{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-87491", "aliases": [], "title": "Chrome：コード実行", "summary": "Google Chrome の V8 エンジンで境界外書き込みが発生し、153.0.8010.36 より前のバージョンでは、遠隔の攻撃者が細工した HTML ページを使ってサンドボックス内で任意のコードを実行させられる可能性があります。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できるため、ブラウザ上で不正な処理が行われる恐れがあります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 153.0.8010.36 / < 153.0.8010.36" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87491", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87491", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-09T00:09:38.419Z", "modifiedAt": "2026-09-21T12:51:58.334Z", "fetchedAt": "2026-10-23T02:43:51.683Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "153.0.8010.36", "status": "affected", "lessThan": "153.0.8010.36", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-87491", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "fetchedAt": "2026-10-23T02:43:51.683Z", "publishedAt": "2026-09-09T00:09:38.419Z", "modifiedAt": "2026-09-21T12:51:58.334Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "153.0.8010.36", "lessThan": "153.0.8010.36", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "Out of bounds write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"153.0.8010.36\",\"status\":\"affected\",\"lessThan\":\"153.0.8010.36\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Out of bounds write\",\"cweId\":\"CWE-787\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T12:51:58.334Z", "fetchedAt": "2026-10-23T02:43:51.683Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-09T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Chromeにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.015Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "739de2019e1a46186bb6fad1236259be4a6c22b5cb9037b2ce99c792bfc02ee6", "sourceModifiedAt": "2026-09-21T12:51:58.334Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 エンジンで境界外書き込みが発生し、153.0.8010.36 より前のバージョンでは、遠隔の攻撃者が細工した HTML ページを使ってサンドボックス内で任意のコードを実行させられる可能性があります。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できるため、ブラウザ上で不正な処理が行われる恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョン 153.0.8010.36 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも153.0.8010.36で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-87491", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "https://issues.chromium.org/issues/543557673", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-87491" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-87491", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/543557673", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87491", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/87xxx/CVE-2026-87491.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"153.0.8010.36\",\"status\":\"affected\",\"lessThan\":\"153.0.8010.36\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-87491\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-87491（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョン 153.0.8010.36 未満が影響を受けます。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも153.0.8010.36で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-87491", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.015Z", "lastSuccess": "2026-10-23T03:37:42.015Z", "sourceCheckedAt": "2026-10-23T02:43:51.683Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-75650", "aliases": [], "title": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source：コード実行", "summary": "Adobe Commerce はテンプレートエンジンで特別な要素の不適切な無効化により、現在のユーザーのコンテキストで任意のコードを実行できる脆弱性の影響を受けます。攻撃者はこの脆弱性を利用して任意のコードを実行でき、ユーザーの操作は不要です。スコープが変更されます。", "risk": "攻撃者が現在のユーザー権限で任意のコードを実行できる可能性がある。", "product": "Adobe Commerce / Adobe Commerce B2B / Magento Open Source", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "adobe", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Adobe Commerce", "range": "<= 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug" }, { "product": "Adobe Commerce B2B", "range": "<= 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug" }, { "product": "Magento Open Source", "range": "<= 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75650", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-07T20:17:16.761Z", "modifiedAt": "2026-09-09T04:25:47.708Z", "fetchedAt": "2026-10-23T02:43:50.699Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "sourceTitle": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Adobe Commerce", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Adobe Commerce B2B", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] }, { "defaultStatus": "unaffected", "product": "Magento Open Source", "vendor": "Adobe", "versions": [ { "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "status": "affected", "version": "0", "versionType": "custom" }, { "status": "unaffected", "version": "Hotfix for CVE-2026-7565", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-75650", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "fetchedAt": "2026-10-23T02:43:50.699Z", "publishedAt": "2026-09-07T20:17:16.761Z", "modifiedAt": "2026-09-09T04:25:47.708Z", "state": "published", "provider": "adobe", "title": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "descriptions": [ { "lang": "en", "value": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Adobe", "product": "Adobe Commerce", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Adobe Commerce B2B", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThanOrEqual": "1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "Adobe", "product": "Magento Open Source", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThanOrEqual": "2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "Hotfix for CVE-2026-7565", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-1336", "lang": "en", "description": "Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "adobe", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "adobe", "tags": [ "vendor-advisory" ], "provider": "adobe", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-1336\",\"description\":\"Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"availabilityRequirement\":\"NOT_DEFINED\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"environmentalScore\":10,\"environmentalSeverity\":\"CRITICAL\",\"exploitCodeMaturity\":\"NOT_DEFINED\",\"integrityImpact\":\"HIGH\",\"integrityRequirement\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"LOW\",\"modifiedAttackVector\":\"NETWORK\",\"modifiedAvailabilityImpact\":\"HIGH\",\"modifiedConfidentialityImpact\":\"HIGH\",\"modifiedIntegrityImpact\":\"HIGH\",\"modifiedPrivilegesRequired\":\"NONE\",\"modifiedScope\":\"CHANGED\",\"modifiedUserInteraction\":\"NONE\",\"privilegesRequired\":\"NONE\",\"remediationLevel\":\"NOT_DEFINED\",\"reportConfidence\":\"NOT_DEFINED\",\"scope\":\"CHANGED\",\"temporalScore\":10,\"temporalSeverity\":\"CRITICAL\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-09T04:25:47.708Z", "fetchedAt": "2026-10-23T02:43:50.699Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Adobe Commerce / Adobe Commerce B2B / Magento Open Sourceにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:21:59.253Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "721097c8a9e0c44f9fbd288dd78325d9bf6f6fae7471c5a0309086145f6c017e", "sourceModifiedAt": "2026-09-09T04:25:47.708Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Adobe Commerce はテンプレートエンジンで特別な要素の不適切な無効化により、現在のユーザーのコンテキストで任意のコードを実行できる脆弱性の影響を受けます。攻撃者はこの脆弱性を利用して任意のコードを実行でき、ユーザーの操作は不要です。スコープが変更されます。", "risk": "攻撃者が現在のユーザー権限で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Adobe Commerce はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Adobe Commerce B2B はバージョン 1.5.3-2026-aug、1.5.2-2026-aug、1.4.2-2026-aug、1.3.4-2026-aug、1.3.3-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Magento Open Source はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug 以下で影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Adobe Commerce / Adobe Commerce B2B / Magento Open Source」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-75650", "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-75650" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "label": "CVE：adobe" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75650", "label": "CVE公式レコード" }, { "url": "https://helpx.adobe.com/security/products/magento/apsb26-146.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75650", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/title", "excerpt": "Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Adobe Commerce B2B\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/75xxx/CVE-2026-75650.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Magento Open Source\",\"vendor\":\"Adobe\",\"versions\":[{\"lessThanOrEqual\":\"2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"Hotfix for CVE-2026-7565\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-75650", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-75650\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-75650（Adobe Commerce / Adobe Commerce B2B / Magento Open Source）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Adobe Commerce はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug、2.4.5-2026-aug、2.4.4-2026-aug 以下で影響を受ける。\n・Adobe Commerce B2B はバージョン 1.5.3-2026-aug、1.5.2-2026-aug、1.4.2-2026-aug、1.3.4-2026-aug、1.3.3-2026-aug 以下で影響を受ける。\n・Magento Open Source はバージョン 2.4.9-2026-aug、2.4.8-2026-aug、2.4.7-2026-aug、2.4.6-2026-aug 以下で影響を受ける。\n・公式の対象表：Adobe / Adobe Commerce。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・公式の対象表：Adobe / Adobe Commerce B2B。影響ありとして記載：1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・公式の対象表：Adobe / Magento Open Source。影響ありとして記載：2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug以下の版。影響なしとして記載：Hotfix for CVE-2026-7565。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-75650", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:21:59.253Z", "lastSuccess": "2026-10-23T03:21:59.253Z", "sourceCheckedAt": "2026-10-23T02:43:50.699Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-81963", "aliases": [], "title": "Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows Server 2025 / Windows Server 2025 (Server Core installation)：権限の奪取", "summary": "Windows Update Stack のリンク解決の不備（リンクフォロー）により、認可された攻撃者がローカルで権限を昇格できる。", "risk": "攻撃者がローカルで権限を昇格できる可能性がある。", "product": "Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows Server 2025 / Windows Server 2025 (Server Core installation)", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 11 version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.7582（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.7582（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.9445（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 Version 25H2", "range": ">= 10.0.26200.0 / < 10.0.26200.9445（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 26H1", "range": ">= 10.0.28000.0 / < 10.0.28000.2954（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.33438（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.33438（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-81963", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963", "label": "Windows Update Stack Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2026-09-08T17:19:13.121Z", "modifiedAt": "2026-10-14T23:14:33.668Z", "fetchedAt": "2026-10-23T02:43:51.118Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Update Stack Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.7582", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.7582", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.9445", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26200.0", "lessThan": "10.0.26200.9445", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.28000.0", "lessThan": "10.0.28000.2954", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.33438", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.33438", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: ARM64-based Systems / x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-81963", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "fetchedAt": "2026-10-23T02:43:51.118Z", "publishedAt": "2026-09-08T17:19:13.121Z", "modifiedAt": "2026-10-14T23:14:33.668Z", "state": "published", "provider": "microsoft", "title": "Windows Update Stack Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 11 version 23H2", "sourcePath": "/containers/cna/affected/0", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.7582", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.7582", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.9445", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.26200.0", "lessThan": "10.0.26200.9445", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "sourcePath": "/containers/cna/affected/4", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.28000.0", "lessThan": "10.0.28000.2954", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.33438", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/6", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.33438", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-59", "lang": "en-US", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-284", "lang": "en-US", "description": "CWE-284: Improper Access Control", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963", "label": "Windows Update Stack Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81963", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.7582\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.7582\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.9445\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.9445\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.2954\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.33438\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.33438\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-59: Improper Link Resolution Before File Access ('Link Following')\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-59\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1", "text": "{\"description\":\"CWE-284: Improper Access Control\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-284\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-14T23:14:33.668Z", "fetchedAt": "2026-10-23T02:43:51.118Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows Server 2025 / Windows Server 2025 (Server Core installation)に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:00.458Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "02a348c1f7fc2e3416d13fadb39f662a56e5c53d3e159a03f940664ddd8fbe53", "sourceModifiedAt": "2026-10-14T23:14:33.668Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Update Stack のリンク解決の不備（リンクフォロー）により、認可された攻撃者がローカルで権限を昇格できる。", "risk": "攻撃者がローカルで権限を昇格できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows 11 version 23H2 の ARM64 系統、バージョン 10.0.22631.0 から 10.0.22631.7582 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Windows 11 Version 23H2 の x64 系統、バージョン 10.0.22631.0 から 10.0.22631.7582 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Windows 11 Version 24H2 の ARM64 系統、バージョン 10.0.26100.0 から 10.0.26100.9445 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Windows 11 Version 24H2 の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.9445 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Windows 11 Version 25H2 の ARM64 系統、バージョン 10.0.26200.0 から 10.0.26200.9445 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "Windows 11 Version 25H2 の x64 系統、バージョン 10.0.26200.0 から 10.0.26200.9445 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "Windows 11 version 26H1 の ARM64 系統、バージョン 10.0.28000.0 から 10.0.28000.2954 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "Windows 11 version 26H1 の x64 系統、バージョン 10.0.28000.0 から 10.0.28000.2954 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "Windows Server 2025 の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.33438 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E8", "E2" ] }, { "text": "Windows Server 2025 (Server Core installation) の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.33438 未満 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E9", "E2" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.7582未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.7582未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.9445未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.9445未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.2954未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.33438未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.33438未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E9" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963" ], "evidenceIds": [ "E10" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2026-81963", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-81963" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-81963", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963", "label": "Windows Update Stack Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-81963", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81963", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Update Stack Elevation of Privilege Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 23H2\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.7582\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.7582\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.9445\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.9445\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.2954\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.33438\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81963.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.33438\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81963", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-81963\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-81963（Windows 11 version 23H2 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows Server 2025 / Windows Server 2025 (Server Core installation)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 11 version 23H2 の ARM64 系統、バージョン 10.0.22631.0 から 10.0.22631.7582 未満 が影響を受ける。\n・Windows 11 Version 23H2 の x64 系統、バージョン 10.0.22631.0 から 10.0.22631.7582 未満 が影響を受ける。\n・Windows 11 Version 24H2 の ARM64 系統、バージョン 10.0.26100.0 から 10.0.26100.9445 未満 が影響を受ける。\n・Windows 11 Version 24H2 の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.9445 未満 が影響を受ける。\n・Windows 11 Version 25H2 の ARM64 系統、バージョン 10.0.26200.0 から 10.0.26200.9445 未満 が影響を受ける。\n・Windows 11 Version 25H2 の x64 系統、バージョン 10.0.26200.0 から 10.0.26200.9445 未満 が影響を受ける。\n・Windows 11 version 26H1 の ARM64 系統、バージョン 10.0.28000.0 から 10.0.28000.2954 未満 が影響を受ける。\n・Windows 11 version 26H1 の x64 系統、バージョン 10.0.28000.0 から 10.0.28000.2954 未満 が影響を受ける。\n・Windows Server 2025 の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.33438 未満 が影響を受ける。\n・Windows Server 2025 (Server Core installation) の x64 系統、バージョン 10.0.26100.0 から 10.0.26100.33438 未満 が影響を受ける。\n・公式の対象表：Microsoft / Windows 11 version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.7582未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.7582未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.9445未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.9445未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.2954未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.33438未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.33438未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-81963", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:00.458Z", "lastSuccess": "2026-10-23T03:22:00.458Z", "sourceCheckedAt": "2026-10-23T02:43:51.118Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-85880", "aliases": [], "title": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows Server 2012 / Windows Server 2012 (Server Core installation) / Windows Server 2012 R2 / Windows Server 2012 R2 (Server Core installation) ：権限の奪取", "summary": "Windows Advanced Local Procedure Call (ALPC) のヒープベースバッファオーバーフローにより、認可された攻撃者がローカルで特権を昇格させることができる脆弱性です。", "risk": "認可された攻撃者がローカルで特権を昇格させる可能性があります。", "product": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows Server 2012 / Windows Server 2012 (Server Core installation) / Windows Server 2012 R2 / Windows Server 2012 R2 (Server Core installation) ", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.9512（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.9245（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.7725（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.7725（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.26349（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.26349（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.23398（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.23398（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.9512（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.9512（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.9245（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.9245（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.5622（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85880", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880", "label": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85880", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2026-09-08T17:14:21.465Z", "modifiedAt": "2026-10-14T23:09:31.608Z", "fetchedAt": "2026-10-23T02:43:51.492Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.7725", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.7725", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.26349", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.26349", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23398", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23398", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.5622", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-85880", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "fetchedAt": "2026-10-23T02:43:51.492Z", "publishedAt": "2026-09-08T17:14:21.465Z", "modifiedAt": "2026-10-14T23:09:31.608Z", "state": "published", "provider": "microsoft", "title": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.7725", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.7725", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/4", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.26349", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.26349", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23398", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/7", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23398", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/8", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/9", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.9512", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.9245", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.5622", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-122", "lang": "en-US", "description": "CWE-122: Heap-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-908", "lang": "en-US", "description": "CWE-908: Use of Uninitialized Resource", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880", "label": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.7725\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.7725\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.26349\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.26349\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23398\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23398\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.5622\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-122: Heap-based Buffer Overflow\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-122\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/1", "text": "{\"description\":\"CWE-908: Use of Uninitialized Resource\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-908\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-14T23:09:31.608Z", "fetchedAt": "2026-10-23T02:43:51.492Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows Server 2012 / Windows Server 2012 (Server Core installation) / Windows Server 2012 R2 / Windows Server 2012 R2 (Server Core installation) に権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:02.707Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5a94d11bf3e03cd78ca78c7d9f4c8933ea1e010c6eefa0b585a0a470ac1a6668", "sourceModifiedAt": "2026-10-14T23:09:31.608Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Advanced Local Procedure Call (ALPC) のヒープベースバッファオーバーフローにより、認可された攻撃者がローカルで特権を昇格させることができる脆弱性です。", "risk": "認可された攻撃者がローカルで特権を昇格させる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Windows 10 Version 1607 の 10.0.14393.0 以上 10.0.14393.9512 未満の 32 ビットシステムおよび x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E3", "E1" ] }, { "text": "Windows 10 Version 1809 の 10.0.17763.0 以上 10.0.17763.9245 未満の 32 ビットシステムおよび x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E4", "E1" ] }, { "text": "Windows 10 Version 21H2 の 10.0.19044.0 以上 10.0.19044.7725 未満の 32 ビット、ARM64 ベース、x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E5", "E1" ] }, { "text": "Windows 10 Version 22H2 の 10.0.19045.0 以上 10.0.19045.7725 未満の 32 ビット、ARM64 ベース、x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E6", "E1" ] }, { "text": "Windows Server 2012 の 6.2.9200.0 以上 6.2.9200.26349 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E7", "E1" ] }, { "text": "Windows Server 2012 (Server Core インストール) の 6.2.9200.0 以上 6.2.9200.26349 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E8", "E1" ] }, { "text": "Windows Server 2012 R2 の 6.3.9600.0 以上 6.3.9600.23398 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E9", "E1" ] }, { "text": "Windows Server 2012 R2 (Server Core インストール) の 6.3.9600.0 以上 6.3.9600.23398 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E10", "E1" ] }, { "text": "Windows Server 2016 の 10.0.14393.0 以上 10.0.14393.9512 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E11", "E1" ] }, { "text": "Windows Server 2016 (Server Core インストール) の 10.0.14393.0 以上 10.0.14393.9512 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E12", "E1" ] }, { "text": "Windows Server 2019 の 10.0.17763.0 以上 10.0.17763.9245 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E13", "E1" ] }, { "text": "Windows Server 2019 (Server Core インストール) の 10.0.17763.0 以上 10.0.17763.9245 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E14", "E1" ] }, { "text": "Windows Server 2022 の 10.0.20348.0 以上 10.0.20348.5622 未満の x64 ベースシステムが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E15", "E1" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.7725未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.7725未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.26349未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.26349未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23398未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23398未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.5622未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E15" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880" ], "evidenceIds": [ "E16" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2026-85880", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880", "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85880" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85880", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880", "label": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-85880", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85880", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.7725\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.7725\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.26349\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.26349\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23398\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23398\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.9512\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.9245\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85880.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.5622\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85880", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-85880\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-85880（Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows Server 2012 / Windows Server 2012 (Server Core installation) / Windows Server 2012 R2 / Windows Server 2012 R2 (Server Core installation) ）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 10 Version 1607 の 10.0.14393.0 以上 10.0.14393.9512 未満の 32 ビットシステムおよび x64 ベースシステムが影響を受けます。\n・Windows 10 Version 1809 の 10.0.17763.0 以上 10.0.17763.9245 未満の 32 ビットシステムおよび x64 ベースシステムが影響を受けます。\n・Windows 10 Version 21H2 の 10.0.19044.0 以上 10.0.19044.7725 未満の 32 ビット、ARM64 ベース、x64 ベースシステムが影響を受けます。\n・Windows 10 Version 22H2 の 10.0.19045.0 以上 10.0.19045.7725 未満の 32 ビット、ARM64 ベース、x64 ベースシステムが影響を受けます。\n・Windows Server 2012 の 6.2.9200.0 以上 6.2.9200.26349 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2012 (Server Core インストール) の 6.2.9200.0 以上 6.2.9200.26349 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2012 R2 の 6.3.9600.0 以上 6.3.9600.23398 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2012 R2 (Server Core インストール) の 6.3.9600.0 以上 6.3.9600.23398 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2016 の 10.0.14393.0 以上 10.0.14393.9512 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2016 (Server Core インストール) の 10.0.14393.0 以上 10.0.14393.9512 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2019 の 10.0.17763.0 以上 10.0.17763.9245 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2019 (Server Core インストール) の 10.0.17763.0 以上 10.0.17763.9245 未満の x64 ベースシステムが影響を受けます。\n・Windows Server 2022 の 10.0.20348.0 以上 10.0.20348.5622 未満の x64 ベースシステムが影響を受けます。\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.7725未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.7725未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.26349未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.26349未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23398未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23398未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.9512未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.9245未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.5622未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-85880", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:02.707Z", "lastSuccess": "2026-10-23T03:22:02.707Z", "sourceCheckedAt": "2026-10-23T02:43:51.492Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-86218", "aliases": [], "title": "N-central：コード実行", "summary": "N‑central は認証前にリモートコード実行が可能な脆弱性があります。影響は 2026.3.1.14 より前のバージョンです。", "risk": "攻撃者が認証前にコードを実行できる可能性があります。", "product": "N-central", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "4.0", "cvssSource": "N-able", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "affected": [ { "product": "N-central", "range": "< 2026.3.1.14" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "label": "CVE：N-able" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86218", "label": "CVE公式レコード" }, { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "label": "CISAが示す関連情報" }, { "url": "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86218", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-06T02:15:28.824Z", "modifiedAt": "2026-09-09T04:25:45.576Z", "fetchedAt": "2026-10-23T02:43:51.541Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "sourceTitle": "pre-authentication remote code execution", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "N-able", "product": "N-central", "versions": [ { "status": "affected", "version": "0", "lessThan": "2026.3.1.14", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-86218", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "fetchedAt": "2026-10-23T02:43:51.541Z", "publishedAt": "2026-09-06T02:15:28.824Z", "modifiedAt": "2026-09-09T04:25:45.576Z", "state": "published", "provider": "N-able", "title": "pre-authentication remote code execution", "descriptions": [ { "lang": "en", "value": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "N-able", "product": "N-central", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "2026.3.1.14", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-96", "lang": "en", "description": "CWE-96 Improper neutralization of directives in statically saved code ('static code injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "N-able", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "label": "N-able", "tags": [ "vendor-advisory" ], "provider": "N-able", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-86218", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"N-able\",\"product\":\"N-central\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"2026.3.1.14\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-96\",\"description\":\"CWE-96 Improper neutralization of directives in statically saved code ('static code injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":10,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-09T04:25:45.576Z", "fetchedAt": "2026-10-23T02:43:51.541Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-08T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "N-centralにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:03.917Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "45d14d5949968d29c3bfa6fa81e5631fba4aa9b6651584843c2bc6cb88b07691", "sourceModifiedAt": "2026-09-09T04:25:45.576Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "N‑central は認証前にリモートコード実行が可能な脆弱性があります。影響は 2026.3.1.14 より前のバージョンです。", "risk": "攻撃者が認証前にコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "2026.3.1.14 より前の N‑central バージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：N-able / N-central。影響ありとして記載：2026.3.1.14未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json" ], "evidenceIds": [ "E3" ] }, { "text": "「N-central」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-86218", "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86218" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-86218", "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86218" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-86218", "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-86218" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "label": "CVE：N-able" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86218", "label": "CVE公式レコード" }, { "url": "https://me.n-able.com/s/security-advisory/aArVy0000002Ld3KAE/cve202686218-preauthentication-remote-code-execution", "label": "CISAが示す関連情報" }, { "url": "https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86218", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourceField": "/containers/cna/title", "excerpt": "pre-authentication remote code execution", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86218.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"N-able\",\"product\":\"N-central\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"2026.3.1.14\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-86218", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-86218\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-86218（N-central）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・2026.3.1.14 より前の N‑central バージョンが影響を受けます。\n・公式の対象表：N-able / N-central。影響ありとして記載：2026.3.1.14未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-86218", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:03.917Z", "lastSuccess": "2026-10-23T03:22:03.917Z", "sourceCheckedAt": "2026-10-23T02:43:51.541Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-85046", "aliases": [], "title": "Chrome：コード実行", "summary": "Google Chrome の V8 エンジンで型混乱が発生し、152.0.7977.82 未満のバージョンでは、細工された HTML ページを通じてリモートの攻撃者がサンドボックス内で任意のコードを実行できる脆弱性です。", "risk": "リモートの攻撃者がサンドボックス内で任意のコードを実行できる可能性があります。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 152.0.7977.82 / < 152.0.7977.82" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85046", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/542403045", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85046", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-03T19:26:12.609Z", "modifiedAt": "2026-09-21T12:53:20.125Z", "fetchedAt": "2026-10-23T02:43:51.346Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "152.0.7977.82", "status": "affected", "lessThan": "152.0.7977.82", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-85046", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "fetchedAt": "2026-10-23T02:43:51.346Z", "publishedAt": "2026-09-03T19:26:12.609Z", "modifiedAt": "2026-09-21T12:53:20.125Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "152.0.7977.82", "lessThan": "152.0.7977.82", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-843", "lang": "en", "description": "Type confusion", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/542403045", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://serotav.github.io/Writeups/v8/when-sorting-leads-to-confusion/", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://github.com/v8/v8/commit/e0562d87ad9c17042b581582c99237d798572e67", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://github.com/Serotav/Writeups/blob/77556c57999805fa7815a114da51d91cf24fbea9/v8/When_Sorting_Leads_To_Confusion.md", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://news.ycombinator.com/item?id=49570669", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/3" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"152.0.7977.82\",\"status\":\"affected\",\"lessThan\":\"152.0.7977.82\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Type confusion\",\"cweId\":\"CWE-843\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T12:53:20.125Z", "fetchedAt": "2026-10-23T02:43:51.346Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-04T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Chromeにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.017Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9a138c68fb65f7f7b403125c0a6570e3469e768b96fe061f67995a6a8becfe14", "sourceModifiedAt": "2026-09-21T12:53:20.125Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome の V8 エンジンで型混乱が発生し、152.0.7977.82 未満のバージョンでは、細工された HTML ページを通じてリモートの攻撃者がサンドボックス内で任意のコードを実行できる脆弱性です。", "risk": "リモートの攻撃者がサンドボックス内で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョンが 152.0.7977.82 未満である場合に影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E2" ] }, { "text": "V8 エンジンにおける型混乱（type confusion）に起因する脆弱性です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも152.0.7977.82で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85046", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "https://issues.chromium.org/issues/542403045", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-85046", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "https://issues.chromium.org/issues/542403045", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-85046", "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "https://issues.chromium.org/issues/542403045", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-85046" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-85046", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/542403045", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85046", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"152.0.7977.82\",\"status\":\"affected\",\"lessThan\":\"152.0.7977.82\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/85xxx/CVE-2026-85046.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"Type confusion\",\"cweId\":\"CWE-843\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-85046", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-85046\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-85046（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョンが 152.0.7977.82 未満である場合に影響を受けます。\n・V8 エンジンにおける型混乱（type confusion）に起因する脆弱性です。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも152.0.7977.82で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-85046", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.017Z", "lastSuccess": "2026-10-23T03:37:42.017Z", "sourceCheckedAt": "2026-10-23T02:43:51.346Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-48710", "aliases": [], "title": "starlette：脆弱性情報", "summary": "Starlette は Host ヘッダーの検証が欠如しており、リクエストの URL のパス (request.url.path) が不正なヘッダーによって汚染され、パスベースのセキュリティチェックを回避できる状態です。", "risk": "request.url を基準にセキュリティ制限を行うミドルウェアやエンドポイントが回避され、意図しないアクセスが可能になる恐れがあります。", "product": "starlette", "category": "other", "component": "package", "severity": "medium", "cvss": 6.5, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "affected": [ { "product": "starlette", "range": "< 1.0.1" } ], "fixed": [], "steps": [ "Starlette をバージョン 1.0.1 以上にアップグレードしてください。", "「CVE-2026-48710」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710", "label": "CVE公式レコード" }, { "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "label": "CISAが示す関連情報" }, { "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "label": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6" }, { "url": "https://badhost.org/", "label": "https://badhost.org" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "label": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml" }, { "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "label": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette" }, { "url": "https://www.secwest.net/starlette", "label": "https://www.secwest.net/starlette" }, { "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "label": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-26T21:54:54.393Z", "modifiedAt": "2026-10-01T17:41:26.242Z", "fetchedAt": "2026-10-23T02:43:49.230Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.", "sourceTitle": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Kludex", "product": "starlette", "versions": [ { "version": "< 1.0.1", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-48710", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "fetchedAt": "2026-10-23T02:43:49.230Z", "publishedAt": "2026-05-26T21:54:54.393Z", "modifiedAt": "2026-10-01T17:41:26.242Z", "state": "published", "provider": "GitHub_M", "title": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "descriptions": [ { "lang": "en", "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Kludex", "product": "starlette", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "< 1.0.1", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1" } ], "references": [ { "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "label": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "label": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://badhost.org/", "label": "https://badhost.org", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "label": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "label": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.secwest.net/starlette", "label": "https://www.secwest.net/starlette", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/5" }, { "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "label": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/6" }, { "url": "https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48710", "label": "redhat-SADP", "tags": [ "vdb-entry", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742", "label": "RHBZ#2481742", "tags": [ "issue-tracking", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/1" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json", "label": "redhat-SADP", "tags": [ "x_sadp-csaf-vex" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30089", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/3" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30088", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24866", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/5" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23346", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43038", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37275", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/9" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34456", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/10" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44696", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/11" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22993", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/12" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26226", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/13" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51357", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/14" }, { "url": "https://access.redhat.com/errata/RHSA-2026:22992", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/15" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34532", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/16" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34526", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/17" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63337", "label": "redhat-SADP", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "provider": "redhat-SADP", "sourcePath": "/containers/adp/1/references/18" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Kludex\",\"product\":\"starlette\",\"versions\":[{\"version\":\"< 1.0.1\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-444\",\"lang\":\"en\",\"description\":\"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/1/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourcePath": "/containers/adp/1/metrics/1/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T17:41:26.242Z", "fetchedAt": "2026-10-23T02:43:49.230Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "starletteに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:05.352Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9bd7d25e27ff68c116a229b4b3d91af70af1ccb1eaecb3688c8dfb4463f8cebe", "sourceModifiedAt": "2026-10-01T17:41:26.242Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Starlette は Host ヘッダーの検証が欠如しており、リクエストの URL のパス (request.url.path) が不正なヘッダーによって汚染され、パスベースのセキュリティチェックを回避できる状態です。", "risk": "request.url を基準にセキュリティ制限を行うミドルウェアやエンドポイントが回避され、意図しないアクセスが可能になる恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "バージョン 1.0.1 未満の Starlette では、HTTP Host ヘッダーが検証されずに request.url が再構築されます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E3", "E2", "E1" ] }, { "text": "バージョン 1.0.1 以降では、RFC 9112 §3.2 および RFC 3986 §3.2.2 の文法に従って Host ヘッダーが検証され、異常な値は scope[\"server\"] にフォールバックします。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：Kludex / starlette。影響ありとして記載：< 1.0.1。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E3" ] }, { "text": "「starlette」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-48710", "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "https://badhost.org/", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "https://www.secwest.net/starlette", "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" ] } ], "actions": [ { "text": "Starlette をバージョン 1.0.1 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E2" ] }, { "text": "「CVE-2026-48710」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-48710", "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "https://badhost.org/", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "https://www.secwest.net/starlette", "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-48710", "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "https://badhost.org/", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "https://www.secwest.net/starlette", "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-48710", "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "https://badhost.org/", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "https://www.secwest.net/starlette", "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-48710", "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "https://badhost.org/", "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "https://www.secwest.net/starlette", "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710", "label": "CVE公式レコード" }, { "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr", "label": "CISAが示す関連情報" }, { "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6", "label": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6" }, { "url": "https://badhost.org/", "label": "https://badhost.org" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml", "label": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml" }, { "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette", "label": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette" }, { "url": "https://www.secwest.net/starlette", "label": "https://www.secwest.net/starlette" }, { "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette", "label": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourceField": "/containers/cna/title", "excerpt": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/48xxx/CVE-2026-48710.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Kludex\",\"product\":\"starlette\",\"versions\":[{\"version\":\"< 1.0.1\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48710", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-48710\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-48710（starlette）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 1.0.1 未満の Starlette では、HTTP Host ヘッダーが検証されずに request.url が再構築されます。\n・バージョン 1.0.1 以降では、RFC 9112 §3.2 および RFC 3986 §3.2.2 の文法に従って Host ヘッダーが検証され、異常な値は scope[\"server\"] にフォールバックします。\n・公式の対象表：Kludex / starlette。影響ありとして記載：< 1.0.1。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-48710", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:05.352Z", "lastSuccess": "2026-10-23T03:22:05.352Z", "sourceCheckedAt": "2026-10-23T02:43:49.230Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-49869", "aliases": [], "title": "kestra：コード実行", "summary": "Kestra はオープンソースのイベント駆動型オーケストレーションプラットフォームです。バージョン 1.0.45 未満および 1.3.21 未満（ただし 1.1.0 以上）では、AuthenticationFilter が request.getPath().endsWith(\"/configs\") でパブリック設定エンドポイントを Basic 認証から除外しています。このチェックは完全なパス一致ではなく末尾の文字列一致なので、最後のセグメントが \"configs\" である任意の API パスが認証を回避できます。認証されていないリモート攻撃者はこの欠陥を利用して、認証情報なしで任意のワークフローを作成・実行できます。Kestra には script 実行プラグイン（plugin‑script‑shell、plugin‑script‑python など）がデフォルトで有効になっているため、攻撃者はワーカーコンテナ内で root 権限のリモートコード実行を行うことができます。この脆弱性は 1.0.45 と 1.3.21 で修正されています。", "risk": "認証されていない攻撃者がコンテナ内で root 権限のコードを実行できるため、システム全体が乗っ取られる可能性があります。", "product": "kestra", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "GitHub_M", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "kestra", "range": "< 1.0.45" }, { "product": "kestra", "range": ">= 1.1.0, < 1.3.21" } ], "fixed": [], "steps": [ "この脆弱性は 1.0.45 と 1.3.21 で修正されています。", "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-49869", "label": "CVE公式レコード" }, { "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49869", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-06-26T20:58:19.576Z", "modifiedAt": "2026-09-03T03:55:27.114Z", "fetchedAt": "2026-10-23T02:43:49.303Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.", "sourceTitle": "Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "kestra-io", "product": "kestra", "versions": [ { "version": "< 1.0.45", "status": "affected" }, { "version": ">= 1.1.0, < 1.3.21", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-49869", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "fetchedAt": "2026-10-23T02:43:49.303Z", "publishedAt": "2026-06-26T20:58:19.576Z", "modifiedAt": "2026-09-03T03:55:27.114Z", "state": "published", "provider": "GitHub_M", "title": "Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`", "descriptions": [ { "lang": "en", "value": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "kestra-io", "product": "kestra", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "< 1.0.45", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": ">= 1.1.0, < 1.3.21", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" }, { "cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "sourcePath": "/containers/cna/problemTypes/2/descriptions/0" }, { "cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "sourcePath": "/containers/cna/problemTypes/3/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-49869", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"kestra-io\",\"product\":\"kestra\",\"versions\":[{\"version\":\"< 1.0.45\",\"status\":\"affected\"},{\"version\":\">= 1.1.0, < 1.3.21\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"lang\":\"en\",\"description\":\"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-184\",\"lang\":\"en\",\"description\":\"CWE-184: Incomplete List of Disallowed Inputs\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/2/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/problemTypes/2/descriptions/0", "text": "{\"cweId\":\"CWE-287\",\"lang\":\"en\",\"description\":\"CWE-287: Improper Authentication\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/3/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/problemTypes/3/descriptions/0", "text": "{\"cweId\":\"CWE-918\",\"lang\":\"en\",\"description\":\"CWE-918: Server-Side Request Forgery (SSRF)\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-03T03:55:27.114Z", "fetchedAt": "2026-10-23T02:43:49.303Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "kestraにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:06.116Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "02ae0157e8d8f06f17926ea288f11cfdd3be9350f91ac2acd24f95164078f028", "sourceModifiedAt": "2026-09-03T03:55:27.114Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Kestra はオープンソースのイベント駆動型オーケストレーションプラットフォームです。バージョン 1.0.45 未満および 1.3.21 未満（ただし 1.1.0 以上）では、AuthenticationFilter が request.getPath().endsWith(\"/configs\") でパブリック設定エンドポイントを Basic 認証から除外しています。このチェックは完全なパス一致ではなく末尾の文字列一致なので、最後のセグメントが \"configs\" である任意の API パスが認証を回避できます。認証されていないリモート攻撃者はこの欠陥を利用して、認証情報なしで任意のワークフローを作成・実行できます。Kestra には script 実行プラグイン（plugin‑script‑shell、plugin‑script‑python など）がデフォルトで有効になっているため、攻撃者はワーカーコンテナ内で root 権限のリモートコード実行を行うことができます。この脆弱性は 1.0.45 と 1.3.21 で修正されています。", "risk": "認証されていない攻撃者がコンテナ内で root 権限のコードを実行できるため、システム全体が乗っ取られる可能性があります。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は Kestra OSS のバージョンが 1.0.45 未満、または 1.1.0 以上かつ 1.3.21 未満の場合です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "AuthenticationFilter が request.getPath().endsWith(\"/configs\") でパブリック設定エンドポイントを除外していることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "プラグイン script‑shell、script‑python などがデフォルトで有効になっていることが前提です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "API のパスの最後のセグメントが \"configs\" である任意のリクエストは認証をバイパスします。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：kestra-io / kestra。影響ありとして記載：< 1.0.45。影響ありとして記載：>= 1.1.0, < 1.3.21。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E3" ] }, { "text": "「kestra」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-49869", "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-49869" ] } ], "actions": [ { "text": "この脆弱性は 1.0.45 と 1.3.21 で修正されています。", "kind": "fix", "evidenceIds": [ "E1", "E2", "E3" ], "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ] }, { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-49869", "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-49869" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-49869", "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-49869" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-49869", "label": "CVE公式レコード" }, { "url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-5vc5-wxxq-3fjx", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49869", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith(\"/configs\") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourceField": "/containers/cna/title", "excerpt": "Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/49xxx/CVE-2026-49869.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"kestra-io\",\"product\":\"kestra\",\"versions\":[{\"version\":\"< 1.0.45\",\"status\":\"affected\"},{\"version\":\">= 1.1.0, < 1.3.21\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-49869", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-49869\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-49869（kestra）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は Kestra OSS のバージョンが 1.0.45 未満、または 1.1.0 以上かつ 1.3.21 未満の場合です。\n・AuthenticationFilter が request.getPath().endsWith(\"/configs\") でパブリック設定エンドポイントを除外していることが前提です。\n・プラグイン script‑shell、script‑python などがデフォルトで有効になっていることが前提です。\n・API のパスの最後のセグメントが \"configs\" である任意のリクエストは認証をバイパスします。\n・公式の対象表：kestra-io / kestra。影響ありとして記載：< 1.0.45。影響ありとして記載：>= 1.1.0, < 1.3.21。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-49869", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:06.116Z", "lastSuccess": "2026-10-23T03:22:06.116Z", "sourceCheckedAt": "2026-10-23T02:43:49.303Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-59822", "aliases": [], "title": "litellm：認証の回避", "summary": "LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーです。バージョン1.84.0未満では、MCP Streamable HTTPエンドポイントに対し、認証されていない攻撃者が偽装したAuthorizationヘッダーを送ると、OAuth2パススルーのフォールバックが作動し、失敗したLiteLLMキーの検証が空のUserAPIKeyAuthオブジェクトに置き換えられ、正当なLiteLLMキーがなくてもMCPツールにリクエストが届くようになります。この問題はバージョン1.84.0で修正されています。", "risk": "有効なLiteLLMキーを持たない攻撃者でもMCPツールにリクエストを送信できるようになる可能性があります。", "product": "litellm", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "4.0", "cvssSource": "GitHub_M", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "affected": [ { "product": "litellm", "range": "< 1.84.0" } ], "fixed": [], "steps": [ "LiteLLMをバージョン1.84.0以降にアップグレードする。", "「CVE-2026-59822」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59822", "label": "CVE公式レコード" }, { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "label": "CISAが示す関連情報" }, { "url": "https://github.com/BerriAI/litellm/pull/26463", "label": "https://github.com/BerriAI/litellm/pull/26463" }, { "url": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "label": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-08T19:32:18.611Z", "modifiedAt": "2026-09-03T03:56:05.174Z", "fetchedAt": "2026-10-23T02:43:49.700Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "sourceTitle": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "BerriAI", "product": "litellm", "versions": [ { "version": "< 1.84.0", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-59822", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "fetchedAt": "2026-10-23T02:43:49.700Z", "publishedAt": "2026-07-08T19:32:18.611Z", "modifiedAt": "2026-09-03T03:56:05.174Z", "state": "published", "provider": "GitHub_M", "title": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback", "descriptions": [ { "lang": "en", "value": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "BerriAI", "product": "litellm", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "< 1.84.0", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "GitHub_M", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "label": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "tags": [ "x_refsource_CONFIRM" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/BerriAI/litellm/pull/26463", "label": "https://github.com/BerriAI/litellm/pull/26463", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "label": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "tags": [ "x_refsource_MISC" ], "provider": "GitHub_M", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.wiz.io/blog/ai-infrastructure-honeypot", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-59822", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"BerriAI\",\"product\":\"litellm\",\"versions\":[{\"version\":\"< 1.84.0\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-287\",\"lang\":\"en\",\"description\":\"CWE-287: Improper Authentication\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"cweId\":\"CWE-306\",\"lang\":\"en\",\"description\":\"CWE-306: Missing Authentication for Critical Function\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N\",\"version\":\"4.0\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-03T03:56:05.174Z", "fetchedAt": "2026-10-23T02:43:49.700Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "litellmに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:06.328Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "633d7269949bd7d61413ed0cdc644f7aa16909296cdc3abe31f0721e90bb587b", "sourceModifiedAt": "2026-09-03T03:56:05.174Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "LiteLLMはAIゲートウェイとしてLLM APIを呼び出すプロキシサーバーです。バージョン1.84.0未満では、MCP Streamable HTTPエンドポイントに対し、認証されていない攻撃者が偽装したAuthorizationヘッダーを送ると、OAuth2パススルーのフォールバックが作動し、失敗したLiteLLMキーの検証が空のUserAPIKeyAuthオブジェクトに置き換えられ、正当なLiteLLMキーがなくてもMCPツールにリクエストが届くようになります。この問題はバージョン1.84.0で修正されています。", "risk": "有効なLiteLLMキーを持たない攻撃者でもMCPツールにリクエストを送信できるようになる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象製品はLiteLLMである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "影響を受けるバージョンは1.84.0未満である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "MCP Streamable HTTPエンドポイントが有効であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が認証されていない（未認証）状態であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "攻撃者が偽装したAuthorizationヘッダーを送信できること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "OAuth2パススルーのフォールバックパスが作動すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "失敗したLiteLLMキー検証が空のUserAPIKeyAuth()オブジェクトに置き換えられること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：BerriAI / litellm。影響ありとして記載：< 1.84.0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E3" ] }, { "text": "「litellm」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ] } ], "actions": [ { "text": "LiteLLMをバージョン1.84.0以降にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-59822」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-59822", "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "https://github.com/BerriAI/litellm/pull/26463", "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-59822" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "label": "CVE：GitHub_M" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59822", "label": "CVE公式レコード" }, { "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-7488-6r32-c95q", "label": "CISAが示す関連情報" }, { "url": "https://github.com/BerriAI/litellm/pull/26463", "label": "https://github.com/BerriAI/litellm/pull/26463" }, { "url": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c", "label": "https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c" }, { "url": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0", "label": "https://github.com/BerriAI/litellm/releases/tag/v1.84.0" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59822", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourceField": "/containers/cna/title", "excerpt": "LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59822.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"BerriAI\",\"product\":\"litellm\",\"versions\":[{\"version\":\"< 1.84.0\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-59822", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-59822\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-59822（litellm）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品はLiteLLMである。\n・影響を受けるバージョンは1.84.0未満である。\n・MCP Streamable HTTPエンドポイントが有効であること。\n・攻撃者が認証されていない（未認証）状態であること。\n・攻撃者が偽装したAuthorizationヘッダーを送信できること。\n・OAuth2パススルーのフォールバックパスが作動すること。\n・失敗したLiteLLMキー検証が空のUserAPIKeyAuth()オブジェクトに置き換えられること。\n・公式の対象表：BerriAI / litellm。影響ありとして記載：< 1.84.0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-59822", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:06.328Z", "lastSuccess": "2026-10-23T03:22:06.328Z", "sourceCheckedAt": "2026-10-23T02:43:49.700Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-82329", "aliases": [], "title": "artifactory：認証の回避", "summary": "JFrog Artifactory には認証の弱点があり、デフォルト設定のままではネットワークに接続できる認証されていない攻撃者が管理者権限を取得できる可能性があります。", "risk": "認証されていない攻撃者が管理者権限を取得できる可能性があります。", "product": "artifactory", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "JFROG", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "artifactory", "range": "< 7.111.21" }, { "product": "artifactory", "range": ">= 7.117.0 / < 7.117.28" }, { "product": "artifactory", "range": ">= 7.125.0 / < 7.125.20" }, { "product": "artifactory", "range": ">= 7.133.0 / < 7.133.29" }, { "product": "artifactory", "range": ">= 7.146.0 / < 7.146.38" }, { "product": "artifactory", "range": ">= 7.161.0 / < 7.161.20" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-82329", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82329", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-28T18:27:43.632Z", "modifiedAt": "2026-09-03T03:56:03.621Z", "fetchedAt": "2026-10-23T02:43:51.183Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.", "sourceTitle": "Potential authentication bypass leading to administrative access in Artifactory", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "jfrog", "product": "artifactory", "versions": [ { "status": "affected", "version": "0", "lessThan": "7.111.21", "versionType": "custom" }, { "status": "affected", "version": "7.117.0", "lessThan": "7.117.28", "versionType": "custom" }, { "status": "affected", "version": "7.125.0", "lessThan": "7.125.20", "versionType": "custom" }, { "status": "affected", "version": "7.133.0", "lessThan": "7.133.29", "versionType": "custom" }, { "status": "affected", "version": "7.146.0", "lessThan": "7.146.38", "versionType": "custom" }, { "status": "affected", "version": "7.161.0", "lessThan": "7.161.20", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-82329", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "fetchedAt": "2026-10-23T02:43:51.183Z", "publishedAt": "2026-08-28T18:27:43.632Z", "modifiedAt": "2026-09-03T03:56:03.621Z", "state": "published", "provider": "JFROG", "title": "Potential authentication bypass leading to administrative access in Artifactory", "descriptions": [ { "lang": "en", "value": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "jfrog", "product": "artifactory", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.111.21", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.117.0", "lessThan": "7.117.28", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.125.0", "lessThan": "7.125.20", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.133.0", "lessThan": "7.133.29", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "7.146.0", "lessThan": "7.146.38", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "7.161.0", "lessThan": "7.161.20", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "JFROG", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/0" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82329", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.111.21\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.117.0\",\"lessThan\":\"7.117.28\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.125.0\",\"lessThan\":\"7.125.20\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.133.0\",\"lessThan\":\"7.133.29\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.146.0\",\"lessThan\":\"7.146.38\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.161.0\",\"lessThan\":\"7.161.20\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-287\",\"description\":\"CWE-287 Improper Authentication\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-03T03:56:03.621Z", "fetchedAt": "2026-10-23T02:43:51.183Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "artifactoryに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:07.714Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "05e18c9a1fae1f8e8a1896e899c3ad5811f17834b8b1978410fab57368e0e5ce", "sourceModifiedAt": "2026-09-03T03:56:03.621Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "JFrog Artifactory には認証の弱点があり、デフォルト設定のままではネットワークに接続できる認証されていない攻撃者が管理者権限を取得できる可能性があります。", "risk": "認証されていない攻撃者が管理者権限を取得できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "デフォルト構成の Artifactory 環境で、ネットワークにアクセスできる認証されていない攻撃者が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：jfrog / artifactory。影響ありとして記載：7.111.21未満の版。影響ありとして記載：7.117.0以上、7.117.28未満。影響ありとして記載：7.125.0以上、7.125.20未満。影響ありとして記載：7.133.0以上、7.133.29未満。影響ありとして記載：7.146.0以上、7.146.38未満。影響ありとして記載：7.161.0以上、7.161.20未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json" ], "evidenceIds": [ "E3" ] }, { "text": "「artifactory」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-82329", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82329" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-82329", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82329" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-82329", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82329" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-82329", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82329", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourceField": "/containers/cna/title", "excerpt": "Potential authentication bypass leading to administrative access in Artifactory", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82329.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"jfrog\",\"product\":\"artifactory\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.111.21\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.117.0\",\"lessThan\":\"7.117.28\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.125.0\",\"lessThan\":\"7.125.20\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.133.0\",\"lessThan\":\"7.133.29\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.146.0\",\"lessThan\":\"7.146.38\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.161.0\",\"lessThan\":\"7.161.20\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82329", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-82329\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-82329（artifactory）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・デフォルト構成の Artifactory 環境で、ネットワークにアクセスできる認証されていない攻撃者が対象です。\n・公式の対象表：jfrog / artifactory。影響ありとして記載：7.111.21未満の版。影響ありとして記載：7.117.0以上、7.117.28未満。影響ありとして記載：7.125.0以上、7.125.20未満。影響ありとして記載：7.133.0以上、7.133.29未満。影響ありとして記載：7.146.0以上、7.146.38未満。影響ありとして記載：7.161.0以上、7.161.20未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-82329", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:07.714Z", "lastSuccess": "2026-10-23T03:22:07.714Z", "sourceCheckedAt": "2026-10-23T02:43:51.183Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-83548", "aliases": [], "title": "SMA1000：脆弱性情報", "summary": "SMA1000 アプライアンスの Work Place インターフェースに、意図しない別のアクセス経路があるため、認証前のサーバーサイドリクエストフォージェリ（SSRF）脆弱性が存在します。リモートの認証されていない攻撃者は、この脆弱性を利用して、機密機能へ不正にアクセスしたり、許可されていない操作を実行したりできる可能性があります。", "risk": "攻撃者が機密機能へ不正にアクセスし、許可されていない操作を実行できる可能性があります。", "product": "SMA1000", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA1000", "range": "12.4.3-03453 (platform-hotfix) and older versions（環境: Linux）" }, { "product": "SMA1000", "range": "12.5.0-02835 (platform-hotfix) and older versions（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-83548", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-01T21:25:45.368Z", "modifiedAt": "2026-09-03T03:55:31.337Z", "fetchedAt": "2026-10-23T02:43:51.264Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "SonicWall", "product": "SMA1000", "platforms": [ "Linux" ], "versions": [ { "status": "affected", "version": "12.4.3-03453 (platform-hotfix) and older versions" }, { "status": "affected", "version": "12.5.0-02835 (platform-hotfix) and older versions" } ], "defaultStatus": "unknown" } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-83548", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "fetchedAt": "2026-10-23T02:43:51.264Z", "publishedAt": "2026-09-01T21:25:45.368Z", "modifiedAt": "2026-09-03T03:55:31.337Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA1000", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4.3-03453 (platform-hotfix) and older versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5.0-02835 (platform-hotfix) and older versions", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side request forgery (SSRF)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" }, { "cweId": "CWE-441", "lang": "en", "description": "CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "sonicwall", "tags": [ "vendor-advisory" ], "provider": "sonicwall", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83548", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03453 (platform-hotfix) and older versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02835 (platform-hotfix) and older versions\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-918\",\"description\":\"CWE-918 Server-Side request forgery (SSRF)\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/problemTypes/1/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourcePath": "/containers/cna/problemTypes/1/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-441\",\"description\":\"CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":10,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-03T03:55:31.337Z", "fetchedAt": "2026-10-23T02:43:51.264Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "SMA1000に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:09.031Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "c68f19dbab93d842d00a770e1eaa0e3379944b5483e8466b15ee7479c61b8055", "sourceModifiedAt": "2026-09-03T03:55:31.337Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SMA1000 アプライアンスの Work Place インターフェースに、意図しない別のアクセス経路があるため、認証前のサーバーサイドリクエストフォージェリ（SSRF）脆弱性が存在します。リモートの認証されていない攻撃者は、この脆弱性を利用して、機密機能へ不正にアクセスしたり、許可されていない操作を実行したりできる可能性があります。", "risk": "攻撃者が機密機能へ不正にアクセスし、許可されていない操作を実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "SMA1000 アプライアンスの Work Place インターフェースにこの脆弱性が存在する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象プラットフォームは Linux である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "バージョン 12.4.3-03453 (platform-hotfix) 以前のすべてのバージョンが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "バージョン 12.5.0-02835 (platform-hotfix) 以前のすべてのバージョンが影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "攻撃者は認証されていないリモートの状態で利用できる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03453 (platform-hotfix) and older versions。影響ありとして記載：12.5.0-02835 (platform-hotfix) and older versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SMA1000」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-83548", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83548" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-83548", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83548" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-83548", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83548" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-83548", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83548", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83548.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03453 (platform-hotfix) and older versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02835 (platform-hotfix) and older versions\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83548", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-83548\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-83548（SMA1000）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SMA1000 アプライアンスの Work Place インターフェースにこの脆弱性が存在する。\n・対象プラットフォームは Linux である。\n・バージョン 12.4.3-03453 (platform-hotfix) 以前のすべてのバージョンが影響を受ける。\n・バージョン 12.5.0-02835 (platform-hotfix) 以前のすべてのバージョンが影響を受ける。\n・攻撃者は認証されていないリモートの状態で利用できる。\n・公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03453 (platform-hotfix) and older versions。影響ありとして記載：12.5.0-02835 (platform-hotfix) and older versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-83548", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:09.031Z", "lastSuccess": "2026-10-23T03:22:09.031Z", "sourceCheckedAt": "2026-10-23T02:43:51.264Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2026-83549", "aliases": [], "title": "SMA1000：コード実行", "summary": "SMA1000 Appliance Management Console (AMC) において、認証済みの管理者権限を持つリモート攻撃者が特定の条件下で任意の OS コマンドを実行できる可能性があり、結果としてサーバー上で攻撃者の命令が実行されるリモートコード実行が発生します。", "risk": "攻撃者が任意の OS コマンドを実行できるため、サーバー上で攻撃者の命令が実行されるリモートコード実行が起こります。", "product": "SMA1000", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA1000", "range": "12.4.3-03453 (platform-hotfix) and older versions（環境: Linux）" }, { "product": "SMA1000", "range": "12.5.0-02835 (platform-hotfix) and older versions（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-83549", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83549", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-09-01T21:28:50.717Z", "modifiedAt": "2026-09-21T13:07:29.786Z", "fetchedAt": "2026-10-23T02:43:51.270Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "SonicWall", "product": "SMA1000", "platforms": [ "Linux" ], "versions": [ { "status": "affected", "version": "12.4.3-03453 (platform-hotfix) and older versions" }, { "status": "affected", "version": "12.5.0-02835 (platform-hotfix) and older versions" } ], "defaultStatus": "unknown" } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-83549", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "fetchedAt": "2026-10-23T02:43:51.270Z", "publishedAt": "2026-09-01T21:28:50.717Z", "modifiedAt": "2026-09-21T13:07:29.786Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA1000", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4.3-03453 (platform-hotfix) and older versions", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5.0-02835 (platform-hotfix) and older versions", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "sonicwall", "tags": [ "vendor-advisory" ], "provider": "sonicwall", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-83549", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03453 (platform-hotfix) and older versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02835 (platform-hotfix) and older versions\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T13:07:29.786Z", "fetchedAt": "2026-10-23T02:43:51.270Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "SMA1000にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:09.671Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "149555a9b525176f53c8a8ae467b9be533f707cc683fdacb869621a6313aa9bc", "sourceModifiedAt": "2026-09-21T13:07:29.786Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SMA1000 Appliance Management Console (AMC) において、認証済みの管理者権限を持つリモート攻撃者が特定の条件下で任意の OS コマンドを実行できる可能性があり、結果としてサーバー上で攻撃者の命令が実行されるリモートコード実行が発生します。", "risk": "攻撃者が任意の OS コマンドを実行できるため、サーバー上で攻撃者の命令が実行されるリモートコード実行が起こります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるプラットフォームは Linux です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "バージョン 12.4.3-03453 (platform-hotfix) 以前のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "バージョン 12.5.0-02835 (platform-hotfix) 以前のすべてのバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "攻撃が成立するには、攻撃者が管理者として認証済みである必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03453 (platform-hotfix) and older versions。影響ありとして記載：12.5.0-02835 (platform-hotfix) and older versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SMA1000」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-83549", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83549" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-83549", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83549" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-83549", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-83549" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-83549", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0016", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83549", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/83xxx/CVE-2026-83549.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03453 (platform-hotfix) and older versions\"},{\"status\":\"affected\",\"version\":\"12.5.0-02835 (platform-hotfix) and older versions\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-83549", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-83549\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-83549（SMA1000）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるプラットフォームは Linux です。\n・バージョン 12.4.3-03453 (platform-hotfix) 以前のすべてのバージョンが影響を受けます。\n・バージョン 12.5.0-02835 (platform-hotfix) 以前のすべてのバージョンが影響を受けます。\n・攻撃が成立するには、攻撃者が管理者として認証済みである必要があります。\n・公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03453 (platform-hotfix) and older versions。影響ありとして記載：12.5.0-02835 (platform-hotfix) and older versions。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-83549", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:09.671Z", "lastSuccess": "2026-10-23T03:22:09.671Z", "sourceCheckedAt": "2026-10-23T02:43:51.270Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-9586", "aliases": [], "title": "Switchvox SMB Edition：コード実行", "summary": "認証されていないリモート攻撃者が、/pa エンドポイントに細工した XML を送信することで、PostgreSQL データベースに任意の SQL 文を実行させ、リモートコード実行を行える脆弱性が存在します。", "risk": "攻撃者は認証なしでバックエンドの PostgreSQL データベースに任意の SQL 文を実行でき、サーバー上で任意のコードを実行させられる可能性があります。", "product": "Switchvox SMB Edition", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "SRA", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "Switchvox SMB Edition", "range": ">= 8.3 (104997) / < 8.4.0.2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "label": "CVE：SRA" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-9586", "label": "CVE公式レコード" }, { "url": "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "label": "CISAが示す関連情報" }, { "url": "https://labs.sra.io/posts/switchvox/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9586", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-17T15:57:42.879Z", "modifiedAt": "2026-09-03T03:55:29.128Z", "fetchedAt": "2026-10-23T02:43:53.352Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "sourceTitle": "Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Sangoma", "product": "Switchvox SMB Edition", "versions": [ { "status": "affected", "version": "8.3 (104997)", "lessThan": "8.4.0.2", "versionType": "semver" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-9586", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "fetchedAt": "2026-10-23T02:43:53.352Z", "publishedAt": "2026-07-17T15:57:42.879Z", "modifiedAt": "2026-09-03T03:55:29.128Z", "state": "published", "provider": "SRA", "title": "Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB", "descriptions": [ { "lang": "en", "value": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Sangoma", "product": "Switchvox SMB Edition", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.3 (104997)", "lessThan": "8.4.0.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "SRA", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "label": "SRA", "tags": [ "release-notes" ], "provider": "SRA", "sourcePath": "/containers/cna/references/0" }, { "url": "https://labs.sra.io/posts/switchvox/", "label": "SRA", "tags": [ "third-party-advisory" ], "provider": "SRA", "sourcePath": "/containers/cna/references/1" }, { "url": "https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Sangoma\",\"product\":\"Switchvox SMB Edition\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.3 (104997)\",\"lessThan\":\"8.4.0.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.3,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-03T03:55:29.128Z", "fetchedAt": "2026-10-23T02:43:53.352Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-09-02T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Switchvox SMB Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:10.981Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "0e966fb8a3d0d379248274278548f401c9fa4e890c4cd7090beb4575d419d2cf", "sourceModifiedAt": "2026-09-03T03:55:29.128Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "認証されていないリモート攻撃者が、/pa エンドポイントに細工した XML を送信することで、PostgreSQL データベースに任意の SQL 文を実行させ、リモートコード実行を行える脆弱性が存在します。", "risk": "攻撃者は認証なしでバックエンドの PostgreSQL データベースに任意の SQL 文を実行でき、サーバー上で任意のコードを実行させられる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは Sangoma Switchvox SMB Edition のバージョン 8.3 (104997) で、バージョン 8.4.0.2 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "脆弱性は /pa エンドポイントが で始まる XML コンテンツを処理する際に発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "ユーザーが制御できる PhoneIP 値が PostgreSQL クエリに直接連結され、サニタイズやパラメータ化が行われていません。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証されていないリモート攻撃者が単一の細工したリクエストで任意の SQL 文を実行できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Sangoma / Switchvox SMB Edition。影響ありとして記載：8.3 (104997)以上、8.4.0.2未満。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Switchvox SMB Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-9586", "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "https://labs.sra.io/posts/switchvox/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-9586" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-9586", "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "https://labs.sra.io/posts/switchvox/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-9586" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-9586", "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "https://labs.sra.io/posts/switchvox/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-9586" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "label": "CVE：SRA" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-9586", "label": "CVE公式レコード" }, { "url": "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "label": "CISAが示す関連情報" }, { "url": "https://labs.sra.io/posts/switchvox/", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9586", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourceField": "/containers/cna/title", "excerpt": "Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/9xxx/CVE-2026-9586.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Sangoma\",\"product\":\"Switchvox SMB Edition\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.3 (104997)\",\"lessThan\":\"8.4.0.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-9586\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-9586（Switchvox SMB Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは Sangoma Switchvox SMB Edition のバージョン 8.3 (104997) で、バージョン 8.4.0.2 未満です。\n・脆弱性は /pa エンドポイントが で始まる XML コンテンツを処理する際に発生します。\n・ユーザーが制御できる PhoneIP 値が PostgreSQL クエリに直接連結され、サニタイズやパラメータ化が行われていません。\n・認証されていないリモート攻撃者が単一の細工したリクエストで任意の SQL 文を実行できます。\n・公式の対象表：Sangoma / Switchvox SMB Edition。影響ありとして記載：8.3 (104997)以上、8.4.0.2未満。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-9586", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:10.981Z", "lastSuccess": "2026-10-23T03:22:10.981Z", "sourceCheckedAt": "2026-10-23T02:43:53.352Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-81578", "aliases": [], "title": "PaperCut MF/NG：認証の回避", "summary": "PaperCut MF と PaperCut NG のウェブ管理インターフェースに不適切なアクセス制御の脆弱性があります。特定の条件下で、認証されていないリモートからのリクエストが管理機能を対象にすると、アクセス検証が完了する前にバックエンドの処理が実行されます。これにより、認証されていないリモート攻撃者がシステム設定の一部を変更できる。", "risk": "認証されていないリモート攻撃者がシステム設定の一部を変更できる。", "product": "PaperCut MF/NG", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "4.0", "cvssSource": "PaperCut", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "affected": [ { "product": "PaperCut MF/NG", "range": "< 24.1.10" }, { "product": "PaperCut MF/NG", "range": ">= 25.0.0 / < 25.0.13" }, { "product": "PaperCut MF/NG", "range": ">= 26.0.0 / < 26.0.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "label": "CVE：PaperCut" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-81578", "label": "CVE公式レコード" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81578", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-28T11:39:45.402Z", "modifiedAt": "2026-09-13T23:15:33.997Z", "fetchedAt": "2026-10-23T02:43:51.098Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.", "sourceTitle": "PaperCut MF/NG: Authentication Bypass", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PaperCut", "product": "PaperCut MF/NG", "versions": [ { "status": "affected", "version": "0", "lessThan": "24.1.10", "versionType": "semver" }, { "status": "affected", "version": "25.0.0", "lessThan": "25.0.13", "versionType": "semver" }, { "status": "affected", "version": "26.0.0", "lessThan": "26.0.5", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-81578", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "fetchedAt": "2026-10-23T02:43:51.098Z", "publishedAt": "2026-08-28T11:39:45.402Z", "modifiedAt": "2026-09-13T23:15:33.997Z", "state": "published", "provider": "PaperCut", "title": "PaperCut MF/NG: Authentication Bypass", "descriptions": [ { "lang": "en", "value": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "PaperCut", "product": "PaperCut MF/NG", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "24.1.10", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "25.0.0", "lessThan": "25.0.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "26.0.0", "lessThan": "26.0.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-305", "lang": "en", "description": "CWE-305 Authentication bypass by primary weakness", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "PaperCut", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "PaperCut", "tags": [], "provider": "PaperCut", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/21842", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-81578", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PaperCut\",\"product\":\"PaperCut MF/NG\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"24.1.10\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"25.0.0\",\"lessThan\":\"25.0.13\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"26.0.0\",\"lessThan\":\"26.0.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-305\",\"description\":\"CWE-305 Authentication bypass by primary weakness\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-13T23:15:33.997Z", "fetchedAt": "2026-10-23T02:43:51.098Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-31T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "PaperCut MF/NGに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:11.227Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9a3ef0727e000f25cfba1d1508c0144337a2b5f7a83f3aef0189037426a05ce2", "sourceModifiedAt": "2026-09-13T23:15:33.997Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PaperCut MF と PaperCut NG のウェブ管理インターフェースに不適切なアクセス制御の脆弱性があります。特定の条件下で、認証されていないリモートからのリクエストが管理機能を対象にすると、アクセス検証が完了する前にバックエンドの処理が実行されます。これにより、認証されていないリモート攻撃者がシステム設定の一部を変更できる。", "risk": "認証されていないリモート攻撃者がシステム設定の一部を変更できる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "脆弱性は PaperCut MF/NG のウェブ管理インターフェースに存在する。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "特定の条件下で、認証されていないリモートからのリクエストが管理機能を対象にできる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "リクエストはアクセス検証が完了する前にバックエンドの処理をトリガーする。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "このバックエンド処理により、システム設定の一部が変更可能になる。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：PaperCut / PaperCut MF/NG。影響ありとして記載：24.1.10未満の版。影響ありとして記載：25.0.0以上、25.0.13未満。影響ありとして記載：26.0.0以上、26.0.5未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E3" ] }, { "text": "「PaperCut MF/NG」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-81578", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-81578" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-81578", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-81578" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-81578", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-81578" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "label": "CVE：PaperCut" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-81578", "label": "CVE公式レコード" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81578", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourceField": "/containers/cna/title", "excerpt": "PaperCut MF/NG: Authentication Bypass", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/81xxx/CVE-2026-81578.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PaperCut\",\"product\":\"PaperCut MF/NG\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"24.1.10\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"25.0.0\",\"lessThan\":\"25.0.13\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"26.0.0\",\"lessThan\":\"26.0.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-81578", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-81578\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-81578（PaperCut MF/NG）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・脆弱性は PaperCut MF/NG のウェブ管理インターフェースに存在する。\n・特定の条件下で、認証されていないリモートからのリクエストが管理機能を対象にできる。\n・リクエストはアクセス検証が完了する前にバックエンドの処理をトリガーする。\n・このバックエンド処理により、システム設定の一部が変更可能になる。\n・公式の対象表：PaperCut / PaperCut MF/NG。影響ありとして記載：24.1.10未満の版。影響ありとして記載：25.0.0以上、25.0.13未満。影響ありとして記載：26.0.0以上、26.0.5未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-81578", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:11.227Z", "lastSuccess": "2026-10-23T03:22:11.227Z", "sourceCheckedAt": "2026-10-23T02:43:51.098Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-82078", "aliases": [], "title": "PaperCut MF/NG：脆弱性情報", "summary": "PaperCut MF/NG のデータベース接続ユーティリティで、設定可能なドライバ名に基づきデータベースドライバのクラスを許可リストなしで動的にロードする脆弱性があります。攻撃者がシステム設定パラメータを操作できると、アプリケーションのクラスパス上にある任意の Java バイトコードを PaperCut サーバーのプロセス権限で実行させることが可能になります。", "risk": "攻撃者が任意の Java バイトコードを PaperCut サーバーのプロセス権限で実行できる可能性があります。", "product": "PaperCut MF/NG", "category": "other", "component": "package", "severity": "critical", "cvss": 9.4, "cvssVersion": "4.0", "cvssSource": "PaperCut", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "affected": [ { "product": "PaperCut MF/NG", "range": "< 24.1.10" }, { "product": "PaperCut MF/NG", "range": ">= 25.0.0 / < 25.0.13" }, { "product": "PaperCut MF/NG", "range": ">= 26.0.0 / < 26.0.5" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "label": "CVE：PaperCut" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-82078", "label": "CVE公式レコード" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "CVE掲載の参考情報" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82078", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-28T11:45:25.388Z", "modifiedAt": "2026-09-13T23:16:32.332Z", "fetchedAt": "2026-10-23T02:43:51.143Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.", "sourceTitle": "PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "PaperCut", "product": "PaperCut MF/NG", "versions": [ { "status": "affected", "version": "0", "lessThan": "24.1.10", "versionType": "semver" }, { "status": "affected", "version": "25.0.0", "lessThan": "25.0.13", "versionType": "semver" }, { "status": "affected", "version": "26.0.0", "lessThan": "26.0.5", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-82078", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "fetchedAt": "2026-10-23T02:43:51.143Z", "publishedAt": "2026-08-28T11:45:25.388Z", "modifiedAt": "2026-09-13T23:16:32.332Z", "state": "published", "provider": "PaperCut", "title": "PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector", "descriptions": [ { "lang": "en", "value": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "PaperCut", "product": "PaperCut MF/NG", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "24.1.10", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "25.0.0", "lessThan": "25.0.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "26.0.0", "lessThan": "26.0.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-470", "lang": "en", "description": "CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "baseScore": 9.4, "baseSeverity": "CRITICAL", "provider": "PaperCut", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "PaperCut", "tags": [], "provider": "PaperCut", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/21842", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-82078", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PaperCut\",\"product\":\"PaperCut MF/NG\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"24.1.10\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"25.0.0\",\"lessThan\":\"25.0.13\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"26.0.0\",\"lessThan\":\"26.0.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-470\",\"description\":\"CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.4,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-13T23:16:32.332Z", "fetchedAt": "2026-10-23T02:43:51.143Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-31T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "PaperCut MF/NGに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:12.066Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "e471474c60cb1c223f649b5afaa8674319fee0f9950ce0d54f2351a7aa32eff9", "sourceModifiedAt": "2026-09-13T23:16:32.332Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "PaperCut MF/NG のデータベース接続ユーティリティで、設定可能なドライバ名に基づきデータベースドライバのクラスを許可リストなしで動的にロードする脆弱性があります。攻撃者がシステム設定パラメータを操作できると、アプリケーションのクラスパス上にある任意の Java バイトコードを PaperCut サーバーのプロセス権限で実行させることが可能になります。", "risk": "攻撃者が任意の Java バイトコードを PaperCut サーバーのプロセス権限で実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "攻撃者がシステム設定パラメータを操作できる場合にこの脆弱性が利用可能です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 24.1.10 未満のすべての PaperCut MF/NG が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 25.0.0 以上で 25.0.13 未満の PaperCut MF/NG が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 26.0.0 以上で 26.0.5 未満の PaperCut MF/NG が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：PaperCut / PaperCut MF/NG。影響ありとして記載：24.1.10未満の版。影響ありとして記載：25.0.0以上、25.0.13未満。影響ありとして記載：26.0.0以上、26.0.5未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3" ] }, { "text": "「PaperCut MF/NG」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82078" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82078" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-82078" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "label": "CVE：PaperCut" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-82078", "label": "CVE公式レコード" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/", "label": "CVE掲載の参考情報" }, { "url": "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82078", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourceField": "/containers/cna/title", "excerpt": "PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82078.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"PaperCut\",\"product\":\"PaperCut MF/NG\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"24.1.10\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"25.0.0\",\"lessThan\":\"25.0.13\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"26.0.0\",\"lessThan\":\"26.0.5\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-82078", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-82078\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-82078（PaperCut MF/NG）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃者がシステム設定パラメータを操作できる場合にこの脆弱性が利用可能です。\n・バージョン 24.1.10 未満のすべての PaperCut MF/NG が影響を受けます。\n・バージョン 25.0.0 以上で 25.0.13 未満の PaperCut MF/NG が影響を受けます。\n・バージョン 26.0.0 以上で 26.0.5 未満の PaperCut MF/NG が影響を受けます。\n・公式の対象表：PaperCut / PaperCut MF/NG。影響ありとして記載：24.1.10未満の版。影響ありとして記載：25.0.0以上、25.0.13未満。影響ありとして記載：26.0.0以上、26.0.5未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-82078", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:12.066Z", "lastSuccess": "2026-10-23T03:22:12.066Z", "sourceCheckedAt": "2026-10-23T02:43:51.143Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2023-49105", "aliases": [], "title": "n/a：脆弱性情報", "summary": "ownCloud core のバージョン 10.13.1 未満（最も古い影響を受けるバージョンは 10.6.0）において、攻撃者が被害者のユーザー名を知り、かつ被害者が署名鍵を設定していない場合、認証なしで任意のファイルにアクセス、変更、削除できる脆弱性が存在します。", "risk": "認証なしで任意のファイルにアクセス、変更、削除が可能になる", "product": "ownCloud ownCloud", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N", "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-49105", "label": "CVE公式レコード" }, { "url": "https://owncloud.org/security", "label": "CISAが示す関連情報" }, { "url": "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49105", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-11-21T00:00:00.000Z", "modifiedAt": "2026-08-28T03:55:23.877Z", "fetchedAt": "2026-10-23T02:43:29.218Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "n/a", "product": "n/a", "versions": [ { "version": "n/a", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-49105", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "fetchedAt": "2026-10-23T02:43:29.218Z", "publishedAt": "2023-11-21T00:00:00.000Z", "modifiedAt": "2026-08-28T03:55:23.877Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://owncloud.org/security", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-49105", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"type\":\"text\",\"lang\":\"en\",\"description\":\"n/a\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-28T03:55:23.877Z", "fetchedAt": "2026-10-23T02:43:29.218Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.019Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "72511da048435533d20c7bfceab6505c832556ddfbc0413690dbf40d944f2fe4", "sourceModifiedAt": "2026-08-28T03:55:23.877Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "ownCloud core のバージョン 10.13.1 未満（最も古い影響を受けるバージョンは 10.6.0）において、攻撃者が被害者のユーザー名を知り、かつ被害者が署名鍵を設定していない場合、認証なしで任意のファイルにアクセス、変更、削除できる脆弱性が存在します。", "risk": "認証なしで任意のファイルにアクセス、変更、削除が可能になる", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は ownCloud core のバージョン 10.13.1 未満（最も古い影響を受けるバージョンは 10.6.0）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃者が被害者のユーザー名を知っていることが必要", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E1" ] }, { "text": "被害者が署名鍵（signing-key）を設定していないことが必要", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E1" ] }, { "text": "pre‑signed URL が、所有者に署名鍵が設定されていなくても受け入れられる", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E1" ] }, { "text": "この状態で認証なしに任意のファイルへアクセス、変更、削除が可能になる", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E2" ] }, { "text": "「ownCloud ownCloud」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-49105", "https://owncloud.org/security", "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-49105" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-49105", "https://owncloud.org/security", "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-49105" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-49105", "https://owncloud.org/security", "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-49105" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-49105", "label": "CVE公式レコード" }, { "url": "https://owncloud.org/security", "label": "CISAが示す関連情報" }, { "url": "https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49105", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no signing-key is configured for the owner of the files. The earliest affected version is 10.6.0.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/49xxx/CVE-2023-49105.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-49105", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-49105\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-49105（ownCloud ownCloud）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は ownCloud core のバージョン 10.13.1 未満（最も古い影響を受けるバージョンは 10.6.0）\n・攻撃者が被害者のユーザー名を知っていることが必要\n・被害者が署名鍵（signing-key）を設定していないことが必要\n・pre‑signed URL が、所有者に署名鍵が設定されていなくても受け入れられる\n・この状態で認証なしに任意のファイルへアクセス、変更、削除が可能になる\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-49105", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.019Z", "lastSuccess": "2026-10-23T03:37:42.019Z", "sourceCheckedAt": "2026-10-23T02:43:29.218Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-53362", "aliases": [], "title": "Linux：脆弱性情報", "summary": "Linux カーネルの IPv6 実装において、__ip6_append_data() のページ割り当てパスで fraggap（フラグメント間の隙間）を考慮していなかったため、コピー先が skb の末端を越えて skb_shared_info に書き込まれ、メモリ破壊が起こる欠陥が修正されました。", "risk": "この欠陥によりカーネルメモリが破壊され、システムがクラッシュする可能性があります。", "product": "Linux", "category": "linux", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "Linux", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 14200d435af9a9eeb444f529fc2f689a236b7962" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 65fb14cbebb0cd0eff903a22d33537ddc8b95769" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 46f201f8b4c39633a1fa3dc12459f506d470993d" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 6374fb9edf72c67a118a2c214a0dddd04c921e0a" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < e9eacf19281ea2498b36291b56c9606118c2d74e" }, { "product": "Linux", "range": ">= 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 / < 736b380e28d0480c7bc3e022f1950f31fe53a7c5" }, { "product": "Linux", "range": "6.0" }, { "product": "Linux", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "カーネルのソースコードで __ip6_append_data() の paged アロケーションパスに fraggap を加算し、pagedlen から fraggap を減算するように修正します。", "「CVE-2026-53362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "利用しているLinuxの配布元が示す、このCVEへの修正パッケージを管理者に適用してもらいます。Ubuntu Desktopでは「ソフトウェアの更新」から提供された更新を適用できます。サーバーや他の配布元では、それぞれの正規の更新手順に従います。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-07-04T11:56:35.864Z", "modifiedAt": "2026-10-15T01:23:25.441Z", "fetchedAt": "2026-10-23T02:43:49.437Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "sourceTitle": "ipv6: account for fraggap on the paged allocation path", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e", "status": "affected", "versionType": "git" }, { "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv6/ip6_output.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-53362", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "fetchedAt": "2026-10-23T02:43:49.437Z", "publishedAt": "2026-07-04T11:56:35.864Z", "modifiedAt": "2026-10-15T01:23:25.441Z", "state": "published", "provider": "Linux", "title": "ipv6: account for fraggap on the paged allocation path", "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/0", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [ "net/ipv6/ip6_output.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e", "versionType": "git", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03", "lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5", "versionType": "git", "status": "affected" } ] }, { "vendor": "Linux", "product": "Linux", "sourcePath": "/containers/cna/affected/1", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [ "net/ipv6/ip6_output.c" ], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "0", "lessThan": "6.0", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "6.1.177", "lessThanOrEqual": "6.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "6.6.144", "lessThanOrEqual": "6.6.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "6.12.95", "lessThanOrEqual": "6.12.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "6.18.38", "lessThanOrEqual": "6.18.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "7.1.3", "lessThanOrEqual": "7.1.*", "versionType": "semver", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "7.2", "lessThanOrEqual": "*", "versionType": "original_commit_for_fix", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "Linux", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/0" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/1" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/2" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/3" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/4" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "Linux", "tags": [], "provider": "Linux", "sourcePath": "/containers/cna/references/5" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "label": "siemens-SADP", "tags": [], "provider": "siemens-SADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"14200d435af9a9eeb444f529fc2f689a236b7962\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"65fb14cbebb0cd0eff903a22d33537ddc8b95769\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"46f201f8b4c39633a1fa3dc12459f506d470993d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"6374fb9edf72c67a118a2c214a0dddd04c921e0a\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"e9eacf19281ea2498b36291b56c9606118c2d74e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"736b380e28d0480c7bc3e022f1950f31fe53a7c5\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "sourcePath": "body:advisory", "text": "SSA-784472\n\nSiemens Security Advisory by Siemens ProductCERT\n\nSSA-784472: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1\n\nPublication Date:\n\n2026-10-13\n\nLast Update:\n\n2026-10-13\n\nCurrent Version:\n\nV1.0\n\nCVSS v3.1 Base Score:\n10.0\n\nCVSS v4.0 Base Score:\n8.7\n\nSUMMARY\n\nMultiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1.1.\n\nSiemens is preparing fixes and recommends specific mitigations for products where fixes are not or not yet available.\n\nKNOWN AFFECTED PRODUCTS\n\nUn-/Collapse All\n\nAffected Product and Versions\nRemediation\n\nSIMATIC S7-1500 TM MFP - GNU/Linux subsystem\n\nAll versions\n\naffected by\n\nall CVEs\n\nCVE-2024-58005\n\nCVE-2023-52927\n\nCVE-2024-53166\n\nCVE-2024-58002\n\nCVE-2025-21844\n\nCVE-2024-26982\n\nCVE-2024-58079\n\nCVE-2025-21858\n\nCVE-2025-21865\n\nCVE-2025-21859\n\nCVE-2025-21862\n\nCVE-2025-21846\n\nCVE-2025-21864\n\nCVE-2025-21838\n\nCVE-2025-21756\n\nCVE-2025-21702\n\nCVE-2024-57977\n\nCVE-2025-21725\n\nCVE-2025-21806\n\nCVE-2024-58009\n\nCVE-2025-21767\n\nCVE-2025-21763\n\nCVE-2024-58077\n\nCVE-2024-58063\n\nCVE-2024-58013\n\nCVE-2025-21835\n\nCVE-2024-57979\n\nCVE-2025-21703\n\nCVE-2025-21735\n\nCVE-2025-21761\n\nCVE-2024-58071\n\nCVE-2025-21728\n\nCVE-2025-21738\n\nCVE-2025-21766\n\nCVE-2025-21795\n\nCVE-2025-21787\n\nCVE-2025-21779\n\nCVE-2024-58061\n\nCVE-2025-21724\n\nCVE-2025-21719\n\nCVE-2025-21790\n\nCVE-2025-21764\n\nCVE-2025-21705\n\nCVE-2025-21814\n\nCVE-2025-21765\n\nCVE-2025-21791\n\nCVE-2024-57986\n\nCVE-2024-40945\n\nCVE-2025-21744\n\nCVE-2024-57993\n\nCVE-2025-21700\n\nCVE-2024-57981\n\nCVE-2025-21832\n\nCVE-2024-58083\n\nCVE-2024-58020\n\nCVE-2025-21706\n\nCVE-2024-57996\n\nCVE-2025-21796\n\nCVE-2025-21758\n\nCVE-2025-21727\n\nCVE-2025-21745\n\nCVE-2024-58058\n\nCVE-2024-58017\n\nCVE-2024-58068\n\nCVE-2025-21716\n\nCVE-2025-21708\n\nCVE-2024-58014\n\nCVE-2025-21704\n\nCVE-2024-57980\n\nCVE-2025-21731\n\nCVE-2025-21726\n\nCVE-2025-21707\n\nCVE-2025-21776\n\nCVE-2025-21830\n\nCVE-2025-21760\n\nCVE-2025-21753\n\nCVE-2025-21762\n\nCVE-2024-58072\n\nCVE-2026-23253\n\nCVE-2026-23277\n\nCVE-2026-23279\n\nCVE-2026-23303\n\nCVE-2026-23356\n\nCVE-2025-21682\n\nCVE-2025-38250\n\nCVE-2026-23204\n\nCVE-2026-23365\n\nCVE-2026-23290\n\nCVE-2026-23339\n\nCVE-2026-23281\n\nCVE-2026-23372\n\nCVE-2026-23312\n\nCVE-2026-23367\n\nCVE-2026-23388\n\nCVE-2026-23398\n\nCVE-2026-23396\n\nCVE-2026-23274\n\nCVE-2026-23336\n\nCVE-2026-23395\n\nCVE-2026-23382\n\nCVE-2026-23368\n\nCVE-2026-23351\n\nCVE-2026-23357\n\nCVE-2026-23245\n\nCVE-2026-23352\n\nCVE-2026-23300\n\nCVE-2026-23100\n\nCVE-2025-68206\n\nCVE-2026-23379\n\nCVE-2025-39748\n\nCVE-2026-23381\n\nCVE-2026-23291\n\nCVE-2026-23304\n\nCVE-2026-23397\n\nCVE-2026-23318\n\nCVE-2026-23391\n\nCVE-2026-23113\n\nCVE-2024-56719\n\nCVE-2026-23154\n\nCVE-2025-68265\n\nCVE-2026-23296\n\nCVE-2026-23231\n\nCVE-2026-23292\n\nCVE-2026-23317\n\nCVE-2026-23319\n\nCVE-2026-23271\n\nCVE-2026-23141\n\nCVE-2026-23157\n\nCVE-2026-23270\n\nCVE-2025-40135\n\nCVE-2025-38162\n\nCVE-2026-23315\n\nCVE-2024-47809\n\nCVE-2025-39863\n\nCVE-2025-68239\n\nCVE-2026-23321\n\nCVE-2025-38192\n\nCVE-2025-38105\n\nCVE-2026-23343\n\nCVE-2026-23340\n\nCVE-2026-23364\n\nCVE-2026-23392\n\nCVE-2024-49998\n\nCVE-2026-23370\n\nCVE-2025-38704\n\nCVE-2026-23359\n\nCVE-2026-23378\n\nCVE-2026-23273\n\nCVE-2026-31708\n\nCVE-2026-43052\n\nCVE-2026-43350\n\nCVE-2026-46056\n\nCVE-2026-31705\n\nCVE-2026-46107\n\nCVE-2026-31449\n\nCVE-2025-21863\n\nCVE-2026-46307\n\nCVE-2026-46047\n\nCVE-2026-31586\n\nCVE-2026-31580\n\nCVE-2026-23444\n\nCVE-2026-23442\n\nCVE-2026-31583\n\nCVE-2026-31532\n\nCVE-2026-31624\n\nCVE-2026-31625\n\nCVE-2026-31630\n\nCVE-2026-31622\n\nCVE-2026-31637\n\nCVE-2026-31629\n\nCVE-2026-31617\n\nCVE-2026-31642\n\nCVE-2026-23066\n\nCVE-2026-23389\n\nCVE-2026-31488\n\nCVE-2026-43110\n\nCVE-2026-31711\n\nCVE-2026-46015\n\nCVE-2026-23399\n\nCVE-2026-43080\n\nCVE-2026-31500\n\nCVE-2026-43111\n\nCVE-2026-31673\n\nCVE-2026-43099\n\nCVE-2026-46037\n\nCVE-2023-53292\n\nCVE-2026-46101\n\nCVE-2026-46161\n\nCVE-2026-31681\n\nCVE-2026-31685\n\nCVE-2026-31696\n\nCVE-2026-43085\n\nCVE-2026-31699\n\nCVE-2026-43089\n\nCVE-2026-31698\n\nCVE-2026-43093\n\nCVE-2026-43493\n\nCVE-2026-43496\n\nCVE-2026-43502\n\nCVE-2026-45834\n\nCVE-2026-45835\n\nCVE-2026-45844\n\nCVE-2026-45843\n\nCVE-2026-45836\n\nCVE-2026-45840\n\nCVE-2026-45842\n\nCVE-2026-46023\n\nCVE-2026-46040\n\nCVE-2026-46051\n\nCVE-2026-46046\n\nCVE-2026-45838\n\nCVE-2026-46033\n\nCVE-2026-46022\n\nCVE-2026-46064\n\nCVE-2026-46070\n\nCVE-2026-46018\n\nCVE-2026-45841\n\nCVE-2026-46088\n\nCVE-2026-46128\n\nCVE-2026-46120\n\nCVE-2026-46124\n\nCVE-2026-46102\n\nCVE-2026-46122\n\nCVE-2026-46146\n\nCVE-2026-46149\n\nCVE-2026-46163\n\nCVE-2026-46177\n\nCVE-2026-46187\n\nCVE-2026-46227\n\nCVE-2026-46243\n\nCVE-2026-43117\n\nCVE-2026-46275\n\nCVE-2026-46303\n\nCVE-2026-43503\n\nCVE-2026-46294\n\nCVE-2026-46167\n\nCVE-2026-46151\n\nCVE-2025-22105\n\nCVE-2024-36922\n\nCVE-2024-56647\n\nCVE-2024-56657\n\nCVE-2026-23255\n\nCVE-2026-43499\n\nCVE-2026-31704\n\nCVE-2026-46113\n\nCVE-2026-46304\n\nCVE-2026-31697\n\nCVE-2026-43114\n\nCVE-2025-38584\n\nCVE-2026-31407\n\nCVE-2026-46150\n\nCVE-2026-31676\n\nCVE-2026-46234\n\nCVE-2026-46214\n\nCVE-2026-46172\n\nCVE-2026-46209\n\nCVE-2026-45997\n\nCVE-2026-31613\n\nCVE-2026-45839\n\nCVE-2026-31612\n\nCVE-2026-43074\n\nCVE-2026-31611\n\nCVE-2026-46050\n\nCVE-2026-43112\n\nCVE-2026-46092\n\nCVE-2025-39997\n\nCVE-2026-46099\n\nCVE-2026-46165\n\nCVE-2026-31694\n\nCVE-2026-46168\n\nCVE-2026-46173\n\nCVE-2026-46136\n\nCVE-2026-46185\n\nCVE-2026-43071\n\nCVE-2026-43094\n\nCVE-2026-46306\n\nCVE-2026-46195\n\nCVE-2026-46193\n\nCVE-2026-46116\n\nCVE-2026-46044\n\nCVE-2026-43116\n\nCVE-2026-53184\n\nCVE-2026-31712\n\nCVE-2026-43421\n\nCVE-2026-53131\n\nCVE-2026-23310\n\nCVE-2026-53198\n\nCVE-2026-46065\n\nCVE-2026-53183\n\nCVE-2026-53147\n\nCVE-2026-46190\n\nCVE-2026-46110\n\nCVE-2026-46323\n\nCVE-2023-54271\n\nCVE-2026-43492\n\nCVE-2026-52918\n\nCVE-2026-45991\n\nCVE-2026-46026\n\nCVE-2026-46038\n\nCVE-2026-46191\n\nCVE-2026-46003\n\nCVE-2026-31700\n\nCVE-2026-46069\n\nCVE-2026-53177\n\nCVE-2026-46021\n\nCVE-2026-52929\n\nCVE-2026-46159\n\nCVE-2026-52923\n\nCVE-2026-52930\n\nCVE-2026-52943\n\nCVE-2026-46083\n\nCVE-2026-46125\n\nCVE-2026-52946\n\nCVE-2026-46180\n\nCVE-2026-53168\n\nCVE-2026-53150\n\nCVE-2026-53080\n\nCVE-2026-53148\n\nCVE-2026-43303\n\nCVE-2026-53149\n\nCVE-2026-46321\n\nCVE-2026-53146\n\nCVE-2026-52947\n\nCVE-2026-52942\n\nCVE-2026-52910\n\nCVE-2026-46322\n\nCVE-2026-46086\n\nCVE-2026-45850\n\nCVE-2026-31709\n\nCVE-2026-46137\n\nCVE-2026-52948\n\nCVE-2026-46320\n\nCVE-2026-53181\n\nCVE-2026-52917\n\nCVE-2026-46196\n\nCVE-2026-53208\n\nCVE-2026-53218\n\nCVE-2026-53219\n\nCVE-2026-53225\n\nCVE-2026-53228\n\nCVE-2026-53236\n\nCVE-2026-53212\n\nCVE-2026-53221\n\nCVE-2026-53227\n\nCVE-2026-53245\n\nCVE-2026-53249\n\nCVE-2026-53253\n\nCVE-2026-53239\n\nCVE-2026-53254\n\nCVE-2026-53242\n\nCVE-2026-53256\n\nCVE-2026-53263\n\nCVE-2026-53265\n\nCVE-2026-53264\n\nCVE-2026-53255\n\nCVE-2026-53268\n\nCVE-2026-53269\n\nCVE-2026-53275\n\nCVE-2026-53337\n\nCVE-2026-53349\n\nCVE-2026-53350\n\nCVE-2026-53352\n\nCVE-2026-53358\n\nCVE-2025-23131\n\nCVE-2026-23278\n\nCVE-2026-53356\n\nCVE-2026-31451\n\nCVE-2026-23302\n\nCVE-2026-23272\n\nCVE-2026-46331\n\nCVE-2026-52928\n\nCVE-2026-52909\n\nCVE-2026-53325\n\nCVE-2026-53167\n\nCVE-2026-53362\n\nCVE-2026-53192\n\nCVE-2026-64560\n\nCurrently no fix is available\n\nSee further recommendations from section\nMitigations\n\nMITIGATIONS\n\nSiemens has identified the following specific mitigations that customers can apply to reduce the risk:\n\nOnly build and run applications from trusted sources.\n\nLimit access to the interactive shell of the additional GNU/Linux subssytem to trusted personnel only.\n\nPlease follow the General Security Recommendations .\n\nGENERAL SECURITY RECOMMENDATIONS\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\nPRODUCT DESCRIPTION\n\nSIMATIC S7-1500 TM MFP is a Technology module Multi functional platform for SIMATIC S7-1500 PLCs based on SIMATIC Industrial OS\n\nVULNERABILITY DESCRIPTION\n\nUn-/Collapse All\n\nThis chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory.\nWherever applicable, it also documents the product-specific impact of the individual vulnerabilities.\n\nVulnerability CVE-2023-52927\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: allow exp not to be removed in nf_ct_find_expectation\n\nCurrently nf_conntrack_in() calling nf_ct_find_expectation() will\nremove the exp from the hash table. However, in some scenario, we\nexpect the exp not to be removed when the created ct will not be\nconfirmed, like in OVS and TC conntrack in the following patches.\n\nThis patch allows exp not to be removed by setting IPS_CONFIRMED\nin the status of the tmpl.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2023-53292\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none\n\nAfter grabbing q->sysfs_lock, q->elevator may become NULL because of\nelevator switch.\n\nFix the NULL dereference on q->elevator by checking it with lock.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2023-54271\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init\n\nblk-iocost sometimes causes the following crash:\n\nBUG: kernel NULL pointer dereference, address: 00000000000000e0\n...\nRIP: 0010:_raw_spin_lock+0x17/0x30\nCode: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00\nRSP: 0018:ffffc900023b3d40 EFLAGS: 00010046\nRAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001\nRDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0\nRBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003\nR10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000\nR13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600\nFS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0\nCall Trace:\n\nioc_weight_write+0x13d/0x410\ncgroup_file_write+0x7a/0x130\nkernfs_fop_write_iter+0xf5/0x170\nvfs_write+0x298/0x370\nksys_write+0x5f/0xb0\n__x64_sys_write+0x1b/0x20\ndo_syscall_64+0x3d/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThis happens because iocg->ioc is NULL. The field is initialized by\nioc_pd_init() and never cleared. The NULL deref is caused by\nblkcg_activate_policy() installing blkg_policy_data before initializing it.\n\nblkcg_activate_policy() was doing the following:\n\nAllocate pd's for all existing blkg's and install them in blkg->pd[].\n\nInitialize all pd's.\n\nOnline all pd's.\n\nblkcg_activate_policy() only grabs the queue_lock and may release and\nre-acquire the lock as allocation may need to sleep. ioc_weight_write()\ngrabs blkcg->lock and iterates all its blkg's. The two can race and if\nioc_weight_write() runs during #1 or between #1 and #2, it can encounter a\npd which is not initialized yet, leading to crash.\n\nThe crash can be reproduced with the following script:\n\n#!/bin/bash\n\necho +io > /sys/fs/cgroup/cgroup.subtree_control\nsystemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct\necho 100 > /sys/fs/cgroup/system.slice/io.weight\nbash -c \"echo '8:0 enable=1' > /sys/fs/cgroup/io.cost.qos\" &\nsleep .2\necho 100 > /sys/fs/cgroup/system.slice/io.weight\n\nwith the following patch applied:\n\ndiff --git a/block/blk-cgroup.c b/block/blk-cgroup.c\nindex fc49be622e05..38d671d5e10c 100644\n--- a/block/blk-cgroup.c\n+++ b/block/blk-cgroup.c\n@@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk disk, const struct blkcg_policy pol)\npd->online = false;\n}\n\nif (system_state == SYSTEM_RUNNING) {\n\nspin_unlock_irq(&q->queue_lock);\n\nssleep(1);\n\nspin_lock_irq(&q->queue_lock);\n\n}\n+\n/ all allocated, init in the same order /\nif (pol->pd_init_fn)\nlist_for_each_entry_reverse(blkg, &q->blkg_list, q_node)\n\nI don't see a reason why all pd's should be allocated, initialized and\nonlined together. The only ordering requirement is that parent blkgs to be\ninitialized and onlined before children, which is guaranteed from the\nwalking order. Let's fix the bug by allocating, initializing and onlining pd\nfor each blkg and holding blkcg->lock over initialization and onlining. This\nensures that an installed blkg is always fully initialized and onlined\nremoving the the race window.\n\nCVSS v3.1 Base Score\n0.0\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-26982\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nSquashfs: check the inode number is not the invalid value of zero\n\nSyskiller has produced an out of bounds access in fill_meta_index().\n\nThat out of bounds access is ultimately caused because the inode\nhas an inode number with the invalid value of zero, which was not checked.\n\nThe reason this causes the out of bounds access is due to following\nsequence of events:\n\nFill_meta_index() is called to allocate (via empty_meta_index())\nand fill a metadata index. It however suffers a data read error\nand aborts, invalidating the newly returned empty metadata index.\nIt does this by setting the inode number of the index to zero,\nwhich means unused (zero is not a valid inode number).\n\nWhen fill_meta_index() is subsequently called again on another\nread operation, locate_meta_index() returns the previous index\nbecause it matches the inode number of 0. Because this index\nhas been returned it is expected to have been filled, and because\nit hasn't been, an out of bounds access is performed.\n\nThis patch adds a sanity check which checks that the inode number\nis not zero when the inode is created and returns -EINVAL if it is.\n\n[phillip@squashfs.org.uk: whitespace fix]\n\nCVSS v3.1 Base Score\n7.1\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\nCWE\nCWE-125: Out-of-bounds Read\n\nVulnerability CVE-2024-36922\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: read txq->read_ptr under lock\n\nIf we read txq->read_ptr without lock, we can read the same\nvalue twice, then obtain the lock, and reclaim from there\nto two different places, but crucially reclaim the same\nentry twice, resulting in the WARN_ONCE() a little later.\nFix that by reading txq->read_ptr under lock.\n\nCVSS v3.1 Base Score\n8.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\nCWE\nCWE-20: Improper Input Validation\n\nVulnerability CVE-2024-40945\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu: Return right value in iommu_sva_bind_device()\n\niommu_sva_bind_device() should return either a sva bond handle or an\nERR_PTR value in error cases. Existing drivers (idxd and uacce) only\ncheck the return value with IS_ERR(). This could potentially lead to\na kernel NULL pointer dereference issue if the function returns NULL\ninstead of an error pointer.\n\nIn reality, this doesn't cause any problems because iommu_sva_bind_device()\nonly returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.\nIn this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will\nreturn an error, and the device drivers won't call iommu_sva_bind_device()\nat all.\n\nCVSS v3.1 Base Score\n6.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\n\nCWE\nCWE-393: Return of Wrong Status Code\n\nVulnerability CVE-2024-47809\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb->lkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists.\n\nCVSS v3.1 Base Score\n5.5\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-49998\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-> ...\n-> dsa_user_phy_read()\n-> ds->ops->phy_read()\n-> lan9303_phy_read()\n-> chip->ops->phy_read()\n-> lan9303_mdio_phy_read()\n-> dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp->conduit->dsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev->dsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds->ops->phy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data. All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we're no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit->dsa_ptr\n(one which doesn't ensure that the interfaces aren't up).\n\nCVSS v3.1 Base Score\n4.7\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\nCWE\nCWE-476: NULL Pointer Dereference\n\nVulnerability CVE-2024-53166\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix bfqq uaf in bfq_limit_depth()\n\nSet new allocated bfqq to bic or remove freed bfqq from bic are both\nprotected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq\nfrom bic without the lock, this can lead to UAF if the io_context is\nshared by multiple tasks.\n\nFor example, test bfq with io_uring can trigger following UAF in v6.6:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50\n\nCall Trace:\n\ndump_stack_lvl+0x47/0x80\nprint_address_description.constprop.0+0x66/0x300\nprint_report+0x3e/0x70\nkasan_report+0xb4/0xf0\nbfqq_group+0x15/0x50\nbfqq_request_over_limit+0x130/0x9a0\nbfq_limit_depth+0x1b5/0x480\n__blk_mq_alloc_requests+0x2b5/0xa00\nblk_mq_get_new_requests+0x11d/0x1d0\nblk_mq_submit_bio+0x286/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__block_write_full_folio+0x3d0/0x640\nwritepage_cb+0x3b/0xc0\nwrite_cache_pages+0x254/0x6c0\nwrite_cache_pages+0x254/0x6c0\ndo_writepages+0x192/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork_asm+0x1b/0x30\n\nAllocated by task 808602:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\n__kasan_slab_alloc+0x83/0x90\nkmem_cache_alloc_node+0x1b1/0x6d0\nbfq_get_queue+0x138/0xfa0\nbfq_get_bfqq_handle_split+0xe3/0x2c0\nbfq_init_rq+0x196/0xbb0\nbfq_insert_request.isra.0+0xb5/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_insert_request+0x15d/0x440\nblk_mq_submit_bio+0x8a4/0xb00\nsubmit_bio_noacct_nocheck+0x331/0x400\n__blkdev_direct_IO_async+0x2dd/0x330\nblkdev_write_iter+0x39a/0x450\nio_write+0x22a/0x840\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFreed by task 808589:\nkasan_save_stack+0x1e/0x40\nkasan_set_track+0x21/0x30\nkasan_save_free_info+0x27/0x40\n__kasan_slab_free+0x126/0x1b0\nkmem_cache_free+0x10c/0x750\nbfq_put_queue+0x2dd/0x770\n__bfq_insert_request.isra.0+0x155/0x7a0\nbfq_insert_request.isra.0+0x122/0x480\nbfq_insert_requests+0x156/0x180\nblk_mq_dispatch_plug_list+0x528/0x7e0\nblk_mq_flush_plug_list.part.0+0xe5/0x590\n__blk_flush_plug+0x3b/0x90\nblk_finish_plug+0x40/0x60\ndo_writepages+0x19d/0x310\nfilemap_fdatawrite_wbc+0x95/0xc0\n__filemap_fdatawrite_range+0x99/0xd0\nfilemap_write_and_wait_range.part.0+0x4d/0xa0\nblkdev_read_iter+0xef/0x1e0\nio_read+0x1b6/0x8a0\nio_issue_sqe+0x87/0x300\nio_wq_submit_work+0xeb/0x390\nio_worker_handle_work+0x24d/0x550\nio_wq_worker+0x27f/0x6c0\nret_from_fork+0x2d/0x50\nret_from_fork_asm+0x1b/0x30\n\nFix the problem by protecting bic_to_bfqq() with bfqd->lock.\n\nCVSS v3.1 Base Score\n7.8\n\nCVSS v3.1 Vector\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\nCVSS v4.0 Base Score\n7.1\n\nCVSS v4.0 Vector\nCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n\nCWE\nCWE-416: Use After Free\n\nVulnerability CVE-2024-56647\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix icmp host relookup triggering ip_rt_bug\n\narp link failure may trigger ip_rt_bug while xfrm enabled, call trace is:\n\nWARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20\nModules linked in:\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:ip_rt_bug+0x14/0x20\nCall Trace:\n\nip_send_skb+0x14/0x40\n__icmp_send+0x42d/0x6a0\nipv4_link_failure+0xe2/0x1d0\narp_error_report+0x3c/0x50\nneigh_invalidate+0x8d/0x100\nneigh_timer_handler+0x2e1/0x330\ncall_timer_fn+0x21/0x120\n__run_timer_base.part.0+0x1c9/0x270\nrun_timer_softirq+0x4c/0x80\nhandle_softirqs+0xac/0x280\nirq_exit_rcu+0x62/0x80\nsysvec_apic_timer_interrupt+0x77/0x90\n\nThe script below reproduces this scenario:\nip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \\\ndir out priority 0 ptype main flag localok icmp\nip l a veth1 type veth\nip a a 192.168.141.111/24 dev veth0\nip l s ", "truncated": true, "representation": "html_text_excerpt", "relatedCve": "CVE-2026-53362", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] } ], "limits": { "completeness": "bounded", "truncatedFields": [ "https://cert-portal.siemens.com/productcert/html/ssa-784472.html" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "Siemens ProductCERT", "sourceUrl": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html", "title": "SSA-784472", "relatedCves": [ "CVE-2024-58005", "CVE-2023-52927", "CVE-2024-53166", "CVE-2024-58002", "CVE-2025-21844", "CVE-2024-26982", "CVE-2024-58079", "CVE-2025-21858", "CVE-2025-21865", "CVE-2025-21859", "CVE-2025-21862", "CVE-2025-21846", "CVE-2025-21864", "CVE-2025-21838", "CVE-2025-21756", "CVE-2025-21702", "CVE-2024-57977", "CVE-2025-21725", "CVE-2025-21806", "CVE-2024-58009", "CVE-2025-21767", "CVE-2025-21763", "CVE-2024-58077", "CVE-2024-58063", "CVE-2024-58013", "CVE-2025-21835", "CVE-2024-57979", "CVE-2025-21703", "CVE-2025-21735", "CVE-2025-21761", "CVE-2024-58071", "CVE-2025-21728", "CVE-2025-21738", "CVE-2025-21766", "CVE-2025-21795", "CVE-2025-21787", "CVE-2025-21779", "CVE-2024-58061", "CVE-2025-21724", "CVE-2025-21719", "CVE-2025-21790", "CVE-2025-21764", "CVE-2025-21705", "CVE-2025-21814", "CVE-2025-21765", "CVE-2025-21791", "CVE-2024-57986", "CVE-2024-40945", "CVE-2025-21744", "CVE-2024-57993", "CVE-2025-21700", "CVE-2024-57981", "CVE-2025-21832", "CVE-2024-58083", "CVE-2024-58020", "CVE-2025-21706", "CVE-2024-57996", "CVE-2025-21796", "CVE-2025-21758", "CVE-2025-21727", "CVE-2025-21745", "CVE-2024-58058", "CVE-2024-58017", "CVE-2024-58068", "CVE-2025-21716", "CVE-2025-21708", "CVE-2024-58014", "CVE-2025-21704", "CVE-2024-57980", "CVE-2025-21731", "CVE-2025-21726", "CVE-2025-21707", "CVE-2025-21776", "CVE-2025-21830", "CVE-2025-21760", "CVE-2025-21753", "CVE-2025-21762", "CVE-2024-58072", "CVE-2026-23253", "CVE-2026-23277", "CVE-2026-23279", "CVE-2026-23303", "CVE-2026-23356", "CVE-2025-21682", "CVE-2025-38250", "CVE-2026-23204", "CVE-2026-23365", "CVE-2026-23290", "CVE-2026-23339", "CVE-2026-23281", "CVE-2026-23372", "CVE-2026-23312", "CVE-2026-23367", "CVE-2026-23388", "CVE-2026-23398", "CVE-2026-23396", "CVE-2026-23274", "CVE-2026-23336", "CVE-2026-23395", "CVE-2026-23382", "CVE-2026-23368", "CVE-2026-23351", "CVE-2026-23357", "CVE-2026-23245", "CVE-2026-23352", "CVE-2026-23300", "CVE-2026-23100", "CVE-2025-68206", "CVE-2026-23379", "CVE-2025-39748", "CVE-2026-23381", "CVE-2026-23291", "CVE-2026-23304", "CVE-2026-23397", "CVE-2026-23318", "CVE-2026-23391", "CVE-2026-23113", "CVE-2024-56719", "CVE-2026-23154", "CVE-2025-68265", "CVE-2026-23296", "CVE-2026-23231", "CVE-2026-23292", "CVE-2026-23317", "CVE-2026-23319", "CVE-2026-23271", "CVE-2026-23141", "CVE-2026-23157", "CVE-2026-23270", "CVE-2025-40135", "CVE-2025-38162", "CVE-2026-23315", "CVE-2024-47809", "CVE-2025-39863", "CVE-2025-68239", "CVE-2026-23321", "CVE-2025-38192", "CVE-2025-38105", "CVE-2026-23343", "CVE-2026-23340", "CVE-2026-23364", "CVE-2026-23392", "CVE-2024-49998", "CVE-2026-23370", "CVE-2025-38704", "CVE-2026-23359", "CVE-2026-23378", "CVE-2026-23273", "CVE-2026-31708", "CVE-2026-43052", "CVE-2026-43350", "CVE-2026-46056", "CVE-2026-31705", "CVE-2026-46107", "CVE-2026-31449", "CVE-2025-21863", "CVE-2026-46307", "CVE-2026-46047", "CVE-2026-31586", "CVE-2026-31580", "CVE-2026-23444", "CVE-2026-23442", "CVE-2026-31583", "CVE-2026-31532", "CVE-2026-31624", "CVE-2026-31625", "CVE-2026-31630", "CVE-2026-31622", "CVE-2026-31637", "CVE-2026-31629", "CVE-2026-31617", "CVE-2026-31642", "CVE-2026-23066", "CVE-2026-23389", "CVE-2026-31488", "CVE-2026-43110", "CVE-2026-31711", "CVE-2026-46015", "CVE-2026-23399", "CVE-2026-43080", "CVE-2026-31500", "CVE-2026-43111", "CVE-2026-31673", "CVE-2026-43099", "CVE-2026-46037", "CVE-2023-53292", "CVE-2026-46101", "CVE-2026-46161", "CVE-2026-31681", "CVE-2026-31685", "CVE-2026-31696", "CVE-2026-43085", "CVE-2026-31699", "CVE-2026-43089", "CVE-2026-31698", "CVE-2026-43093", "CVE-2026-43493", "CVE-2026-43496", "CVE-2026-43502", "CVE-2026-45834", "CVE-2026-45835", "CVE-2026-45844", "CVE-2026-45843", "CVE-2026-45836", "CVE-2026-45840", "CVE-2026-45842", "CVE-2026-46023", "CVE-2026-46040", "CVE-2026-46051", "CVE-2026-46046", "CVE-2026-45838", "CVE-2026-46033", "CVE-2026-46022", "CVE-2026-46064", "CVE-2026-46070", "CVE-2026-46018", "CVE-2026-45841", "CVE-2026-46088", "CVE-2026-46128", "CVE-2026-46120", "CVE-2026-46124", "CVE-2026-46102", "CVE-2026-46122", "CVE-2026-46146", "CVE-2026-46149", "CVE-2026-46163", "CVE-2026-46177", "CVE-2026-46187", "CVE-2026-46227", "CVE-2026-46243", "CVE-2026-43117", "CVE-2026-46275", "CVE-2026-46303", "CVE-2026-43503", "CVE-2026-46294", "CVE-2026-46167", "CVE-2026-46151", "CVE-2025-22105", "CVE-2024-36922", "CVE-2024-56647", "CVE-2024-56657", "CVE-2026-23255", "CVE-2026-43499", "CVE-2026-31704", "CVE-2026-46113", "CVE-2026-46304", "CVE-2026-31697", "CVE-2026-43114", "CVE-2025-38584", "CVE-2026-31407", "CVE-2026-46150", "CVE-2026-31676", "CVE-2026-46234", "CVE-2026-46214", "CVE-2026-46172", "CVE-2026-46209", "CVE-2026-45997", "CVE-2026-31613", "CVE-2026-45839", "CVE-2026-31612", "CVE-2026-43074", "CVE-2026-31611", "CVE-2026-46050", "CVE-2026-43112", "CVE-2026-46092", "CVE-2025-39997", "CVE-2026-46099", "CVE-2026-46165", "CVE-2026-31694", "CVE-2026-46168", "CVE-2026-46173", "CVE-2026-46136", "CVE-2026-46185", "CVE-2026-43071", "CVE-2026-43094", "CVE-2026-46306", "CVE-2026-46195", "CVE-2026-46193", "CVE-2026-46116", "CVE-2026-46044", "CVE-2026-43116", "CVE-2026-53184", "CVE-2026-31712", "CVE-2026-43421", "CVE-2026-53131", "CVE-2026-23310", "CVE-2026-53198", "CVE-2026-46065", "CVE-2026-53183", "CVE-2026-53147", "CVE-2026-46190", "CVE-2026-46110", "CVE-2026-46323", "CVE-2023-54271", "CVE-2026-43492", "CVE-2026-52918", "CVE-2026-45991", "CVE-2026-46026", "CVE-2026-46038", "CVE-2026-46191", "CVE-2026-46003", "CVE-2026-31700", "CVE-2026-46069", "CVE-2026-53177", "CVE-2026-46021", "CVE-2026-52929", "CVE-2026-46159", "CVE-2026-52923", "CVE-2026-52930", "CVE-2026-52943", "CVE-2026-46083", "CVE-2026-46125", "CVE-2026-52946", "CVE-2026-46180", "CVE-2026-53168", "CVE-2026-53150", "CVE-2026-53080", "CVE-2026-53148", "CVE-2026-43303", "CVE-2026-53149", "CVE-2026-46321", "CVE-2026-53146", "CVE-2026-52947", "CVE-2026-52942", "CVE-2026-52910", "CVE-2026-46322", "CVE-2026-46086", "CVE-2026-45850", "CVE-2026-31709", "CVE-2026-46137", "CVE-2026-52948", "CVE-2026-46320", "CVE-2026-53181", "CVE-2026-52917", "CVE-2026-46196", "CVE-2026-53208", "CVE-2026-53218", "CVE-2026-53219", "CVE-2026-53225", "CVE-2026-53228", "CVE-2026-53236", "CVE-2026-53212", "CVE-2026-53221", "CVE-2026-53227", "CVE-2026-53245", "CVE-2026-53249", "CVE-2026-53253", "CVE-2026-53239", "CVE-2026-53254", "CVE-2026-53242", "CVE-2026-53256", "CVE-2026-53263", "CVE-2026-53265", "CVE-2026-53264", "CVE-2026-53255", "CVE-2026-53268", "CVE-2026-53269", "CVE-2026-53275", "CVE-2026-53337", "CVE-2026-53349", "CVE-2026-53350", "CVE-2026-53352", "CVE-2026-53358", "CVE-2025-23131", "CVE-2026-23278", "CVE-2026-53356", "CVE-2026-31451", "CVE-2026-23302", "CVE-2026-23272", "CVE-2026-46331", "CVE-2026-52928", "CVE-2026-52909", "CVE-2026-53325", "CVE-2026-53167", "CVE-2026-53362", "CVE-2026-53192", "CVE-2026-64560", "CVE-2025-37780" ], "truncated": true } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-15T01:23:25.441Z", "fetchedAt": "2026-10-23T02:43:49.437Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Linuxに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.020Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8075a6c8701b77ff3ce09331b1485a2c06a5660bbb7480139bdb5ef040acb32d", "sourceModifiedAt": "2026-10-15T01:23:25.441Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Linux カーネルの IPv6 実装において、__ip6_append_data() のページ割り当てパスで fraggap（フラグメント間の隙間）を考慮していなかったため、コピー先が skb の末端を越えて skb_shared_info に書き込まれ、メモリ破壊が起こる欠陥が修正されました。", "risk": "この欠陥によりカーネルメモリが破壊され、システムがクラッシュする可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "特権のないユーザーが UDPv6 ソケットで MSG_MORE と MSG_SPLICE_PAGES を組み合わせて使用した場合に、この欠陥をトリガーできます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "paged‑allocation ブランチが MSG_MORE、NETIF_F_SG、または大きな fraglen の条件で選択されたときに影響します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、14200d435af9a9eeb444f529fc2f689a236b7962未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、65fb14cbebb0cd0eff903a22d33537ddc8b95769未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、46f201f8b4c39633a1fa3dc12459f506d470993d未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、6374fb9edf72c67a118a2c214a0dddd04c921e0a未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、e9eacf19281ea2498b36291b56c9606118c2d74e未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、736b380e28d0480c7bc3e022f1950f31fe53a7c5未満。対象のファイル：net/ipv6/ip6_output.c", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.177以上、6.1.*以下。影響なしとして記載：6.6.144以上、6.6.*以下。影響なしとして記載：6.12.95以上、6.12.*以下。影響なしとして記載：6.18.38以上、6.18.*以下。影響なしとして記載：7.1.3以上、7.1.*以下。影響なしとして記載：7.2以上（原資料の上限表記は「*」）。対象のファイル：net/ipv6/ip6_output.c。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "カーネルのソースコードで __ip6_append_data() の paged アロケーションパスに fraggap を加算し、pagedlen から fraggap を減算するように修正します。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-53362」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-53362", "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362" ] }, { "text": "利用しているLinuxの配布元が示す、このCVEへの修正パッケージを管理者に適用してもらいます。Ubuntu Desktopでは「ソフトウェアの更新」から提供された更新を適用できます。サーバーや他の配布元では、それぞれの正規の更新手順に従います。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json" ], "evidenceIds": [ "E3" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "label": "CVE：Linux" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53362", "label": "CVE公式レコード" }, { "url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e", "label": "CISAが示す関連情報" }, { "url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5", "label": "CVE掲載の参考情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb's linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb->end into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()'s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/title", "excerpt": "ipv6: account for fraggap on the paged allocation path", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"14200d435af9a9eeb444f529fc2f689a236b7962\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"65fb14cbebb0cd0eff903a22d33537ddc8b95769\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"46f201f8b4c39633a1fa3dc12459f506d470993d\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"6374fb9edf72c67a118a2c214a0dddd04c921e0a\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"e9eacf19281ea2498b36291b56c9606118c2d74e\",\"status\":\"affected\",\"versionType\":\"git\"},{\"version\":\"773ba4fe9104a64a54d1c00f0fb6ffb95def2b03\",\"lessThan\":\"736b380e28d0480c7bc3e022f1950f31fe53a7c5\",\"status\":\"affected\",\"versionType\":\"git\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/53xxx/CVE-2026-53362.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Linux\",\"vendor\":\"Linux\",\"defaultStatus\":\"affected\",\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"programFiles\":[\"net/ipv6/ip6_output.c\"],\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.1.177\",\"lessThanOrEqual\":\"6.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.6.144\",\"lessThanOrEqual\":\"6.6.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"6.18.38\",\"lessThanOrEqual\":\"6.18.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.1.3\",\"lessThanOrEqual\":\"7.1.*\",\"status\":\"unaffected\",\"versionType\":\"semver\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"status\":\"unaffected\",\"versionType\":\"original_commit_for_fix\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53362", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-53362\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-53362（Linux）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・特権のないユーザーが UDPv6 ソケットで MSG_MORE と MSG_SPLICE_PAGES を組み合わせて使用した場合に、この欠陥をトリガーできます。\n・paged‑allocation ブランチが MSG_MORE、NETIF_F_SG、または大きな fraglen の条件で選択されたときに影響します。\n・公式の対象表：Linux / Linux。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、14200d435af9a9eeb444f529fc2f689a236b7962未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、65fb14cbebb0cd0eff903a22d33537ddc8b95769未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、46f201f8b4c39633a1fa3dc12459f506d470993d未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、6374fb9edf72c67a118a2c214a0dddd04c921e0a未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、e9eacf19281ea2498b36291b56c9606118c2d74e未満。影響ありとして記載：773ba4fe9104a64a54d1c00f0fb6ffb95def2b03以上、736b380e28d0480c7bc3e022f1950f31fe53a7c5未満。対象のファイル：net/ipv6/ip6_output.c\n・公式の対象表：Linux / Linux。影響ありとして記載：6.0。影響なしとして記載：6.0未満の版。影響なしとして記載：6.1.177以上、6.1.*以下。影響なしとして記載：6.6.144以上、6.6.*以下。影響なしとして記載：6.12.95以上、6.12.*以下。影響なしとして記載：6.18.38以上、6.18.*以下。影響なしとして記載：7.1.3以上、7.1.*以下。影響なしとして記載：7.2以上（原資料の上限表記は「*」）。対象のファイル：net/ipv6/ip6_output.c。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-53362", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.020Z", "lastSuccess": "2026-10-23T03:37:42.020Z", "sourceCheckedAt": "2026-10-23T02:43:49.437Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-66384", "aliases": [], "title": "artifactory：脆弱性情報", "summary": "認証されたユーザーが、特定のリモートリポジトリ条件下で、Docker キャッシュパス以外の場所にデータを書き込むことができる。", "risk": "データが意図しないディレクトリに書き込まれる可能性がある。", "product": "artifactory", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "JFROG", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "affected": [ { "product": "artifactory", "range": "< 7.146.35" }, { "product": "artifactory", "range": ">= 7.161.0 / < 7.161.16" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-66384", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66384", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-12T15:14:04.906Z", "modifiedAt": "2026-08-28T03:55:24.229Z", "fetchedAt": "2026-10-23T02:43:49.947Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.", "sourceTitle": "Authenticated users may write data outside the intended Docker cache path", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "versions": [ { "status": "affected", "version": "0", "lessThan": "7.146.35", "versionType": "custom" }, { "status": "affected", "version": "7.161.0", "lessThan": "7.161.16", "versionType": "custom" } ], "defaultStatus": "unaffected", "vendor": "jfrog", "product": "artifactory" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-66384", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "fetchedAt": "2026-10-23T02:43:49.947Z", "publishedAt": "2026-08-12T15:14:04.906Z", "modifiedAt": "2026-08-28T03:55:24.229Z", "state": "published", "provider": "JFROG", "title": "Authenticated users may write data outside the intended Docker cache path", "descriptions": [ { "lang": "en", "value": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "jfrog", "product": "artifactory", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "7.146.35", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.161.0", "lessThan": "7.161.16", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "JFROG", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/0" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "JFROG", "tags": [ "vendor-advisory" ], "provider": "JFROG", "sourcePath": "/containers/cna/references/1" }, { "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://openai.com/index/hugging-face-incident-and-the-road-ahead/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-66384", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.146.35\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.161.0\",\"lessThan\":\"7.161.16\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\",\"vendor\":\"jfrog\",\"product\":\"artifactory\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-22\",\"description\":\"CWE-22 Improper Limitation of a Pathname to a Restricted Directory\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.3,\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-28T03:55:24.229Z", "fetchedAt": "2026-10-23T02:43:49.947Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "artifactoryに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:14.475Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "7484e2f097d24932eb22072a824dda8a5ed9dc9b02683ba05bbf1c485bde94f7", "sourceModifiedAt": "2026-08-28T03:55:24.229Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "認証されたユーザーが、特定のリモートリポジトリ条件下で、Docker キャッシュパス以外の場所にデータを書き込むことができる。", "risk": "データが意図しないディレクトリに書き込まれる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "攻撃は認証されたユーザーであることが必要です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "攻撃は特定のリモートリポジトリ設定が存在する場合にのみ成立します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E2", "E1" ] }, { "text": "公式の対象表：jfrog / artifactory。影響ありとして記載：7.146.35未満の版。影響ありとして記載：7.161.0以上、7.161.16未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E3" ] }, { "text": "「artifactory」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-66384", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-66384" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-66384", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-66384" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-66384", "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-66384" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "label": "CVE：JFROG" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-66384", "label": "CVE公式レコード" }, { "url": "https://docs.jfrog.com/releases/docs/jfrog-security-advisories", "label": "CISAが示す関連情報" }, { "url": "https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66384", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourceField": "/containers/cna/title", "excerpt": "Authenticated users may write data outside the intended Docker cache path", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.", "language": "en", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66384.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThan\":\"7.146.35\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.161.0\",\"lessThan\":\"7.161.16\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\",\"vendor\":\"jfrog\",\"product\":\"artifactory\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-66384", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-66384\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-66384（artifactory）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・攻撃は認証されたユーザーであることが必要です。\n・攻撃は特定のリモートリポジトリ設定が存在する場合にのみ成立します。\n・公式の対象表：jfrog / artifactory。影響ありとして記載：7.146.35未満の版。影響ありとして記載：7.161.0以上、7.161.16未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-66384", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:14.475Z", "lastSuccess": "2026-10-23T03:22:14.475Z", "sourceCheckedAt": "2026-10-23T02:43:49.947Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2015-3246", "aliases": [], "title": "n/a：サービス停止", "summary": "libuser のバージョン 0.56.13-8 未満および 0.60-7 未満（0.60 系列）では、userhelper プログラム（usermode パッケージ内）が /etc/passwd を直接書き換えるため、ローカルユーザーが書き換え中にエラーを起こすとファイル状態が不整合になり、サービスが利用できなくなる（Denial of Service）可能性があります。また、この問題は CVE-2015-3245 と組み合わせると権限昇格につながる可能性があります。", "risk": "ローカルユーザーがエラーを引き起こすことで /etc/passwd が不整合となり、システムの認証機能が利用できなくなる可能性があります（サービス停止）。", "product": "Red Hat Libuser", "category": "linux", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "redhat", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2015-3246", "label": "CVE公式レコード" }, { "url": "http://www.securityfocus.com/bid/76022", "label": "76022" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html", "label": "FEDORA-2015-12301" }, { "url": "https://www.exploit-db.com/exploits/44633/", "label": "44633" }, { "url": "https://access.redhat.com/articles/1537873", "label": "CISAが示す関連情報" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1482.html", "label": "RHSA-2015:1482" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html", "label": "FEDORA-2015-12064" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html", "label": "openSUSE-SU-2015:1332" }, { "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt", "label": "CVE掲載の参考情報" }, { "url": "http://www.securitytracker.com/id/1033040", "label": "1033040" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1483.html", "label": "RHSA-2015:1483" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3246", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2015-08-11T14:00:00.000Z", "modifiedAt": "2026-10-01T18:02:50.537Z", "fetchedAt": "2026-10-23T02:42:58.610Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2015-3246", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "fetchedAt": "2026-10-23T02:42:58.610Z", "publishedAt": "2015-08-11T14:00:00.000Z", "modifiedAt": "2026-10-01T18:02:50.537Z", "state": "published", "provider": "redhat", "title": "", "descriptions": [ { "lang": "en", "value": "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.4, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.securityfocus.com/bid/76022", "label": "76022", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html", "label": "FEDORA-2015-12301", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.exploit-db.com/exploits/44633/", "label": "44633", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://access.redhat.com/articles/1537873", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1482.html", "label": "RHSA-2015:1482", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html", "label": "FEDORA-2015-12064", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html", "label": "openSUSE-SU-2015:1332", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "http://www.securitytracker.com/id/1033040", "label": "1033040", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1483.html", "label": "RHSA-2015:1483", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.4,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T18:02:50.537Z", "fetchedAt": "2026-10-23T02:42:58.610Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-26T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "n/aにサービス停止に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "処理の停止や過大な負荷により、サービスを利用できなくなる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:37:42.023Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d45a447e6d67f33c0f152fd8e7755cf7a2db9c0ee05f1e394e8ba042a21373ac", "sourceModifiedAt": "2026-10-01T18:02:50.537Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "libuser のバージョン 0.56.13-8 未満および 0.60-7 未満（0.60 系列）では、userhelper プログラム（usermode パッケージ内）が /etc/passwd を直接書き換えるため、ローカルユーザーが書き換え中にエラーを起こすとファイル状態が不整合になり、サービスが利用できなくなる（Denial of Service）可能性があります。また、この問題は CVE-2015-3245 と組み合わせると権限昇格につながる可能性があります。", "risk": "ローカルユーザーがエラーを引き起こすことで /etc/passwd が不整合となり、システムの認証機能が利用できなくなる可能性があります（サービス停止）。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "libuser バージョン 0.56.13-8 未満（0.56 系列）で、userhelper プログラム（usermode パッケージ）を使用している環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E1" ] }, { "text": "libuser バージョン 0.60-7 未満（0.60 系列）で、userhelper プログラム（usermode パッケージ）を使用している環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E1" ] }, { "text": "ローカルユーザーが /etc/passwd の書き換え操作を実行できる権限を持っていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E2" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json" ], "evidenceIds": [ "E2" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2015-3246", "label": "CVE公式レコード" }, { "url": "http://www.securityfocus.com/bid/76022", "label": "76022" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html", "label": "FEDORA-2015-12301" }, { "url": "https://www.exploit-db.com/exploits/44633/", "label": "44633" }, { "url": "https://access.redhat.com/articles/1537873", "label": "CISAが示す関連情報" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1482.html", "label": "RHSA-2015:1482" }, { "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html", "label": "FEDORA-2015-12064" }, { "url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html", "label": "openSUSE-SU-2015:1332" }, { "url": "https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt", "label": "CVE掲載の参考情報" }, { "url": "http://www.securitytracker.com/id/1033040", "label": "1033040" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-1483.html", "label": "RHSA-2015:1483" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3246", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/3xxx/CVE-2015-3246.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3246", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2015-3246\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2015-3246（Red Hat Libuser）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・libuser バージョン 0.56.13-8 未満（0.56 系列）で、userhelper プログラム（usermode パッケージ）を使用している環境。\n・libuser バージョン 0.60-7 未満（0.60 系列）で、userhelper プログラム（usermode パッケージ）を使用している環境。\n・ローカルユーザーが /etc/passwd の書き換え操作を実行できる権限を持っていること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2015-3246", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:37:42.023Z", "lastSuccess": "2026-10-23T03:37:42.023Z", "sourceCheckedAt": "2026-10-23T02:42:58.610Z", "errorCode": null }, "glossary": [ { "term": "権限昇格", "meaning": "本来その利用者には許可されていない、より強い権限で操作できるようになることです。必要な元の権限と、得られる権限を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/269.html", "kind": "general_definition" } ] } }, { "id": "CVE-2015-5287", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Automatic Bug Reporting Tool (ABRT) の abrt-hook-ccpp ヘルププログラムは、バージョン 2.7.1 より前では、特定の権限を持つローカルユーザーが予測可能な名前のファイルへのシンボリックリンク攻撃により権限を取得できる。例として /var/tmp/abrt/abrt-hax-coredump や /var/spool/abrt/abrt-hax-coredump が示されている。", "risk": "ローカルユーザーが権限を昇格できる可能性がある。", "product": "Red Hat Automatic Bug Reporting Tool", "category": "linux", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "redhat", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2015-5287", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-2505.html", "label": "RHSA-2015:2505" }, { "url": "https://www.exploit-db.com/exploits/38832/", "label": "38832" }, { "url": "http://www.openwall.com/lists/oss-security/2015/12/01/1", "label": "[oss-security] 20151201 CVE-2015-5273 + CVE-2015-5287, abrt local root in Centos/Fedora/RHEL" }, { "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "label": "CVE掲載の参考情報" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1266837", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/78137", "label": "78137" }, { "url": "https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5287", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2015-12-07T18:00:00.000Z", "modifiedAt": "2026-08-27T03:56:39.465Z", "fetchedAt": "2026-10-23T02:42:58.877Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2015-5287", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "fetchedAt": "2026-10-23T02:42:58.877Z", "publishedAt": "2015-12-07T18:00:00.000Z", "modifiedAt": "2026-08-27T03:56:39.465Z", "state": "published", "provider": "redhat", "title": "", "descriptions": [ { "lang": "en", "value": "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://rhn.redhat.com/errata/RHSA-2015-2505.html", "label": "RHSA-2015:2505", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.exploit-db.com/exploits/38832/", "label": "38832", "tags": [ "exploit", "x_refsource_EXPLOIT-DB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://www.openwall.com/lists/oss-security/2015/12/01/1", "label": "[oss-security] 20151201 CVE-2015-5273 + CVE-2015-5287, abrt local root in Centos/Fedora/RHEL", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1266837", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.securityfocus.com/bid/78137", "label": "78137", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-27T03:56:39.465Z", "fetchedAt": "2026-10-23T02:42:58.877Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-26T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:22:19.216Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2fb943dae0164d04ab26f50f4cc9c43eeff51bdceefca81857cdfe341294ccd5", "sourceModifiedAt": "2026-08-27T03:56:39.465Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Automatic Bug Reporting Tool (ABRT) の abrt-hook-ccpp ヘルププログラムは、バージョン 2.7.1 より前では、特定の権限を持つローカルユーザーが予測可能な名前のファイルへのシンボリックリンク攻撃により権限を取得できる。例として /var/tmp/abrt/abrt-hax-coredump や /var/spool/abrt/abrt-hax-coredump が示されている。", "risk": "ローカルユーザーが権限を昇格できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ABRT のバージョンが 2.7.1 未満であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E1" ] }, { "text": "ローカルユーザーが特定の権限（シンボリックリンク作成権限等）を持っていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E2" ] }, { "text": "管理担当者に、Linuxの種類（Ubuntu、Red Hatなど）と版、対象パッケージ名、配布元を含む完全なパッケージ番号を確認してもらいます。OSの種類や製品の上流の番号だけで、影響の有無を決めないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "更新が用意されていない場合は、配布元や保守会社へCVE番号とパッケージ番号を送り、影響の有無・回避策・提供予定を確認します。他のLinux向けの修正をそのまま入れないでください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json" ], "evidenceIds": [ "E2" ] }, { "text": "修正後の完全なパッケージ番号と、その配布元のCVE対応表を照合します。古い番号のまま修正を取り込む場合があるため、数字が小さいという理由だけで未修正とは扱いません。管理者に必要な再起動の完了も確認してもらってください。", "kind": "procedure", "sourceUrls": [ "https://documentation.ubuntu.com/security/security-updates/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "label": "CVE：redhat" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2015-5287", "label": "CVE公式レコード" }, { "url": "http://rhn.redhat.com/errata/RHSA-2015-2505.html", "label": "RHSA-2015:2505" }, { "url": "https://www.exploit-db.com/exploits/38832/", "label": "38832" }, { "url": "http://www.openwall.com/lists/oss-security/2015/12/01/1", "label": "[oss-security] 20151201 CVE-2015-5273 + CVE-2015-5287, abrt local root in Centos/Fedora/RHEL" }, { "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html", "label": "CVE掲載の参考情報" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1266837", "label": "CVE掲載の参考情報" }, { "url": "http://www.securityfocus.com/bid/78137", "label": "78137" }, { "url": "https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740e", "label": "CISAが示す関連情報" }, { "url": "http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5287", "label": "CISAが示す関連情報" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2015/5xxx/CVE-2015-5287.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2015-5287\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2015-5287（Red Hat Automatic Bug Reporting Tool）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ABRT のバージョンが 2.7.1 未満であること。\n・ローカルユーザーが特定の権限（シンボリックリンク作成権限等）を持っていること。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2015-5287", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:22:19.216Z", "lastSuccess": "2026-10-23T03:22:19.216Z", "sourceCheckedAt": "2026-10-23T02:42:58.877Z", "errorCode": null }, "glossary": [] } } ], "total": 2187, "limit": 20, "offset": 400, "filters": { "product": "all", "type": "all", "q": "", "page": 21 }, "pagination": { "page": 21, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T14:17:50.525Z", "lastAttempt": "2026-10-23T14:17:50.525Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "ok", "lastSuccess": "2026-10-23T14:17:50.525Z", "lastAttempt": "2026-10-23T14:17:50.525Z", "error": null, "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T14:17:50.525Z", "lastAttempt": "2026-10-23T14:17:50.525Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T14:17:50.525Z", "lastAttempt": "2026-10-23T14:17:50.525Z", "error": null, "recordCount": 1, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T13:02:54.887Z 〜 2026-10-23T14:17:50.525Z、全製品の変更 240/240件まで確認、対象1件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-23T14:17:50.525Z", "lastAttempt": "2026-10-23T14:17:50.525Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }