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87886" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87886", "https://security-advisory.acronis.com/advisories/SEC-10986", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87886" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "label": "CVE：Acronis" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87886", "label": "CVE公式レコード" }, { "url": "https://security-advisory.acronis.com/advisories/SEC-10986", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87886", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for cPanel & WHM\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.9.3.1021\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup extension for Plesk\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.8.11.638\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87886.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Acronis\",\"product\":\"Acronis Backup plugin for DirectAdmin\",\"platforms\":[\"Linux\"],\"versions\":[{\"version\":\"unspecified\",\"status\":\"affected\",\"lessThan\":\"1.2.3.238\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87886", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-87886\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-87886（Acronis Backup plugin for cPanel & WHM / Acronis Backup extension for Plesk / Acronis Backup plugin for DirectAdmin）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Acronis Backup plugin for cPanel & WHM（Linux）で、ビルド 1.9.3.1021 未満は影響を受けます。\n・Acronis Backup extension for Plesk（Linux）で、ビルド 1.8.11.638 未満は影響を受けます。\n・Acronis Backup plugin for DirectAdmin（Linux）で、ビルド 1.2.3.238 未満は影響を受けます。\n・公式の対象表：Acronis / Acronis Backup plugin for cPanel & WHM。影響ありとして記載：1.9.3.1021未満（原資料では開始版が未指定）。対象の環境：Linux\n・公式の対象表：Acronis / Acronis Backup extension for Plesk。影響ありとして記載：1.8.11.638未満（原資料では開始版が未指定）。対象の環境：Linux\n・公式の対象表：Acronis / Acronis Backup plugin for DirectAdmin。影響ありとして記載：1.2.3.238未満（原資料では開始版が未指定）。対象の環境：Linux\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-87886", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:47.191Z", "lastSuccess": "2026-10-23T03:21:47.191Z", "sourceCheckedAt": "2026-10-23T02:43:51.756Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-76461", "aliases": [], "title": "Cisco Secure Email：データベースへの不正操作", "summary": "Cisco Secure Email Gateway のメール解析ロジックに不十分な検証があり、認証されていないリモート攻撃者が細工したメールに悪意のある SQL 文を含めて送信すると、ルート権限で任意のコマンドを実行できる可能性があります。", "risk": "攻撃者がシステム上でルート権限のコマンドを実行できるため、サーバー全体が制御下に置かれる恐れがあります。", "product": "Cisco Secure Email", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Cisco Secure Email", "range": "14.0.0-698" }, { "product": "Cisco Secure Email", "range": "13.5.1-277" }, { "product": "Cisco Secure Email", "range": "13.0.0-392" }, { "product": "Cisco Secure Email", "range": "14.2.0-620" }, { "product": "Cisco Secure Email", "range": "13.0.5-007" }, { "product": "Cisco Secure Email", "range": "13.5.4-038" }, { "product": "Cisco Secure Email", "range": "14.2.1-020" }, { "product": "Cisco Secure Email", "range": "14.3.0-032" }, { "product": "Cisco Secure Email", "range": "15.0.0-104" }, { "product": "Cisco Secure Email", "range": "15.0.1-030" }, { "product": "Cisco Secure Email", "range": "15.5.0-048" }, { "product": "Cisco Secure Email", "range": "15.5.1-055" }, { "product": "Cisco Secure Email", "range": "15.5.2-018" }, { "product": "Cisco Secure Email", "range": "16.0.0-050" }, { "product": "Cisco Secure Email", "range": "15.0.3-002" }, { "product": "Cisco Secure Email", "range": "16.0.0-054" }, { "product": "Cisco Secure Email", "range": "15.5.3-022" }, { "product": "Cisco Secure Email", "range": "16.0.1-017" }, { "product": "Cisco Secure Email", "range": "15.5.4-012" }, { "product": "Cisco Secure Email", "range": "16.0.4-016" }, { "product": "Cisco Secure Email", "range": "15.0.5-016" }, { "product": "Cisco Secure Email", "range": "16.0.2-112" }, { "product": "Cisco Secure Email", "range": "16.0.3-044" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76461", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-14T16:09:07.839Z", "modifiedAt": "2026-09-18T12:10:27.392Z", "fetchedAt": "2026-10-23T02:43:50.892Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.", "sourceTitle": "Cisco Secure Email Gateway SQL Injection Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Secure Email", "versions": [ { "version": "14.0.0-698", "status": "affected" }, { "version": "13.5.1-277", "status": "affected" }, { "version": "13.0.0-392", "status": "affected" }, { "version": "14.2.0-620", "status": "affected" }, { "version": "13.0.5-007", "status": "affected" }, { "version": "13.5.4-038", "status": "affected" }, { "version": "14.2.1-020", "status": "affected" }, { "version": "14.3.0-032", "status": "affected" }, { "version": "15.0.0-104", "status": "affected" }, { "version": "15.0.1-030", "status": "affected" }, { "version": "15.5.0-048", "status": "affected" }, { "version": "15.5.1-055", "status": "affected" }, { "version": "15.5.2-018", "status": "affected" }, { "version": "16.0.0-050", "status": "affected" }, { "version": "15.0.3-002", "status": "affected" }, { "version": "16.0.0-054", "status": "affected" }, { "version": "15.5.3-022", "status": "affected" }, { "version": "16.0.1-017", "status": "affected" }, { "version": "15.5.4-012", "status": "affected" }, { "version": "16.0.4-016", "status": "affected" }, { "version": "15.0.5-016", "status": "affected" }, { "version": "16.0.2-112", "status": "affected" }, { "version": "16.0.3-044", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-76461", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "fetchedAt": "2026-10-23T02:43:50.892Z", "publishedAt": "2026-09-14T16:09:07.839Z", "modifiedAt": "2026-09-18T12:10:27.392Z", "state": "published", "provider": "cisco", "title": "Cisco Secure Email Gateway SQL Injection Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Secure Email", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.0.0-698", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.5.1-277", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "13.0.0-392", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "14.2.0-620", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "13.0.5-007", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "13.5.4-038", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "14.2.1-020", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "14.3.0-032", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "15.0.0-104", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "15.0.1-030", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "15.5.0-048", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "15.5.1-055", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "15.5.2-018", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "16.0.0-050", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "15.0.3-002", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "16.0.0-054", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "15.5.3-022", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "16.0.1-017", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "15.5.4-012", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "16.0.4-016", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "15.0.5-016", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "16.0.2-112", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "16.0.3-044", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "label": "cisco-sa-esa-inj-2bLVGmhX", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-76461", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email\",\"versions\":[{\"version\":\"14.0.0-698\",\"status\":\"affected\"},{\"version\":\"13.5.1-277\",\"status\":\"affected\"},{\"version\":\"13.0.0-392\",\"status\":\"affected\"},{\"version\":\"14.2.0-620\",\"status\":\"affected\"},{\"version\":\"13.0.5-007\",\"status\":\"affected\"},{\"version\":\"13.5.4-038\",\"status\":\"affected\"},{\"version\":\"14.2.1-020\",\"status\":\"affected\"},{\"version\":\"14.3.0-032\",\"status\":\"affected\"},{\"version\":\"15.0.0-104\",\"status\":\"affected\"},{\"version\":\"15.0.1-030\",\"status\":\"affected\"},{\"version\":\"15.5.0-048\",\"status\":\"affected\"},{\"version\":\"15.5.1-055\",\"status\":\"affected\"},{\"version\":\"15.5.2-018\",\"status\":\"affected\"},{\"version\":\"16.0.0-050\",\"status\":\"affected\"},{\"version\":\"15.0.3-002\",\"status\":\"affected\"},{\"version\":\"16.0.0-054\",\"status\":\"affected\"},{\"version\":\"15.5.3-022\",\"status\":\"affected\"},{\"version\":\"16.0.1-017\",\"status\":\"affected\"},{\"version\":\"15.5.4-012\",\"status\":\"affected\"},{\"version\":\"16.0.4-016\",\"status\":\"affected\"},{\"version\":\"15.0.5-016\",\"status\":\"affected\"},{\"version\":\"16.0.2-112\",\"status\":\"affected\"},{\"version\":\"16.0.3-044\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"type\":\"cwe\",\"cweId\":\"CWE-89\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-18T12:10:27.392Z", "fetchedAt": "2026-10-23T02:43:50.892Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-14T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Cisco Secure Emailにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:48.884Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5b43715599ea764aafd30734f1577d24123ac4f83e79d294c47b16aad0d23fb9", "sourceModifiedAt": "2026-09-18T12:10:27.392Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Secure Email Gateway のメール解析ロジックに不十分な検証があり、認証されていないリモート攻撃者が細工したメールに悪意のある SQL 文を含めて送信すると、ルート権限で任意のコマンドを実行できる可能性があります。", "risk": "攻撃者がシステム上でルート権限のコマンドを実行できるため、サーバー全体が制御下に置かれる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるバージョンは、14.0.0-698、13.5.1-277、13.0.0-392、14.2.0-620、13.0.5-007、13.5.4-038、14.2.1-020、14.3.0-032、15.0.0-104、15.0.1-030、15.5.0-048、15.5.1-055、15.5.2-018、16.0.0-050、15.0.3-002、16.0.0-054、15.5.3-022、16.0.1-017、15.5.4-012、16.0.4-016、15.0.5-016、16.0.2-112、16.0.3-044 のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "未認証のリモート攻撃者が、Cisco AsyncOS ソフトウェア上の Cisco Secure Email Gateway に対して細工したメールを送信できる環境が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Email。影響ありとして記載：14.0.0-698。影響ありとして記載：13.5.1-277。影響ありとして記載：13.0.0-392。影響ありとして記載：14.2.0-620。影響ありとして記載：13.0.5-007。影響ありとして記載：13.5.4-038。影響ありとして記載：14.2.1-020。影響ありとして記載：14.3.0-032。影響ありとして記載：15.0.0-104。影響ありとして記載：15.0.1-030。影響ありとして記載：15.5.0-048。影響ありとして記載：15.5.1-055。影響ありとして記載：15.5.2-018。影響ありとして記載：16.0.0-050。影響ありとして記載：15.0.3-002。影響ありとして記載：16.0.0-054。影響ありとして記載：15.5.3-022。影響ありとして記載：16.0.1-017。影響ありとして記載：15.5.4-012。影響ありとして記載：16.0.4-016。影響ありとして記載：15.0.5-016。影響ありとして記載：16.0.2-112。影響ありとして記載：16.0.3-044。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Secure Email」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-76461", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76461" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-76461", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76461" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-76461", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-76461" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76461", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.\r\n\r\nThis vulnerability is due to insufficient validation in the email parsing logic. An attacker could exploit this vulnerability by sending a crafted email message that contains malicious SQL statements through an affected device. A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Secure Email Gateway SQL Injection Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/76xxx/CVE-2026-76461.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Email\",\"versions\":[{\"version\":\"14.0.0-698\",\"status\":\"affected\"},{\"version\":\"13.5.1-277\",\"status\":\"affected\"},{\"version\":\"13.0.0-392\",\"status\":\"affected\"},{\"version\":\"14.2.0-620\",\"status\":\"affected\"},{\"version\":\"13.0.5-007\",\"status\":\"affected\"},{\"version\":\"13.5.4-038\",\"status\":\"affected\"},{\"version\":\"14.2.1-020\",\"status\":\"affected\"},{\"version\":\"14.3.0-032\",\"status\":\"affected\"},{\"version\":\"15.0.0-104\",\"status\":\"affected\"},{\"version\":\"15.0.1-030\",\"status\":\"affected\"},{\"version\":\"15.5.0-048\",\"status\":\"affected\"},{\"version\":\"15.5.1-055\",\"status\":\"affected\"},{\"version\":\"15.5.2-018\",\"status\":\"affected\"},{\"version\":\"16.0.0-050\",\"status\":\"affected\"},{\"version\":\"15.0.3-002\",\"status\":\"affected\"},{\"version\":\"16.0.0-054\",\"status\":\"affected\"},{\"version\":\"15.5.3-022\",\"status\":\"affected\"},{\"version\":\"16.0.1-017\",\"status\":\"affected\"},{\"version\":\"15.5.4-012\",\"status\":\"affected\"},{\"version\":\"16.0.4-016\",\"status\":\"affected\"},{\"version\":\"15.0.5-016\",\"status\":\"affected\"},{\"version\":\"16.0.2-112\",\"status\":\"affected\"},{\"version\":\"16.0.3-044\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-76461", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-76461\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-76461（Cisco Secure Email）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるバージョンは、14.0.0-698、13.5.1-277、13.0.0-392、14.2.0-620、13.0.5-007、13.5.4-038、14.2.1-020、14.3.0-032、15.0.0-104、15.0.1-030、15.5.0-048、15.5.1-055、15.5.2-018、16.0.0-050、15.0.3-002、16.0.0-054、15.5.3-022、16.0.1-017、15.5.4-012、16.0.4-016、15.0.5-016、16.0.2-112、16.0.3-044 のすべてのバージョンが影響を受けます。\n・未認証のリモート攻撃者が、Cisco AsyncOS ソフトウェア上の Cisco Secure Email Gateway に対して細工したメールを送信できる環境が対象です。\n・公式の対象表：Cisco / Cisco Secure Email。影響ありとして記載：14.0.0-698。影響ありとして記載：13.5.1-277。影響ありとして記載：13.0.0-392。影響ありとして記載：14.2.0-620。影響ありとして記載：13.0.5-007。影響ありとして記載：13.5.4-038。影響ありとして記載：14.2.1-020。影響ありとして記載：14.3.0-032。影響ありとして記載：15.0.0-104。影響ありとして記載：15.0.1-030。影響ありとして記載：15.5.0-048。影響ありとして記載：15.5.1-055。影響ありとして記載：15.5.2-018。影響ありとして記載：16.0.0-050。影響ありとして記載：15.0.3-002。影響ありとして記載：16.0.0-054。影響ありとして記載：15.5.3-022。影響ありとして記載：16.0.1-017。影響ありとして記載：15.5.4-012。影響ありとして記載：16.0.4-016。影響ありとして記載：15.0.5-016。影響ありとして記載：16.0.2-112。影響ありとして記載：16.0.3-044。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-76461", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:48.884Z", "lastSuccess": "2026-10-23T03:21:48.884Z", "sourceCheckedAt": "2026-10-23T02:43:50.892Z", "errorCode": null }, "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-42016", "aliases": [], "title": "artifactory：権限の奪取", "summary": "JFrog Artifactory のユーザートークンの認可検証が正しく行われず、トークンの署名や発行者は確認するもののトークンのスコープが検証されないため、特権昇格が可能になる。", "risk": "攻撃者が自分の権限を上げて、管理者レベルの操作ができる可能性がある。", "product": "artifactory", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "JFROG", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "affected": [ { "product": "artifactory", "range": "< 7.133.11" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42016", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42016", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-27T19:20:56.352Z", "modifiedAt": "2026-09-12T03:55:20.650Z", "fetchedAt": "2026-10-23T02:43:48.851Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.", "sourceTitle": "Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "jfrog", "product": "artifactory", "versions": [ { "status": "affected", "version": "0", "lessThan": "7.133.11", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-42016", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "fetchedAt": "2026-10-23T02:43:48.851Z", "publishedAt": "2026-07-27T19:20:56.352Z", "modifiedAt": "2026-09-12T03:55:20.650Z", "state": "published", "provider": "JFROG", "title": "Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation", "descriptions": [ { "lang": "en", "value": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "jfrog", "product": "artifactory", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.133.11", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "JFROG", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/0" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42016", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.133.11\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-863\",\"description\":\"CWE-863 Incorrect Authorization\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.1,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-12T03:55:20.650Z", "fetchedAt": "2026-10-23T02:43:48.851Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-11T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "artifactoryに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:49.852Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b4c672084ce42b3c4f4543b6207d5cdf79c90e341e9c5f9106119cb559a6ca68", "sourceModifiedAt": "2026-09-12T03:55:20.650Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "JFrog Artifactory のユーザートークンの認可検証が正しく行われず、トークンの署名や発行者は確認するもののトークンのスコープが検証されないため、特権昇格が可能になる。", "risk": "攻撃者が自分の権限を上げて、管理者レベルの操作ができる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "JFrog Artifactory（セルフホスト） のバージョン 7.133.11 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "トークンの署名や発行者は検証されるが、トークンのスコープが検証されないため、特権昇格攻撃が可能になる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：jfrog / artifactory。影響ありとして記載：7.133.11未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E3" ] }, { "text": "「artifactory」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42016", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42016" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-42016", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42016" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42016", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42016" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42016", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42016", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourceField": "/containers/cna/title", "excerpt": "Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42016.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.133.11\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42016", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-42016\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-42016（artifactory）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・JFrog Artifactory（セルフホスト） のバージョン 7.133.11 未満が影響を受ける。\n・トークンの署名や発行者は検証されるが、トークンのスコープが検証されないため、特権昇格攻撃が可能になる。\n・公式の対象表：jfrog / artifactory。影響ありとして記載：7.133.11未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-42016", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:49.852Z", "lastSuccess": "2026-10-23T03:21:49.852Z", "sourceCheckedAt": "2026-10-23T02:43:48.851Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-42018", "aliases": [], "title": "artifactory：脆弱性情報", "summary": "JFrog Artifactory は、匿名アクセスが無効化されている場合でも、認証されていない呼び出し元に内部の匿名ユーザートークンを返す可能性があり、機密リソースが漏洩する恐れがあります。", "risk": "機密リソースが外部に漏洩する可能性があります。", "product": "artifactory", "category": "other", "component": "package", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "JFROG", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "artifactory", "range": "< 7.111.20" }, { "product": "artifactory", "range": ">= 7.117.0 / < 7.117.27" }, { "product": "artifactory", "range": ">= 7.125.0 / < 7.125.19" }, { "product": "artifactory", "range": ">= 7.133.0 / < 7.133.28" }, { "product": "artifactory", "range": ">= 7.146.0 / < 7.146.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42018", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42018", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-12T17:43:21.289Z", "modifiedAt": "2026-10-01T18:06:26.138Z", "fetchedAt": "2026-10-23T02:43:48.876Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "sourceTitle": "Anonymous user token generation exposure in JFrog Artifactory", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "jfrog", "product": "artifactory", "versions": [ { "status": "affected", "version": "0", "lessThan": "7.111.20", "versionType": "custom" }, { "status": "affected", "version": "7.117.0", "lessThan": "7.117.27", "versionType": "custom" }, { "status": "affected", "version": "7.125.0", "lessThan": "7.125.19", "versionType": "custom" }, { "status": "affected", "version": "7.133.0", "lessThan": "7.133.28", "versionType": "custom" }, { "status": "affected", "version": "7.146.0", "lessThan": "7.146.8", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-42018", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "fetchedAt": "2026-10-23T02:43:48.876Z", "publishedAt": "2026-08-12T17:43:21.289Z", "modifiedAt": "2026-10-01T18:06:26.138Z", "state": "published", "provider": "JFROG", "title": "Anonymous user token generation exposure in JFrog Artifactory", "descriptions": [ { "lang": "en", "value": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "jfrog", "product": "artifactory", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.111.20", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.117.0", "lessThan": "7.117.27", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.125.0", "lessThan": "7.125.19", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.133.0", "lessThan": "7.133.28", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "7.146.0", "lessThan": "7.146.8", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "JFROG", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/0" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.111.20\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.117.0\",\"lessThan\":\"7.117.27\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.125.0\",\"lessThan\":\"7.125.19\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.133.0\",\"lessThan\":\"7.133.28\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.146.0\",\"lessThan\":\"7.146.8\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-287\",\"description\":\"CWE-287 Improper Authentication\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.5,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T18:06:26.138Z", "fetchedAt": "2026-10-23T02:43:48.876Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-11T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "artifactoryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:51.185Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "27556fc1b7c1ac8548205175d294d6df9b6316c21e8a836482ae0b6bca1b9949", "sourceModifiedAt": "2026-10-01T18:06:26.138Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "JFrog Artifactory は、匿名アクセスが無効化されている場合でも、認証されていない呼び出し元に内部の匿名ユーザートークンを返す可能性があり、機密リソースが漏洩する恐れがあります。", "risk": "機密リソースが外部に漏洩する可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "匿名アクセスが無効化されている環境で、認証されていない呼び出し元が内部の匿名ユーザートークンを取得できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "7.111.20 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "7.117.0 以上 7.117.27 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "7.125.0 以上 7.125.19 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "7.133.0 以上 7.133.28 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "7.146.0 以上 7.146.8 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：jfrog / artifactory。影響ありとして記載：7.111.20未満の版。影響ありとして記載：7.117.0以上、7.117.27未満。影響ありとして記載：7.125.0以上、7.125.19未満。影響ありとして記載：7.133.0以上、7.133.28未満。影響ありとして記載：7.146.0以上、7.146.8未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3" ] }, { "text": "「artifactory」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42018", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42018" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-42018", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42018" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-42018", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-42018" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42018", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42018", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourceField": "/containers/cna/title", "excerpt": "Anonymous user token generation exposure in JFrog Artifactory", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/42xxx/CVE-2026-42018.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.111.20\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.117.0\",\"lessThan\":\"7.117.27\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.125.0\",\"lessThan\":\"7.125.19\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.133.0\",\"lessThan\":\"7.133.28\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.146.0\",\"lessThan\":\"7.146.8\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-42018", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-42018\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-42018（artifactory）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・匿名アクセスが無効化されている環境で、認証されていない呼び出し元が内部の匿名ユーザートークンを取得できる。\n・7.111.20 未満のバージョンは影響を受けます。\n・7.117.0 以上 7.117.27 未満のバージョンは影響を受けます。\n・7.125.0 以上 7.125.19 未満のバージョンは影響を受けます。\n・7.133.0 以上 7.133.28 未満のバージョンは影響を受けます。\n・7.146.0 以上 7.146.8 未満のバージョンは影響を受けます。\n・公式の対象表：jfrog / artifactory。影響ありとして記載：7.111.20未満の版。影響ありとして記載：7.117.0以上、7.117.27未満。影響ありとして記載：7.125.0以上、7.125.19未満。影響ありとして記載：7.133.0以上、7.133.28未満。影響ありとして記載：7.146.0以上、7.146.8未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-42018", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:51.185Z", "lastSuccess": "2026-10-23T03:21:51.185Z", "sourceCheckedAt": "2026-10-23T02:43:48.876Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-84869", "aliases": [], "title": "ScreenConnect：脆弱性情報", "summary": "ScreenConnect クライアントで、ゲストからホストへのファイル転送操作を通じてファイルが実行される可能性があります。", "risk": "攻撃者がリモートセッション中にファイルを転送し、ホスト側で承認や確認なしに実行できる恐れがあります。", "product": "ScreenConnect", "category": "other", "component": "package", "severity": "critical", "cvss": 9.9, "cvssVersion": "3.1", "cvssSource": "ConnectWise", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "ScreenConnect", "range": "All versions prior to 26.6.5" } ], "fixed": [], "steps": [ "クラウド環境では最新リリースに更新し、ホストクライアントとアクセスエージェントを再インストールしてください。オンプレミス環境では ScreenConnect クライアントをバージョン 26.6.5 以降にアップグレードしてください。Automate 統合環境では、Automate Assurance サブスクリプションが有効な場合に 26.6.5 アップデートを適用してください。", "「CVE-2026-84869」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "label": "CVE：ConnectWise" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-84869", "label": "CVE公式レコード" }, { "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "label": "CISAが示す関連情報" }, { "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "label": "CVE掲載の参考情報" }, { "url": "https://www.connectwise.com/company/trust/advisories", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-08T19:29:33.630Z", "modifiedAt": "2026-09-12T03:55:19.450Z", "fetchedAt": "2026-10-23T02:43:51.313Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "sourceTitle": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "ConnectWise", "product": "ScreenConnect", "versions": [ { "status": "affected", "version": "All versions prior to 26.6.5" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-84869", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "fetchedAt": "2026-10-23T02:43:51.313Z", "publishedAt": "2026-09-08T19:29:33.630Z", "modifiedAt": "2026-09-12T03:55:19.450Z", "state": "published", "provider": "ConnectWise", "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions", "descriptions": [ { "lang": "en", "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "ConnectWise", "product": "ScreenConnect", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "All versions prior to 26.6.5", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Cloud: Updated to the latest release. We recommend that\npartners reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client and update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem: Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments: Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n * Navigate to the Administration > Security > Roles section. \n * Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n * Save\nyour changes. Repeat for each role.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "provider": "ConnectWise", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "label": "ConnectWise", "tags": [], "provider": "ConnectWise", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "label": "ConnectWise", "tags": [], "provider": "ConnectWise", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.connectwise.com/company/trust/advisories", "label": "ConnectWise", "tags": [], "provider": "ConnectWise", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.huntress.com/blog/rogue-screenconnect-installations", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"ConnectWise\",\"product\":\"ScreenConnect\",\"versions\":[{\"status\":\"affected\",\"version\":\"All versions prior to 26.6.5\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Cloud: Updated to the latest release. We recommend that\npartners reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client and update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem: Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments: Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n * Navigate to the Administration > Security > Roles section. \n * Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n * Save\nyour changes. Repeat for each role.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-862\",\"description\":\"CWE-862 Missing Authorization\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-269\",\"description\":\"CWE-269 Improper Privilege Management\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.9,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-12T03:55:19.450Z", "fetchedAt": "2026-10-23T02:43:51.313Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-11T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "ScreenConnectに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:53.804Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "38fc150b477398b1706eab1c13b0047282a0cef208ddf1fe2a9bd65e678147f0", "sourceModifiedAt": "2026-09-12T03:55:19.450Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ScreenConnect クライアントで、ゲストからホストへのファイル転送操作を通じてファイルが実行される可能性があります。", "risk": "攻撃者がリモートセッション中にファイルを転送し、ホスト側で承認や確認なしに実行できる恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "ScreenConnect クライアントの条件により、アクティブなリモートセッション中にファイルが転送され、ホスト側の承認や確認がなくても実行されることがあります。ScreenConnect サーバーは影響を受けません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ScreenConnect」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-84869", "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "https://www.connectwise.com/company/trust/advisories", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-84869" ] } ], "actions": [ { "text": "クラウド環境では最新リリースに更新し、ホストクライアントとアクセスエージェントを再インストールしてください。オンプレミス環境では ScreenConnect クライアントをバージョン 26.6.5 以降にアップグレードしてください。Automate 統合環境では、Automate Assurance サブスクリプションが有効な場合に 26.6.5 アップデートを適用してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2026-84869」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-84869", "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "https://www.connectwise.com/company/trust/advisories", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-84869" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-84869", "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "https://www.connectwise.com/company/trust/advisories", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-84869" ] } ], "temporaryMitigations": [ { "text": "すぐにアップデートできない場合は、管理画面の「Administration > Security > Roles」へ移動し、各ロールのセッショングループで「TransferFiles」権限が選択されている場合はチェックを外して保存してください。これをすべてのロールで繰り返します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-84869", "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "https://www.connectwise.com/company/trust/advisories", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-84869" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "label": "CVE：ConnectWise" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-84869", "label": "CVE公式レコード" }, { "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "label": "CISAが示す関連情報" }, { "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "label": "CVE掲載の参考情報" }, { "url": "https://www.connectwise.com/company/trust/advisories", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourceField": "/containers/cna/title", "excerpt": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"ConnectWise\",\"product\":\"ScreenConnect\",\"versions\":[{\"status\":\"affected\",\"version\":\"All versions prior to 26.6.5\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Cloud: Updated to the latest release. We recommend that\npartners reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client and update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem: Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments: Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84869.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n * Navigate to the Administration > Security > Roles section. \n * Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n * Save\nyour changes. Repeat for each role.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-84869\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-84869（ScreenConnect）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ScreenConnect クライアントの条件により、アクティブなリモートセッション中にファイルが転送され、ホスト側の承認や確認がなくても実行されることがあります。ScreenConnect サーバーは影響を受けません。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-84869", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:53.804Z", "lastSuccess": "2026-10-23T03:21:53.804Z", "sourceCheckedAt": "2026-10-23T02:43:51.313Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-85706", "aliases": [], "title": "GitLab：ファイルへの不正アクセス", "summary": "GitLab CE/EE のバージョン 18.7 から 18.11.12 未満、19.0 から 19.0.9 未満、19.1 から 19.1.8 未満、19.2 から 19.2.6 未満、19.3 から 19.3.2 未満において、特定の条件下で認証されていないユーザーがリポジトリコミット API のパス制限ミスと認証チェック欠如により、GitLab サーバー上の任意のファイルを読み取れる可能性があります。", "risk": "認証されていないユーザーが任意のファイルを読み取れる可能性があります。", "product": "GitLab", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "GitLab", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "affected": [ { "product": "GitLab", "range": ">= 18.7 / < 18.11.12" }, { "product": "GitLab", "range": ">= 19.0 / < 19.0.9" }, { "product": "GitLab", "range": ">= 19.1 / < 19.1.8" }, { "product": "GitLab", "range": ">= 19.2 / < 19.2.6" }, { "product": "GitLab", "range": ">= 19.3 / < 19.3.2" } ], "fixed": [], "steps": [ "バージョン 18.11.12、19.0.9、19.1.8、19.2.6、19.3.2 以上にアップグレードしてください。", "「CVE-2026-85706」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "label": "CVE：GitLab" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85706", "label": "CVE公式レコード" }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/3909881", "label": "HackerOne Bug Bounty Report #3909881" }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85706", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-12T02:46:31.624Z", "modifiedAt": "2026-09-23T21:03:18.163Z", "fetchedAt": "2026-10-23T02:43:51.491Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "sourceTitle": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [ { "lessThan": "18.11.12", "status": "affected", "version": "18.7", "versionType": "semver" }, { "lessThan": "19.0.9", "status": "affected", "version": "19.0", "versionType": "semver" }, { "lessThan": "19.1.8", "status": "affected", "version": "19.1", "versionType": "semver" }, { "lessThan": "19.2.6", "status": "affected", "version": "19.2", "versionType": "semver" }, { "lessThan": "19.3.2", "status": "affected", "version": "19.3", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-85706", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "fetchedAt": "2026-10-23T02:43:51.491Z", "publishedAt": "2026-09-12T02:46:31.624Z", "modifiedAt": "2026-09-23T21:03:18.163Z", "state": "published", "provider": "GitLab", "title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab", "descriptions": [ { "lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "GitLab", "product": "GitLab", "sourcePath": "/containers/cna/affected/0", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "18.7", "lessThan": "18.11.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "19.0", "lessThan": "19.0.9", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "19.1", "lessThan": "19.1.8", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "19.2", "lessThan": "19.2.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "19.3", "lessThan": "19.3.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to versions 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2 or above.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "GitLab", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "label": "GitLab", "tags": [], "provider": "GitLab", "sourcePath": "/containers/cna/references/0" }, { "url": "https://hackerone.com/reports/3909881", "label": "HackerOne Bug Bounty Report #3909881", "tags": [ "technical-description", "exploit", "permissions-required" ], "provider": "GitLab", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"cpes\":[\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"product\":\"GitLab\",\"repo\":\"git://git@gitlab.com:gitlab-org/gitlab.git\",\"vendor\":\"GitLab\",\"versions\":[{\"lessThan\":\"18.11.12\",\"status\":\"affected\",\"version\":\"18.7\",\"versionType\":\"semver\"},{\"lessThan\":\"19.0.9\",\"status\":\"affected\",\"version\":\"19.0\",\"versionType\":\"semver\"},{\"lessThan\":\"19.1.8\",\"status\":\"affected\",\"version\":\"19.1\",\"versionType\":\"semver\"},{\"lessThan\":\"19.2.6\",\"status\":\"affected\",\"version\":\"19.2\",\"versionType\":\"semver\"},{\"lessThan\":\"19.3.2\",\"status\":\"affected\",\"version\":\"19.3\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to versions 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2 or above.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-22\",\"description\":\"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-23T21:03:18.163Z", "fetchedAt": "2026-10-23T02:43:51.491Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-11T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "GitLabにファイルへの不正アクセスに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "許可していない場所のファイルにアクセスされる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:53.954Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d052c28c12aa29bb229bd19829e6dfee8da3852f8439082e17674908aa50ad01", "sourceModifiedAt": "2026-09-23T21:03:18.163Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "GitLab CE/EE のバージョン 18.7 から 18.11.12 未満、19.0 から 19.0.9 未満、19.1 から 19.1.8 未満、19.2 から 19.2.6 未満、19.3 から 19.3.2 未満において、特定の条件下で認証されていないユーザーがリポジトリコミット API のパス制限ミスと認証チェック欠如により、GitLab サーバー上の任意のファイルを読み取れる可能性があります。", "risk": "認証されていないユーザーが任意のファイルを読み取れる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは GitLab CE/EE のバージョン 18.7 から 18.11.12 未満、19.0 から 19.0.9 未満、19.1 から 19.1.8 未満、19.2 から 19.2.6 未満、19.3 から 19.3.2 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "条件として、認証されていないユーザーがリポジトリコミット API を利用でき、パス制限が不適切で認証チェックが欠如している場合にファイルが読み取られます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：GitLab / GitLab。影響ありとして記載：18.7以上、18.11.12未満。影響ありとして記載：19.0以上、19.0.9未満。影響ありとして記載：19.1以上、19.1.8未満。影響ありとして記載：19.2以上、19.2.6未満。影響ありとして記載：19.3以上、19.3.2未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E3" ] }, { "text": "「GitLab」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85706", "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "https://hackerone.com/reports/3909881", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] } ], "actions": [ { "text": "バージョン 18.11.12、19.0.9、19.1.8、19.2.6、19.3.2 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2026-85706」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-85706", "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "https://hackerone.com/reports/3909881", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85706", "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "https://hackerone.com/reports/3909881", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-85706", "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "https://hackerone.com/reports/3909881", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85706", "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "https://hackerone.com/reports/3909881", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85706" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "label": "CVE：GitLab" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85706", "label": "CVE公式レコード" }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/3909881", "label": "HackerOne Bug Bounty Report #3909881" }, { "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85706", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourceField": "/containers/cna/title", "excerpt": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"cpes\":[\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"product\":\"GitLab\",\"repo\":\"git://git@gitlab.com:gitlab-org/gitlab.git\",\"vendor\":\"GitLab\",\"versions\":[{\"lessThan\":\"18.11.12\",\"status\":\"affected\",\"version\":\"18.7\",\"versionType\":\"semver\"},{\"lessThan\":\"19.0.9\",\"status\":\"affected\",\"version\":\"19.0\",\"versionType\":\"semver\"},{\"lessThan\":\"19.1.8\",\"status\":\"affected\",\"version\":\"19.1\",\"versionType\":\"semver\"},{\"lessThan\":\"19.2.6\",\"status\":\"affected\",\"version\":\"19.2\",\"versionType\":\"semver\"},{\"lessThan\":\"19.3.2\",\"status\":\"affected\",\"version\":\"19.3\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85706.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to versions 18.11.12, 19.0.9, 19.1.8, 19.2.6, 19.3.2 or above.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85706", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-85706\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-85706（GitLab）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは GitLab CE/EE のバージョン 18.7 から 18.11.12 未満、19.0 から 19.0.9 未満、19.1 から 19.1.8 未満、19.2 から 19.2.6 未満、19.3 から 19.3.2 未満です。\n・条件として、認証されていないユーザーがリポジトリコミット API を利用でき、パス制限が不適切で認証チェックが欠如している場合にファイルが読み取られます。\n・公式の対象表：GitLab / GitLab。影響ありとして記載：18.7以上、18.11.12未満。影響ありとして記載：19.0以上、19.0.9未満。影響ありとして記載：19.1以上、19.1.8未満。影響ありとして記載：19.2以上、19.2.6未満。影響ありとして記載：19.3以上、19.3.2未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-85706", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:53.954Z", "lastSuccess": "2026-10-23T03:21:53.954Z", "sourceCheckedAt": "2026-10-23T02:43:51.491Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-67277", "aliases": [], "title": "RouterOS：サービス停止", "summary": "RouterOS は、プライマリセッションの認証が完了する前に「related」btest 接続を受け付けます。認証されていないクライアントはこの状態を利用して IPv4 UDP テストを開始でき、random-data=false の場合、送信側はカーネルのパケットバッファから初期化されていないデータの末尾を送ります。また、チェックされていない逆転したパケットサイズの範囲により符号なし整数のアンダーフローが起こり、異常に大きなフラグメント化された出力が生成され、RouterOS カーネルを再起動させる可能性があります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "risk": "この脆弱性によりカーネルメモリが漏洩し、さらにカーネルが再起動させられるため、サービスが利用できなくなる（Denial of Service）可能性があります。", "product": "RouterOS", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "4.0", "cvssSource": "CERT-PL", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "RouterOS", "range": ">= 7.24 / < 7.24.2" }, { "product": "RouterOS", "range": ">= 7.0.0 / < 7.23.4" }, { "product": "RouterOS", "range": ">= 6.0.0 / < 6.49.21" } ], "fixed": [], "steps": [ "この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-67277", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CISAが示す関連情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-05T20:00:56.614Z", "modifiedAt": "2026-09-11T03:55:58.675Z", "fetchedAt": "2026-10-23T02:43:50.028Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourceTitle": "Kernel memory disclosure and denial of service in MikroTik RouterOS btest service", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Mikrotik", "product": "RouterOS", "versions": [ { "status": "affected", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom" }, { "status": "affected", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-67277", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "fetchedAt": "2026-10-23T02:43:50.028Z", "publishedAt": "2026-09-05T20:00:56.614Z", "modifiedAt": "2026-09-11T03:55:58.675Z", "state": "published", "provider": "CERT-PL", "title": "Kernel memory disclosure and denial of service in MikroTik RouterOS btest service", "descriptions": [ { "lang": "en", "value": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Mikrotik", "product": "RouterOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-306", "lang": "en", "description": "CWE-306 Missing authentication for critical function", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CERT-PL", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CERT-PL", "tags": [ "third-party-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/0" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CERT-PL", "tags": [ "technical-description" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/1" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CERT-PL", "tags": [ "exploit" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/2" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CERT-PL", "tags": [ "vendor-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/3" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/4" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/5" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-67277", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-306\",\"description\":\"CWE-306 Missing authentication for critical function\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-11T03:55:58.675Z", "fetchedAt": "2026-10-23T02:43:50.028Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-10T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "RouterOSにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:54.303Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4b36a5bca762738afe31b703e0903b7694150d6ad0d4c1130e43b0085d854df8", "sourceModifiedAt": "2026-09-11T03:55:58.675Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "RouterOS は、プライマリセッションの認証が完了する前に「related」btest 接続を受け付けます。認証されていないクライアントはこの状態を利用して IPv4 UDP テストを開始でき、random-data=false の場合、送信側はカーネルのパケットバッファから初期化されていないデータの末尾を送ります。また、チェックされていない逆転したパケットサイズの範囲により符号なし整数のアンダーフローが起こり、異常に大きなフラグメント化された出力が生成され、RouterOS カーネルを再起動させる可能性があります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "risk": "この脆弱性によりカーネルメモリが漏洩し、さらにカーネルが再起動させられるため、サービスが利用できなくなる（Denial of Service）可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "RouterOS バージョン 7.24 で、7.24.2 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "RouterOS バージョン 7.0.0 で、7.23.4 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "RouterOS バージョン 6.0.0 で、6.49.21 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "認証されていないクライアントが btest サービスに接続し、IPv4 UDP テストを開始できる状態が存在します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3" ] }, { "text": "「RouterOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-67277", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67277" ] } ], "actions": [ { "text": "この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されています。", "kind": "fix", "evidenceIds": [ "E1", "E2" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-67277", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67277" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-67277", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-67277" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-67277", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CISAが示す関連情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67277", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "RouterOS accepts a \"related\" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With \"random-data=false\", the sender transmits an uninitialized tail from a kernel packet buffer. A separate unchecked, inverted packet-size interval causes unsigned integer underflow, anomalously large fragmented output, and can restart the RouterOS kernel.\n\n\n\nThis issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourceField": "/containers/cna/title", "excerpt": "Kernel memory disclosure and denial of service in MikroTik RouterOS btest service", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67277.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-67277", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-67277\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-67277（RouterOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・RouterOS バージョン 7.24 で、7.24.2 未満は影響を受けます。\n・RouterOS バージョン 7.0.0 で、7.23.4 未満は影響を受けます。\n・RouterOS バージョン 6.0.0 で、6.49.21 未満は影響を受けます。\n・認証されていないクライアントが btest サービスに接続し、IPv4 UDP テストを開始できる状態が存在します。\n・公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-67277", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:54.303Z", "lastSuccess": "2026-10-23T03:21:54.303Z", "sourceCheckedAt": "2026-10-23T02:43:50.028Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-86060", "aliases": [], "title": "RouterOS：権限の奪取", "summary": "RouterOS の SSH ログイン経路で、先頭が禁止文字で始まるユーザー名を使用すると、信頼された RouterOS ポリシーマスクが変更され、特権昇格が可能になるという引数処理の欠陥があります。攻撃には認証されていない SSH セッションで RouterOS のログインヘルパーに到達する必要があります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されました。", "risk": "攻撃者が特権昇格を行い、RouterOS 上で管理者権限に相当する操作が可能になる可能性があります。", "product": "RouterOS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.2, "cvssVersion": "4.0", "cvssSource": "CERT-PL", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "RouterOS", "range": ">= 7.24 / < 7.24.2" }, { "product": "RouterOS", "range": ">= 7.0.0 / < 7.23.4" }, { "product": "RouterOS", "range": ">= 6.0.0 / < 6.49.21" } ], "fixed": [], "steps": [ "この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されました。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86060", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86060", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-05T20:00:59.107Z", "modifiedAt": "2026-09-11T03:55:59.761Z", "fetchedAt": "2026-10-23T02:43:51.509Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourceTitle": "SSH session privilege manipulation via a crafted username in Mikrotik RouterOS", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Mikrotik", "product": "RouterOS", "versions": [ { "status": "affected", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom" }, { "status": "affected", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-86060", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "fetchedAt": "2026-10-23T02:43:51.509Z", "publishedAt": "2026-09-05T20:00:59.107Z", "modifiedAt": "2026-09-11T03:55:59.761Z", "state": "published", "provider": "CERT-PL", "title": "SSH session privilege manipulation via a crafted username in Mikrotik RouterOS", "descriptions": [ { "lang": "en", "value": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Mikrotik", "product": "RouterOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.24", "lessThan": "7.24.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0", "lessThan": "7.23.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.0.0", "lessThan": "6.49.21", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-88", "lang": "en", "description": "CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.2, "baseSeverity": "CRITICAL", "provider": "CERT-PL", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CERT-PL", "tags": [ "third-party-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/0" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CERT-PL", "tags": [ "technical-description" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/1" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CERT-PL", "tags": [ "exploit" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/2" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CERT-PL", "tags": [ "vendor-advisory" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/3" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/4" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/5" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CERT-PL", "tags": [ "release-notes" ], "provider": "CERT-PL", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86060", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-88\",\"description\":\"CWE-88 Improper neutralization of argument delimiters in a command ('argument injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.2,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-11T03:55:59.761Z", "fetchedAt": "2026-10-23T02:43:51.509Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-10T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "RouterOSに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:55.081Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "958483a1e98b956a5516eab147696ff60ede7630428ba1a78d944c9889d5489e", "sourceModifiedAt": "2026-09-11T03:55:59.761Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "RouterOS の SSH ログイン経路で、先頭が禁止文字で始まるユーザー名を使用すると、信頼された RouterOS ポリシーマスクが変更され、特権昇格が可能になるという引数処理の欠陥があります。攻撃には認証されていない SSH セッションで RouterOS のログインヘルパーに到達する必要があります。この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されました。", "risk": "攻撃者が特権昇格を行い、RouterOS 上で管理者権限に相当する操作が可能になる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "RouterOS バージョン 7.24 から 7.24.2 未満は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "RouterOS バージョン 7.0.0 から 7.23.4 未満は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "RouterOS バージョン 6.0.0 から 6.49.21 未満は影響があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3" ] }, { "text": "「RouterOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-86060", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86060" ] } ], "actions": [ { "text": "この問題はバージョン 6.49.21（Long‑term）、7.23.4（Long‑term）および 7.24.2（Stable）で修正されました。", "kind": "fix", "evidenceIds": [ "E1", "E2" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-86060", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86060" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-86060", "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "https://mikrotik.com/supportsec/september-2026-vulnerability/", "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "https://mikrotik.com/supportsec/september-2026-vulnerability", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86060" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "label": "CVE：CERT-PL" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86060", "label": "CVE公式レコード" }, { "url": "https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve", "label": "CVE掲載の参考情報" }, { "url": "https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/", "label": "CVE掲載の参考情報" }, { "url": "https://npratley.net/reversing-mikrotiks-silent-patch-the-routeros-7-23-4-fix-they-wouldnt-explain/", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability/", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/6-49-21-long-term-is-released/272802", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-23-4-long-term-is-released/272801", "label": "CVE掲載の参考情報" }, { "url": "https://forum.mikrotik.com/t/7-24-2-stable-is-released/272800", "label": "CVE掲載の参考情報" }, { "url": "https://mikrotik.com/supportsec/september-2026-vulnerability", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86060", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "RouterOS contains an argument-handling flaw in the SSH login\npath involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourceField": "/containers/cna/title", "excerpt": "SSH session privilege manipulation via a crafted username in Mikrotik RouterOS", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86060.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Mikrotik\",\"product\":\"RouterOS\",\"versions\":[{\"status\":\"affected\",\"version\":\"7.24\",\"lessThan\":\"7.24.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.23.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.0.0\",\"lessThan\":\"6.49.21\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86060", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-86060\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-86060（RouterOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・RouterOS バージョン 7.24 から 7.24.2 未満は影響があります。\n・RouterOS バージョン 7.0.0 から 7.23.4 未満は影響があります。\n・RouterOS バージョン 6.0.0 から 6.49.21 未満は影響があります。\n・公式の対象表：Mikrotik / RouterOS。影響ありとして記載：7.24以上、7.24.2未満。影響ありとして記載：7.0.0以上、7.23.4未満。影響ありとして記載：6.0.0以上、6.49.21未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-86060", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:55.081Z", "lastSuccess": "2026-10-23T03:21:55.081Z", "sourceCheckedAt": "2026-10-23T02:43:51.509Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-25249", "aliases": [], "title": "FortiSwitchManager / FortiOS：脆弱性情報", "summary": "対象版の公式記載に相違があるため、以下の説明だけで対象外・修正済みと判断しないでください。Fortinet FortiOS 7.6.0 から 7.6.3、7.4.0 から 7.4.8、7.2.0 から 7.2.11、7.0.0 から 7.0.17、6.4 の全バージョン、そして FortiSwitchManager 7.2.0 から 7.2.6、7.0.0 から 7.0.5 において、ヒープベースのバッファオーバーフローが存在し、特別に細工したパケットを送ることで攻撃者が未許可のコードやコマンドを実行できる可能性があります。", "risk": "攻撃者が特別に細工したパケットを送ることで、未許可のコードやコマンドを実行できる可能性があります。", "product": "FortiSwitchManager / FortiOS", "category": "other", "component": "package", "severity": "high", "cvss": 7.4, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C", "affected": [ { "product": "FortiSwitchManager", "range": ">= 7.2.2 / <= 7.2.5" }, { "product": "FortiOS", "range": ">= 7.6.0 / <= 7.6.2" }, { "product": "FortiOS", "range": ">= 7.4.0 / <= 7.4.7" }, { "product": "FortiOS", "range": ">= 7.2.4 / <= 7.2.11" } ], "fixed": [], "steps": [ "FortiSwitchManager をバージョン 7.2.7 以上にアップグレードしてください。", "FortiSwitchManager をバージョン 7.0.6 以上にアップグレードしてください。", "FortiSASE バージョン 25.2.c で本脆弱性は修正済みです。追加の対策は不要です。", "FortiSASE バージョン 25.1.b で本脆弱性は修正済みです。追加の対策は不要です。", "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiOS をバージョン 8.0.0 以上にアップグレードしてください。", "FortiOS をバージョン 7.6.4 以上にアップグレードしてください。", "FortiOS をバージョン 7.4.9 以上にアップグレードしてください。", "FortiOS をバージョン 7.2.12 以上にアップグレードしてください。", "FortiOS をバージョン 7.0.18 以上にアップグレードしてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "label": "CVE：fortinet" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-25249", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25249", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-13T16:32:35.662Z", "modifiedAt": "2026-10-15T01:05:48.869Z", "fetchedAt": "2026-10-23T02:43:36.870Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiSwitchManager", "cpes": [ "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.2.2", "lessThanOrEqual": "7.2.5", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiOS", "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.2", "status": "affected" }, { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.7", "status": "affected" }, { "versionType": "semver", "version": "7.2.4", "lessThanOrEqual": "7.2.11", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-25249", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "fetchedAt": "2026-10-23T02:43:36.870Z", "publishedAt": "2026-01-13T16:32:35.662Z", "modifiedAt": "2026-10-15T01:05:48.869Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiSwitchManager", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.2.2", "lessThanOrEqual": "7.2.5", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "7.6.0", "lessThanOrEqual": "7.6.2", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "7.4.0", "lessThanOrEqual": "7.4.7", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "7.2.4", "lessThanOrEqual": "7.2.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nFortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C", "baseScore": 7.4, "baseSeverity": "HIGH", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25249", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSwitchManager\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.2\",\"lessThanOrEqual\":\"7.2.5\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.11\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nFortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-122\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourcePath": "body:advisory", "text": "SSA-864900\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.1\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-52963\n\nCVE-2024-32122\n\nCVE-2024-50562\n\nCVE-2025-22862\n\nCVE-2025-24471\n\nCVE-2025-25250\n\nCVE-2024-55599\n\nCVE-2025-25248\n\nCVE-2025-53744\n\nCVE-2025-57740\n\nCVE-2025-58903\n\nCVE-2025-31366\n\nCVE-2025-47890\n\nCVE-2025-25253\n\nCVE-2025-58413\n\nCVE-2025-53843\n\nCVE-2025-59718\n\nCVE-2025-59719\n\nCVE-2025-25249\n\nUpdate Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.6.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2025-31514\n\nCVE-2025-54821\n\nCVE-2025-53844\n\nCVE-2025-67862\n\nCVE-2026-59837\n\nCVE-2025-62826\n\nCVE-2025-62675\n\nCVE-2025-43892\n\nCVE-2026-59840\n\nCVE-2026-84392\n\nUpdate Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2024-52963\n\nUnder the config vpn ipsec phase1-interface configuration, either set authmethod to psk, or set digital-signature-auth to disable (see https://fortiguard.fortinet.com/psirt/FG-IR-24-373 )\n\nCVE-2025-25249\n\nFor each interface, remove \"fabric\" access (see https://fortiguard.fortinet.com/psirt/FG-IR-25-084 )\n\nCVE-2025-53843\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs (see https://fortiguard.fortinet.com/psirt/FG-IR-25-358 for more information)\n\nCVE-2025-58413\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs . Remove inter-controller-peer elements in config wireless-controller inter-controller configuration. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-632 for more information)\n\nCVE-2025-59718\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nCVE-2025-59719\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-32122\n\nAn insufficiently protected credentials vulnerability in FortiOS may allow a privileged authenticated attacker to retrieve LDAP credentials via modifying the LDAP server IP address in the FortiOS configuration to point to a malicious attacker-controlled server.\n\nCVSS v3.1 Base Score\n2.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-522: Insufficiently Protected Credentials\n\nVulnerability CVE-2024-50562\n\nAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.\n\nCVSS v3.1 Base Score\n4.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R\n\nCWE\nCWE-613: Insufficient Session Expiration\n\nVulnerability CVE-2024-52963\n\nA out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.\n\nCVSS v3.1 Base Score\n3.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2024-55599\n\nAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U\n\nCWE\nCWE-358: Improperly Implemented Security Check for Standard\n\nVulnerability CVE-2025-22862\n\nAn Authentication Bypass Using an Alternate Path or Channel vulnerability in FortiOS and FortiProxy may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-288: Authentication Bypass Using an Alternate Path or Channel\n\nVulnerability CVE-2025-24471\n\nAn Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C\n\nCWE\nCWE-295: Improper Certificate Validation\n\nVulnerability CVE-2025-25248\n\nAn Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R\n\nCVSS v4.0 Base Score\n6.0\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-190: Integer Overflow or Wraparound\n\nVulnerability CVE-2025-25249\n\nA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4.0 through 6.4.16, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n8.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-25250\n\nAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R\n\nCWE\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n\nVulnerability CVE-2025-25253\n\nAn Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-297: Improper Validation of Certificate with Host Mismatch\n\nVulnerability CVE-2025-31366\n\nAn Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] in FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; FortiSASE 25.3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2025-31514\n\nAn Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-532: Insertion of Sensitive Information into Log File\n\nVulnerability CVE-2025-43892\n\nA buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-126: Buffer Over-read\n\nVulnerability CVE-2025-47890\n\nAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n2.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\nCWE\nCWE-601: URL Redirection to Untrusted Site ('Open Redirect')\n\nVulnerability CVE-2025-53744\n\nAn incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-266: Incorrect Privilege Assignment\n\nVulnerability CVE-2025-53843\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-53844\n\nA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2025-54821\n\nAn Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.\n\nCVSS v3.1 Base Score\n1.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N\n\nCWE\nCWE-269: Improper Privilege Management\n\nVulnerability CVE-2025-57740\n\nAn Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-58413\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-58903\n\nAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-252: Unchecked Return Value\n\nVulnerability CVE-2025-59718\n\nA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-347: Improper Verification of Cryptographic Signature\n\nVulnerability CVE-2025-59719\n\nAn improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.\n\nCVSS v3.1 Base Score\n9.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-347: Improper Verification of Cryptographic Signature\n\nVulnerability CVE-2025-62675\n\nAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.\n\nCVSS v3.1 Base Score\n3.4\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N\n\nCWE\nCWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\nVulnerability CVE-2025-62826\n\nAn Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n3.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\nCWE\nCWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')\n\nVulnerability CVE-2025-67862\n\nAn Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State\n\nVulnerability CVE-2026-59837\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n6.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2026-59840\n\nA buffer over-read vulnerability [CWE-126] in FortiOS, FortiProxy, and FortiSASE may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-126: Buffer Over-read\n\nVulnerability CVE-2026-84392\n\nA NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nADDITIONAL INFORMATION\n\nSiemens recommends to consult and implement the workarounds provided in Fortinet's upstream security notifications .\nFortinet provides a public RSS feed for their security alerts to which customers can also subscribe [1].\n\n[1] https://filestore.fortinet.com/fortiguard/rss/ir.xml\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT:\n\nhttps://www.siemens.com/cert/advisories\n\nHISTORY DATA\n\nV1.0 (2025-05-13):\n\nPublication Date\n\nV1.1 (2025-07-08):\n\nAdded CVE-2025-24471, CVE-2025-22862, CVE-2024-50562 and CVE-2025-25250\n\nV1.2 (2025-08-12):\n\nAdded CVE-2024-55599\n\nV1.3 (2025-09-09):\n\nAdded CVE-2025-25248 and CVE-2025-53744\n\nV1.4 (2025-11-11):\n\nAdded CVE-2025-57740, CVE-2025-31514, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890 and CVE-2025-25253\n\nV1.5 (2026-01-13):\n\nAdded CVE-2025-54821, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719\n\nV1.6 (2026-01-22):\n\nUpdated remediation for CVE-2024-52963 , CVE-2024-32122, CVE-2024-32122, CVE-2024-50562, CVE-2025-22862, CVE-2025-24471, CVE-2025-25250 , CVE-2024-55599, CVE-2025-25248, CVE-2025-53744, CVE-2025-57740, CVE-2025-58903, CVE-2025-31366, CVE-2025-47890, CVE-2025-25253, CVE-2025-58413, CVE-2025-53843, CVE-2025-59718 and CVE-2025-59719\n\nV1.7 (2026-02-10):\n\nAdded CVE-2025-25249\n\nV1.8 (2026-06-09):\n\nAdded CVE-2025-53844. Updated remediation for CVE-2025-31514 and CVE-2025-54821\n\nV1.9 (2026-07-14):\n\nAdded CVE-2025-67862\n\nV2.0 (2026-08-11):\n\nAdded CVE-2026-59837, CVE-2025-62826, CVE-2025-62675, CVE-2025-43892 and CVE-2026-59840\n\nV2.1 (2026-10-13):\n\nAdded CVE-2026-84392\n\nTERMS OF USE\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on:\nhttps://www.siemens.com/productcert/terms-of-use .\n\nSSA-864900\n\n©\nSiemens 2026", "truncated": false, "representation": "html_text_excerpt", "relatedCve": "CVE-2025-25249", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ] } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "title": "SSA-864900", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "title": "SSA-864900", "relatedCves": [ "CVE-2024-52963", "CVE-2024-32122", "CVE-2024-50562", "CVE-2025-22862", "CVE-2025-24471", "CVE-2025-25250", "CVE-2024-55599", "CVE-2025-25248", "CVE-2025-53744", "CVE-2025-57740", "CVE-2025-58903", "CVE-2025-31366", "CVE-2025-47890", "CVE-2025-25253", "CVE-2025-58413", "CVE-2025-53843", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-25249", "CVE-2025-31514", "CVE-2025-54821", "CVE-2025-53844", "CVE-2025-67862", "CVE-2026-59837", "CVE-2025-62826", "CVE-2025-62675", "CVE-2025-43892", "CVE-2026-59840", "CVE-2026-84392" ], "truncated": false } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-15T01:05:48.869Z", "fetchedAt": "2026-10-23T02:43:36.870Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "FortiSwitchManager / FortiOSに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:57.104Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2ba40cf25c5cd934f882f2b7cc56f992653d44419e100c4978bfd3f2af79818c", "sourceModifiedAt": "2026-10-15T01:05:48.869Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "対象版の公式記載に相違があるため、以下の説明だけで対象外・修正済みと判断しないでください。Fortinet FortiOS 7.6.0 から 7.6.3、7.4.0 から 7.4.8、7.2.0 から 7.2.11、7.0.0 から 7.0.17、6.4 の全バージョン、そして FortiSwitchManager 7.2.0 から 7.2.6、7.0.0 から 7.0.5 において、ヒープベースのバッファオーバーフローが存在し、特別に細工したパケットを送ることで攻撃者が未許可のコードやコマンドを実行できる可能性があります。", "risk": "攻撃者が特別に細工したパケットを送ることで、未許可のコードやコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E3" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.4.0から7.4.8」、対象表は「7.4.0以上、7.4.7以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.6.0から7.6.3」、対象表は「7.6.0以上、7.6.2以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "FortiOS 7.6.0 から 7.6.3 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiOS 7.4.0 から 7.4.8 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiOS 7.2.0 から 7.2.11 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiOS 7.0.0 から 7.0.17 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiOS 6.4 の全バージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiSwitchManager 7.2.0 から 7.2.6 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiSwitchManager 7.0.0 から 7.0.5 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E1" ] }, { "text": "FortiSwitchManager バージョン 7.2.2 から 7.2.5 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E2" ] }, { "text": "FortiOS バージョン 7.6.0 から 7.6.2 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E3" ] }, { "text": "FortiOS バージョン 7.4.0 から 7.4.7 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E3" ] }, { "text": "FortiOS バージョン 7.2.4 から 7.2.11 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiSwitchManager。影響ありとして記載：7.2.2以上、7.2.5以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.2以下。影響ありとして記載：7.4.0以上、7.4.7以下。影響ありとして記載：7.2.4以上、7.2.11以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E2" ] }, { "text": "「FortiSwitchManager / FortiOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-25249", "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-25249" ] } ], "actions": [ { "text": "FortiSwitchManager をバージョン 7.2.7 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSwitchManager をバージョン 7.0.6 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSASE バージョン 25.2.c で本脆弱性は修正済みです。追加の対策は不要です。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSASE バージョン 25.1.b で本脆弱性は修正済みです。追加の対策は不要です。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiOS をバージョン 8.0.0 以上にアップグレードしてください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiOS をバージョン 7.6.4 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiOS をバージョン 7.4.9 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiOS をバージョン 7.2.12 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiOS をバージョン 7.0.18 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E4" ] } ], "temporaryMitigations": [ { "text": "各インターフェースで \"fabric\" アクセスを削除してください。", "kind": "fix", "sourceUrls": [ "https://cert-portal.siemens.com/productcert/html/ssa-864900.html" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-25249", "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-25249" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.6.0から7.6.3」、対象表は「7.6.0以上、7.6.2以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.4.0から7.4.8」、対象表は「7.4.0以上、7.4.7以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "label": "CVE：fortinet" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-25249", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-084", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25249", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSwitchManager\",\"cpes\":[\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.2:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.2.2\",\"lessThanOrEqual\":\"7.2.5\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.2\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.7\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.11\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/25xxx/CVE-2025-25249.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiSwitchManager version 7.2.7 or above\nUpgrade to FortiSwitchManager version 7.0.6 or above\nFortinet remediated this issue in FortiSASE version 25.2.c and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSASE version 25.1.b and hence customers do not need to perform any action.\nUpgrade to upcoming FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.4 or above\nUpgrade to FortiOS version 7.4.9 or above\nUpgrade to FortiOS version 7.2.12 or above\nUpgrade to FortiOS version 7.0.18 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-864900.html", "sourceField": "body:advisory", "excerpt": "SSA-864900\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-864900: Multiple Vulnerabilities in Fortigate NGFW before V7.6.6 on RUGGEDCOM APE1808 Devices\n\nPublication Date:\n\n2025-05-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV2.1\n\nCVSS v3.1 Base Score:\n9.8\n\nCVSS v4.0 Base Score:\n8.6\n\nSUMMARY\n\nFortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\n\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nExpand children\n\nRUGGEDCOM APE1808\n\nShow more details\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.4.9\n\naffected by\n\nmultiple CVEs\n\nCVE-2024-52963\n\nCVE-2024-32122\n\nCVE-2024-50562\n\nCVE-2025-22862\n\nCVE-2025-24471\n\nCVE-2025-25250\n\nCVE-2024-55599\n\nCVE-2025-25248\n\nCVE-2025-53744\n\nCVE-2025-57740\n\nCVE-2025-58903\n\nCVE-2025-31366\n\nCVE-2025-47890\n\nCVE-2025-25253\n\nCVE-2025-58413\n\nCVE-2025-53843\n\nCVE-2025-59718\n\nCVE-2025-59719\n\nCVE-2025-25249\n\nUpdate Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nRUGGEDCOM APE1808\n\nAll versions with Fortinet NGFW < V7.6.6\n\naffected by\n\nmultiple CVEs\n\nCVE-2025-31514\n\nCVE-2025-54821\n\nCVE-2025-53844\n\nCVE-2025-67862\n\nCVE-2026-59837\n\nCVE-2025-62826\n\nCVE-2025-62675\n\nCVE-2025-43892\n\nCVE-2026-59840\n\nCVE-2026-84392\n\nUpdate Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nCVE-2024-52963\n\nUnder the config vpn ipsec phase1-interface configuration, either set authmethod to psk, or set digital-signature-auth to disable (see https://fortiguard.fortinet.com/psirt/FG-IR-24-373 )\n\nCVE-2025-25249\n\nFor each interface, remove \"fabric\" access (see https://fortiguard.fortinet.com/psirt/FG-IR-25-084 )\n\nCVE-2025-53843\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs (see https://fortiguard.fortinet.com/psirt/FG-IR-25-358 for more information)\n\nCVE-2025-58413\n\nDisable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs . Remove inter-controller-peer elements in config wireless-controller inter-controller configuration. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-632 for more information)\n\nCVE-2025-59718\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nCVE-2025-59719\n\nTo prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-647 for more information)\n\nProduct-specific remediations or mitigations can be found in the section\nKnown Affected Products .\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nRUGGEDCOM APE1808 is a powerful utility-grade application hosting platform that lets you deploy a range of commercially available applications for edge computing and cybersecurity in harsh, industrial environments.\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2024-32122\n\nAn insufficiently protected credentials vulnerability in FortiOS may allow a privileged authenticated attacker to retrieve LDAP credentials via modifying the LDAP server IP address in the FortiOS configuration to point to a malicious attacker-controlled server.\n\nCVSS v3.1 Base Score\n2.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-522: Insufficiently Protected Credentials\n\nVulnerability CVE-2024-50562\n\nAn Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.\n\nCVSS v3.1 Base Score\n4.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RC:R\n\nCWE\nCWE-613: Insufficient Session Expiration\n\nVulnerability CVE-2024-52963\n\nA out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.\n\nCVSS v3.1 Base Score\n3.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2024-55599\n\nAn Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U\n\nCWE\nCWE-358: Improperly Implemented Security Check for Standard\n\nVulnerability CVE-2025-22862\n\nAn Authentication Bypass Using an Alternate Path or Channel vulnerability in FortiOS and FortiProxy may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.\n\nCVSS v3.1 Base Score\n6.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-288: Authentication Bypass Using an Alternate Path or Channel\n\nVulnerability CVE-2025-24471\n\nAn Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.\n\nCVSS v3.1 Base Score\n6.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C\n\nCWE\nCWE-295: Improper Certificate Validation\n\nVulnerability CVE-2025-25248\n\nAn Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.\n\nCVSS v3.1 Base Score\n5.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R\n\nCVSS v4.0 Base Score\n6.0\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-190: Integer Overflow or Wraparound\n\nVulnerability CVE-2025-25249\n\nA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4.0 through 6.4.16, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n8.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-25250\n\nAn Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RC:R\n\nCWE\nCWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n\nVulnerability CVE-2025-25253\n\nAn Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-297: Improper Validation of Certificate with Host Mismatch\n\nVulnerability CVE-2025-31366\n\nAn Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] in FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; FortiSASE 25.3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nCWE\nCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\nVulnerability CVE-2025-31514\n\nAn Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-532: Insertion of Sensitive Information into Log File\n\nVulnerability CVE-2025-43892\n\nA buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.\n\nCVSS v3.1 Base Score\n4.3\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\n\nCWE\nCWE-126: Buffer Over-read\n\nVulnerability CVE-2025-47890\n\nAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.\n\nCVSS v3.1 Base Score\n2.6\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\nCWE\nCWE-601: URL Redirection to Untrusted Site ('Open Redirect')\n\nVulnerability CVE-2025-53744\n\nAn incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.\n\nCVSS v3.1 Base Score\n7.2\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n8.6\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-266: Incorrect Privilege Assignment\n\nVulnerability CVE-2025-53843\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-53844\n\nA out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-787: Out-of-bounds Write\n\nVulnerability CVE-2025-54821\n\nAn Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.\n\nCVSS v3.1 Base Score\n1.9\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N\n\nCWE\nCWE-269: Improper Privilege Management\n\nVulnerability CVE-2025-57740\n\nAn Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests.\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-122: Heap-based Buffer Overflow\n\nVulnerability CVE-2025-58413\n\nA stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets\n\nCVSS v3.1 Base Score\n7.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-121: Stack-based Buffer Overflow\n\nVulnerability CVE-2025-58903\n\nAn Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.\n\nCVSS v3.1 Base Score\n2.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n\nCWE\nCWE-252: Unchecked Return Value\n\nVulnerability CVE-2025-59718\n\nA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 t", "language": null, "representation": "html_text_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-25249", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-25249\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-25249（FortiSwitchManager / FortiOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・FortiOS 7.6.0 から 7.6.3 が影響を受けます。\n・FortiOS 7.4.0 から 7.4.8 が影響を受けます。\n・FortiOS 7.2.0 から 7.2.11 が影響を受けます。\n・FortiOS 7.0.0 から 7.0.17 が影響を受けます。\n・FortiOS 6.4 の全バージョンが影響を受けます。\n・FortiSwitchManager 7.2.0 から 7.2.6 が影響を受けます。\n・FortiSwitchManager 7.0.0 から 7.0.5 が影響を受けます。\n・FortiSwitchManager バージョン 7.2.2 から 7.2.5 が影響を受けます。\n・FortiOS バージョン 7.6.0 から 7.6.2 が影響を受けます。\n・FortiOS バージョン 7.4.0 から 7.4.7 が影響を受けます。\n・FortiOS バージョン 7.2.4 から 7.2.11 が影響を受けます。\n・公式の対象表：Fortinet / FortiSwitchManager。影響ありとして記載：7.2.2以上、7.2.5以下。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.2以下。影響ありとして記載：7.4.0以上、7.4.7以下。影響ありとして記載：7.2.4以上、7.2.11以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-25249\n\n公式資料で追加確認が必要な点：\n・公式情報では 8.0.0 が公開予定または未リリースとして記載されています。\n・対象版の公式記載に相違があります。FortiOSについて、説明文は「7.6.0から7.6.3」、対象表は「7.6.0以上、7.6.2以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。\n・対象版の公式記載に相違があります。FortiOSについて、説明文は「7.4.0から7.4.8」、対象表は「7.4.0以上、7.4.7以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [ { "code": "planned_release", "text": "公式情報では 8.0.0 が公開予定または未リリースとして記載されています。", "evidenceIds": [ "E4" ] }, { "code": "affected_range_conflict", "text": "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.6.0から7.6.3」、対象表は「7.6.0以上、7.6.2以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "evidenceIds": [ "E1", "E3" ] }, { "code": "affected_range_conflict", "text": "対象版の公式記載に相違があります。FortiOSについて、説明文は「7.4.0から7.4.8」、対象表は「7.4.0以上、7.4.7以下」です。説明文と対象表のどちらか一方だけで対象外や修正済みと判断せず、利用中の版を添えて提供元に確認してください。", "evidenceIds": [ "E1", "E3" ] } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:57.104Z", "lastSuccess": "2026-10-23T03:21:57.104Z", "sourceCheckedAt": "2026-10-23T02:43:36.870Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-19490", "aliases": [], "title": "ADC / Gateway：脆弱性情報", "summary": "NetScaler ADC と NetScaler Gateway に脆弱性があります。この問題は、ADC がバージョン 14.1 から 73.32 まで、または 13.1 から 63.21 まで、Gateway がバージョン 14.1 から 73.32 まで、または 13.1 から 63.21 までの範囲で影響を受けます。", "risk": "提供された資料には、具体的な被害や影響についての記載がありません。", "product": "ADC / Gateway", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "NetScaler", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "affected": [ { "product": "ADC", "range": ">= 14.1 / <= 73.32" }, { "product": "ADC", "range": ">= 13.1 / <= 63.21" }, { "product": "Gateway", "range": ">= 14.1 / <= 73.32" }, { "product": "Gateway", "range": ">= 13.1 / <= 63.21" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "label": "CVE：NetScaler" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19490", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "label": "CVE掲載の参考情報" }, { "url": "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19490", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-19T12:54:39.730Z", "modifiedAt": "2026-10-07T18:01:17.320Z", "fetchedAt": "2026-10-23T02:43:47.041Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "sourceTitle": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "NetScaler", "product": "ADC", "versions": [ { "status": "affected", "version": "14.1", "lessThanOrEqual": "73.32", "versionType": "patch" }, { "status": "affected", "version": "13.1", "lessThanOrEqual": "63.21", "versionType": "patch" } ], "defaultStatus": "unaffected" }, { "vendor": "NetScaler", "product": "Gateway", "versions": [ { "status": "affected", "version": "14.1", "lessThanOrEqual": "73.32", "versionType": "patch" }, { "status": "affected", "version": "13.1", "lessThanOrEqual": "63.21", "versionType": "patch" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-19490", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "fetchedAt": "2026-10-23T02:43:47.041Z", "publishedAt": "2026-08-19T12:54:39.730Z", "modifiedAt": "2026-10-07T18:01:17.320Z", "state": "published", "provider": "NetScaler", "title": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490", "descriptions": [ { "lang": "en", "value": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "NetScaler", "product": "ADC", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "14.1", "lessThanOrEqual": "73.32", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "13.1", "lessThanOrEqual": "63.21", "versionType": "patch", "status": "affected" } ] }, { "vendor": "NetScaler", "product": "Gateway", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "14.1", "lessThanOrEqual": "73.32", "versionType": "patch", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "13.1", "lessThanOrEqual": "63.21", "versionType": "patch", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "NetScaler", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "label": "NetScaler", "tags": [], "provider": "NetScaler", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"NetScaler\",\"product\":\"ADC\",\"versions\":[{\"status\":\"affected\",\"version\":\"14.1\",\"lessThanOrEqual\":\"73.32\",\"versionType\":\"patch\"},{\"status\":\"affected\",\"version\":\"13.1\",\"lessThanOrEqual\":\"63.21\",\"versionType\":\"patch\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"NetScaler\",\"product\":\"Gateway\",\"versions\":[{\"status\":\"affected\",\"version\":\"14.1\",\"lessThanOrEqual\":\"73.32\",\"versionType\":\"patch\"},{\"status\":\"affected\",\"version\":\"13.1\",\"lessThanOrEqual\":\"63.21\",\"versionType\":\"patch\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T18:01:17.320Z", "fetchedAt": "2026-10-23T02:43:47.041Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "ADC / Gatewayに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:58.004Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce391e16627282ce36124ae70490c6643b078e643109513d87fd2ea2e34243b8", "sourceModifiedAt": "2026-10-07T18:01:17.320Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "NetScaler ADC と NetScaler Gateway に脆弱性があります。この問題は、ADC がバージョン 14.1 から 73.32 まで、または 13.1 から 63.21 まで、Gateway がバージョン 14.1 から 73.32 まで、または 13.1 から 63.21 までの範囲で影響を受けます。", "risk": "提供された資料には、具体的な被害や影響についての記載がありません。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "NetScaler ADC のバージョン 14.1 以上 73.32 以下、または 13.1 以上 63.21 以下が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "NetScaler Gateway のバージョン 14.1 以上 73.32 以下、または 13.1 以上 63.21 以下が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、73.32以下。影響ありとして記載：13.1以上、63.21以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、73.32以下。影響ありとして記載：13.1以上、63.21以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ADC / Gateway」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-19490", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-19490" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-19490", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-19490" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-19490", "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-19490" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "label": "CVE：NetScaler" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19490", "label": "CVE公式レコード" }, { "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939", "label": "CVE掲載の参考情報" }, { "url": "https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19490", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourceField": "/containers/cna/title", "excerpt": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"NetScaler\",\"product\":\"ADC\",\"versions\":[{\"status\":\"affected\",\"version\":\"14.1\",\"lessThanOrEqual\":\"73.32\",\"versionType\":\"patch\"},{\"status\":\"affected\",\"version\":\"13.1\",\"lessThanOrEqual\":\"63.21\",\"versionType\":\"patch\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/19xxx/CVE-2026-19490.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"NetScaler\",\"product\":\"Gateway\",\"versions\":[{\"status\":\"affected\",\"version\":\"14.1\",\"lessThanOrEqual\":\"73.32\",\"versionType\":\"patch\"},{\"status\":\"affected\",\"version\":\"13.1\",\"lessThanOrEqual\":\"63.21\",\"versionType\":\"patch\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-19490\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-19490（ADC / Gateway）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・NetScaler ADC のバージョン 14.1 以上 73.32 以下、または 13.1 以上 63.21 以下が影響を受けます。\n・NetScaler Gateway のバージョン 14.1 以上 73.32 以下、または 13.1 以上 63.21 以下が影響を受けます。\n・公式の対象表：NetScaler / ADC。影響ありとして記載：14.1以上、73.32以下。影響ありとして記載：13.1以上、63.21以下。\n・公式の対象表：NetScaler / Gateway。影響ありとして記載：14.1以上、73.32以下。影響ありとして記載：13.1以上、63.21以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-19490", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:58.004Z", "lastSuccess": "2026-10-23T03:21:58.004Z", "sourceCheckedAt": "2026-10-23T02:43:47.041Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20079", "aliases": [], "title": "Cisco Secure Firewall Management Center (FMC)：コード実行", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに脆弱性があり、認証されていないリモート攻撃者が認証を回避し、スクリプトファイルを実行して基盤 OS の root 権限を取得できる可能性があります。この脆弱性は起動時に作成される不適切なシステムプロセスが原因です。攻撃者は細工した HTTP リクエストを送ることで悪用でき、成功すると様々なスクリプトやコマンドを実行してデバイスの root 権限を得られます。", "risk": "攻撃が成功すると、攻撃者はデバイスの root 権限を取得し、OS 上で任意の操作が可能になる。", "product": "Cisco Secure Firewall Management Center (FMC)", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.1.0.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.9" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.11" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "10.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.9" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.11" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.12" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "10.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20079", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20079", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-03-04T17:17:35.838Z", "modifiedAt": "2026-09-16T20:08:37.499Z", "fetchedAt": "2026-10-23T02:43:47.208Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. ", "sourceTitle": "Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "versions": [ { "version": "7.0.0", "status": "affected" }, { "version": "7.0.0.1", "status": "affected" }, { "version": "7.0.1", "status": "affected" }, { "version": "7.1.0", "status": "affected" }, { "version": "7.0.1.1", "status": "affected" }, { "version": "7.1.0.1", "status": "affected" }, { "version": "7.0.2", "status": "affected" }, { "version": "7.2.0", "status": "affected" }, { "version": "7.0.2.1", "status": "affected" }, { "version": "7.0.3", "status": "affected" }, { "version": "7.1.0.2", "status": "affected" }, { "version": "7.2.0.1", "status": "affected" }, { "version": "7.0.4", "status": "affected" }, { "version": "7.2.1", "status": "affected" }, { "version": "7.0.5", "status": "affected" }, { "version": "7.3.0", "status": "affected" }, { "version": "7.2.2", "status": "affected" }, { "version": "7.3.1", "status": "affected" }, { "version": "7.2.3", "status": "affected" }, { "version": "7.1.0.3", "status": "affected" }, { "version": "7.2.3.1", "status": "affected" }, { "version": "7.2.4", "status": "affected" }, { "version": "7.0.6", "status": "affected" }, { "version": "7.2.4.1", "status": "affected" }, { "version": "7.2.5", "status": "affected" }, { "version": "7.3.1.1", "status": "affected" }, { "version": "7.4.0", "status": "affected" }, { "version": "7.0.6.1", "status": "affected" }, { "version": "7.2.5.1", "status": "affected" }, { "version": "7.4.1", "status": "affected" }, { "version": "7.2.6", "status": "affected" }, { "version": "7.4.1.1", "status": "affected" }, { "version": "7.0.6.2", "status": "affected" }, { "version": "7.2.7", "status": "affected" }, { "version": "7.2.5.2", "status": "affected" }, { "version": "7.3.1.2", "status": "affected" }, { "version": "7.2.8", "status": "affected" }, { "version": "7.6.0", "status": "affected" }, { "version": "7.4.2", "status": "affected" }, { "version": "7.2.8.1", "status": "affected" }, { "version": "7.0.6.3", "status": "affected" }, { "version": "7.4.2.1", "status": "affected" }, { "version": "7.2.9", "status": "affected" }, { "version": "7.0.7", "status": "affected" }, { "version": "7.7.0", "status": "affected" }, { "version": "7.4.2.2", "status": "affected" }, { "version": "7.2.10", "status": "affected" }, { "version": "7.6.1", "status": "affected" }, { "version": "7.4.2.3", "status": "affected" }, { "version": "7.0.8", "status": "affected" }, { "version": "7.6.2", "status": "affected" }, { "version": "7.7.10", "status": "affected" }, { "version": "7.2.10.1", "status": "affected" }, { "version": "7.0.8.1", "status": "affected" }, { "version": "7.6.2.1", "status": "affected" }, { "version": "7.2.10.2", "status": "affected" }, { "version": "7.7.10.1", "status": "affected" }, { "version": "7.4.2.4", "status": "affected" }, { "version": "7.4.3", "status": "affected" }, { "version": "7.6.3", "status": "affected" }, { "version": "7.7.11", "status": "affected" }, { "version": "7.6.4", "status": "affected" }, { "version": "10.0.0", "status": "affected" }, { "version": "7.4.4", "status": "affected" }, { "version": "7.4.5", "status": "affected" }, { "version": "7.0.9", "status": "affected" }, { "version": "7.2.11", "status": "affected" }, { "version": "7.7.12", "status": "affected" }, { "version": "7.6.5", "status": "affected" }, { "version": "7.4.6", "status": "affected" }, { "version": "10.0.1", "status": "affected" }, { "version": "7.4.7", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20079", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "fetchedAt": "2026-10-23T02:43:47.208Z", "publishedAt": "2026-03-04T17:17:35.838Z", "modifiedAt": "2026-09-16T20:08:37.499Z", "state": "published", "provider": "cisco", "title": "Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. ", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "7.0.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "7.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "7.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "7.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "7.0.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "7.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "7.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "7.2.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "7.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "7.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "7.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "7.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "7.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "7.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "7.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "7.1.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "7.2.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "7.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "7.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "7.2.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "7.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "7.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "7.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "7.0.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "7.2.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "7.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "7.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "7.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "7.0.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "7.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "7.2.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "7.3.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "7.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "7.6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "7.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "7.2.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "7.0.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "7.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "7.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "7.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "7.7.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "7.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "7.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "7.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "7.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "7.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "7.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "7.7.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "7.2.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "7.0.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "7.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "7.2.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "7.7.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "7.4.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "7.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "7.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "7.7.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "7.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "10.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "7.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "7.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "7.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "7.2.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "7.7.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "7.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "7.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "10.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "7.4.7", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "Authentication Bypass Using an Alternate Path or Channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "label": "cisco-sa-onprem-fmc-authbypass-5JPp45V2", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://blog.talosintelligence.com/fmc-ongoing-exploitation/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20079", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://seclists.org/fulldisclosure/2026/Aug/80", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"7.1.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.6.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"},{\"version\":\"7.0.9\",\"status\":\"affected\"},{\"version\":\"7.2.11\",\"status\":\"affected\"},{\"version\":\"7.7.12\",\"status\":\"affected\"},{\"version\":\"7.6.5\",\"status\":\"affected\"},{\"version\":\"7.4.6\",\"status\":\"affected\"},{\"version\":\"10.0.1\",\"status\":\"affected\"},{\"version\":\"7.4.7\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. ", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In August 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Authentication Bypass Using an Alternate Path or Channel\",\"type\":\"cwe\",\"cweId\":\"CWE-288\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-16T20:08:37.499Z", "fetchedAt": "2026-10-23T02:43:47.208Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Cisco Secure Firewall Management Center (FMC)にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:58.168Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "187f5745f7bd99984fea14403f22e3cd635d1a7857365d5381e72c65944765d6", "sourceModifiedAt": "2026-09-16T20:08:37.499Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに脆弱性があり、認証されていないリモート攻撃者が認証を回避し、スクリプトファイルを実行して基盤 OS の root 権限を取得できる可能性があります。この脆弱性は起動時に作成される不適切なシステムプロセスが原因です。攻撃者は細工した HTTP リクエストを送ることで悪用でき、成功すると様々なスクリプトやコマンドを実行してデバイスの root 権限を得られます。", "risk": "攻撃が成功すると、攻撃者はデバイスの root 権限を取得し、OS 上で任意の操作が可能になる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Secure Firewall Management Center (FMC) の以下のバージョンが影響を受ける: 7.0.0, 7.0.0.1, 7.0.1, 7.1.0, 7.0.1.1, 7.1.0.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3, 7.1.0.2, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 7.3.0, 7.2.2, 7.3.1, 7.2.3, 7.1.0.3, 7.2.3.1, 7.2.4, 7.0.6, 7.2.4.1, 7.2.5, 7.3.1.1, 7.4.0, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.4.1.1, 7.0.6.2, 7.2.7, 7.2.5.2, 7.3.1.2, 7.2.8, 7.6.0, 7.4.2, 7.2.8.1, 7.0.6.3, 7.4.2.1, 7.2.9, 7.0.7, 7.7.0, 7.4.2.2, 7.2.10, 7.6.1, 7.4.2.3, 7.0.8, 7.6.2, 7.7.10, 7.2.10.1, 7.0.8.1, 7.6.2.1, 7.2.10.2, 7.7.10.1, 7.4.2.4, 7.4.3, 7.6.3, 7.7.11, 7.6.4, 10.0.0, 7.4.4, 7.4.5, 7.0.9, 7.2.11, 7.7.12, 7.6.5, 7.4.6, 10.0.1, 7.4.7", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.1.0。影響ありとして記載：7.0.1.1。影響ありとして記載：7.1.0.1。影響ありとして記載：7.0.2。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.1.0.2。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.1.0.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.6.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。影響ありとして記載：7.0.9。影響ありとして記載：7.2.11。影響ありとして記載：7.7.12。影響ありとして記載：7.6.5。影響ありとして記載：7.4.6。影響ありとして記載：10.0.1。影響ありとして記載：7.4.7。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Secure Firewall Management Center (FMC)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20079", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20079" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20079", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20079" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20079", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20079" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20079", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20079", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. \r\n\r\nThis vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to execute a variety of scripts and commands that allow root access to the device. ", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20079.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"7.1.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.1.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.6.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"},{\"version\":\"7.0.9\",\"status\":\"affected\"},{\"version\":\"7.2.11\",\"status\":\"affected\"},{\"version\":\"7.7.12\",\"status\":\"affected\"},{\"version\":\"7.6.5\",\"status\":\"affected\"},{\"version\":\"7.4.6\",\"status\":\"affected\"},{\"version\":\"10.0.1\",\"status\":\"affected\"},{\"version\":\"7.4.7\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20079", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20079\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20079（Cisco Secure Firewall Management Center (FMC)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Secure Firewall Management Center (FMC) の以下のバージョンが影響を受ける: 7.0.0, 7.0.0.1, 7.0.1, 7.1.0, 7.0.1.1, 7.1.0.1, 7.0.2, 7.2.0, 7.0.2.1, 7.0.3, 7.1.0.2, 7.2.0.1, 7.0.4, 7.2.1, 7.0.5, 7.3.0, 7.2.2, 7.3.1, 7.2.3, 7.1.0.3, 7.2.3.1, 7.2.4, 7.0.6, 7.2.4.1, 7.2.5, 7.3.1.1, 7.4.0, 7.0.6.1, 7.2.5.1, 7.4.1, 7.2.6, 7.4.1.1, 7.0.6.2, 7.2.7, 7.2.5.2, 7.3.1.2, 7.2.8, 7.6.0, 7.4.2, 7.2.8.1, 7.0.6.3, 7.4.2.1, 7.2.9, 7.0.7, 7.7.0, 7.4.2.2, 7.2.10, 7.6.1, 7.4.2.3, 7.0.8, 7.6.2, 7.7.10, 7.2.10.1, 7.0.8.1, 7.6.2.1, 7.2.10.2, 7.7.10.1, 7.4.2.4, 7.4.3, 7.6.3, 7.7.11, 7.6.4, 10.0.0, 7.4.4, 7.4.5, 7.0.9, 7.2.11, 7.7.12, 7.6.5, 7.4.6, 10.0.1, 7.4.7\n・公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.1.0。影響ありとして記載：7.0.1.1。影響ありとして記載：7.1.0.1。影響ありとして記載：7.0.2。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.1.0.2。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.1.0.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.6.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。影響ありとして記載：7.0.9。影響ありとして記載：7.2.11。影響ありとして記載：7.7.12。影響ありとして記載：7.6.5。影響ありとして記載：7.4.6。影響ありとして記載：10.0.1。影響ありとして記載：7.4.7。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20079", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:58.168Z", "lastSuccess": "2026-10-23T03:21:58.168Z", "sourceCheckedAt": "2026-10-23T02:43:47.208Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-87491", "aliases": [], "title": "Chrome：コード実行", "summary": "Google Chrome の V8 エンジンで境界外書き込みが発生し、153.0.8010.36 より前のバージョンでは、遠隔の攻撃者が細工した HTML ページを使ってサンドボックス内で任意のコードを実行させられる可能性があります。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できるため、ブラウザ上で不正な処理が行われる恐れがあります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 153.0.8010.36 / < 153.0.8010.36" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87491", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87491", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-09T00:09:38.419Z", "modifiedAt": "2026-09-21T12:51:58.334Z", "fetchedAt": "2026-10-23T02:43:51.683Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "153.0.8010.36", "status": "affected", "lessThan": "153.0.8010.36", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-87491", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "fetchedAt": "2026-10-23T02:43:51.683Z", "publishedAt": "2026-09-09T00:09:38.419Z", "modifiedAt": "2026-09-21T12:51:58.334Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "153.0.8010.36", "lessThan": "153.0.8010.36", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "Out of bounds write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"153.0.8010.36\",\"status\":\"affected\",\"lessThan\":\"153.0.8010.36\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Out of bounds write\",\"cweId\":\"CWE-787\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T12:51:58.334Z", "fetchedAt": "2026-10-23T02:43:51.683Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Chromeにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.015Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "739de2019e1a46186bb6fad1236259be4a6c22b5cb9037b2ce99c792bfc02ee6", "sourceModifiedAt": "2026-09-21T12:51:58.334Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 エンジンで境界外書き込みが発生し、153.0.8010.36 より前のバージョンでは、遠隔の攻撃者が細工した HTML ページを使ってサンドボックス内で任意のコードを実行させられる可能性があります。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できるため、ブラウザ上で不正な処理が行われる恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョン 153.0.8010.36 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも153.0.8010.36で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87491", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87491", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"153.0.8010.36\",\"status\":\"affected\",\"lessThan\":\"153.0.8010.36\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-87491\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-87491（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョン 153.0.8010.36 未満が影響を受けます。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも153.0.8010.36で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-87491", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.015Z", "lastSuccess": "2026-10-23T03:37:42.015Z", "sourceCheckedAt": "2026-10-23T02:43:51.683Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-75650", "aliases": [], "title": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source：コード実行", "summary": "Adobe Commerce はテンプレートエンジンで特別な要素の不適切な無効化により、現在のユーザーのコンテキストで任意のコードを実行できる脆弱性の影響を受けます。攻撃者はこの脆弱性を利用して任意のコードを実行でき、ユーザーの操作は不要です。スコープが変更されます。", "risk": "攻撃者が現在のユーザー権限で任意のコードを実行できる可能性がある。", "product": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "adobe", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Adobe Commerce", "range": "<= 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug" }, { "product": "Adobe Commerce B2B", "range": "<= 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug" }, { "product": "Magento Open Source", "range": "<= 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75650", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-07T20:17:16.761Z", "modifiedAt": "2026-09-09T04:25:47.708Z", "fetchedAt": "2026-10-23T02:43:50.699Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "sourceTitle": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Adobe Commerce", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Adobe Commerce B2B", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Magento Open Source", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-75650", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "fetchedAt": "2026-10-23T02:43:50.699Z", "publishedAt": "2026-09-07T20:17:16.761Z", "modifiedAt": "2026-09-09T04:25:47.708Z", "state": "published", "provider": "adobe", "title": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "descriptions": [ { "lang": "en", "value": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Adobe", "product": "Adobe Commerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Adobe Commerce B2B", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Magento Open Source", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-1336", "lang": "en", "description": "Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "adobe", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "adobe", "tags": [ "vendor-advisory" ], "provider": "adobe", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-1336\",\"description\":\"Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"availabilityRequirement\":\"NOT_DEFINED\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"environmentalScore\":10,\"environmentalSeverity\":\"CRITICAL\",\"exploitCodeMaturity\":\"NOT_DEFINED\",\"integrityImpact\":\"HIGH\",\"integrityRequirement\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"LOW\",\"modifiedAttackVector\":\"NETWORK\",\"modifiedAvailabilityImpact\":\"HIGH\",\"modifiedConfidentialityImpact\":\"HIGH\",\"modifiedIntegrityImpact\":\"HIGH\",\"modifiedPrivilegesRequired\":\"NONE\",\"modifiedScope\":\"CHANGED\",\"modifiedUserInteraction\":\"NONE\",\"privilegesRequired\":\"NONE\",\"remediationLevel\":\"NOT_DEFINED\",\"reportConfidence\":\"NOT_DEFINED\",\"scope\":\"CHANGED\",\"temporalScore\":10,\"temporalSeverity\":\"CRITICAL\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-09T04:25:47.708Z", "fetchedAt": "2026-10-23T02:43:50.699Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Adobe Commerce / Adobe Commerce B2B / Magento Open Sourceにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:59.253Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "721097c8a9e0c44f9fbd288dd78325d9bf6f6fae7471c5a0309086145f6c017e", "sourceModifiedAt": "2026-09-09T04:25:47.708Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Commerce はテンプレートエンジンで特別な要素の不適切な無効化により、現在のユーザーのコンテキストで任意のコードを実行できる脆弱性の影響を受けます。攻撃者はこの脆弱性を利用して任意のコードを実行でき、ユーザーの操作は不要です。スコープが変更されます。", "risk": "攻撃者が現在のユーザー権限で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Adobe Commerce はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Adobe Commerce B2B はバージョン 1.5.3-2026-aug、1.5.2-2026-aug、1.4.2-2026-aug、1.3.4-2026-aug、1.3.3-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Magento Open Source はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Commerce / Adobe Commerce B2B / Magento Open Source」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75650", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/title", "excerpt": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-75650\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-75650（Adobe Commerce / Adobe Commerce B2B / Magento Open Source）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Adobe Commerce はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下で影響を受ける。\n・Adobe Commerce B2B はバージョン 1.5.3-2026-aug、1.5.2-2026-aug、1.4.2-2026-aug、1.3.4-2026-aug、1.3.3-2026-aug 以下で影響を受ける。\n・Magento Open Source はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug 以下で影響を受ける。\n・公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-75650", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:59.253Z", "lastSuccess": "2026-10-23T03:21:59.253Z", "sourceCheckedAt": "2026-10-23T02:43:50.699Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } } ], "total": 2185, "limit": 20, "offset": 380, "filters": { "product": "all", "type": "all", "q": "", "page": 20 }, "pagination": { "page": 20, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 0, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T11:02:49.534Z 〜 2026-10-23T12:17:49.722Z、全製品の変更 0/0件まで確認、対象0件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T12:17:49.722Z", "lastAttempt": "2026-10-23T12:17:49.722Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }