{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-18577", "aliases": [], "title": "N-central：認証の回避", "summary": "不完全なパッチにより、N-central の認証バイパスと管理者アカウント乗っ取りが可能になる。説明では 2026.3.1 までのバージョンが影響を受けると記載されているが、影響範囲の構造化データでは 2026.3 以下が影響対象で、2026.3.1 は含まれない。", "risk": "認証がバイパスされ、管理者アカウントが乗っ取られる可能性がある。", "product": "N-central", "category": "other", "component": "package", "severity": "high", "cvss": 8.2, "cvssVersion": "4.0", "cvssSource": "N-able", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A", "affected": [ { "product": "N-central", "range": "<= 2026.3" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "label": "CVE：N-able" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18577", "label": "CVE公式レコード" }, { "url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18556", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18577", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-08-02T22:06:18.296Z", "modifiedAt": "2026-08-04T13:32:51.312Z", "fetchedAt": "2026-10-23T02:43:46.926Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1", "sourceTitle": "Incomplete patch leads to administrative account takeover", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "N-able", "product": "N-central", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "2026.3", "versionType": "custom" }, { "status": "unaffected", "version": "2026.3.1.7", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-18577", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "fetchedAt": "2026-10-23T02:43:46.926Z", "publishedAt": "2026-08-02T22:06:18.296Z", "modifiedAt": "2026-08-04T13:32:51.312Z", "state": "published", "provider": "N-able", "title": "Incomplete patch leads to administrative account takeover", "descriptions": [ { "lang": "en", "value": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "N-able", "product": "N-central", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "2026.3", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "2026.3.1.7", "versionType": "custom", "status": "unaffected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-288", "lang": "en", "description": "CWE-288 Authentication bypass using an alternate path or channel", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A", "baseScore": 8.2, "baseSeverity": "HIGH", "provider": "N-able", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "label": "N-able", "tags": [], "provider": "N-able", "sourcePath": "/containers/cna/references/0" }, { "url": "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "label": "N-able", "tags": [], "provider": "N-able", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18556", "label": "N-able", "tags": [], "provider": "N-able", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-18577", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.n-able.com/blog/n-central-security-update-august-2-2026", "label": "CISA-ADP", "tags": [ "vendor-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"N-able\",\"product\":\"N-central\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThanOrEqual\":\"2026.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2026.3.1.7\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-288\",\"description\":\"CWE-288 Authentication bypass using an alternate path or channel\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"ATTACKED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.2,\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:A\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T13:32:51.312Z", "fetchedAt": "2026-10-23T02:43:46.926Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-08-03T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "N-centralに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:01.929Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b3ca7d8d7a4bffc3f7404d5265356e2f3372921e384f58a663a9d29de5b1542f", "sourceModifiedAt": "2026-08-04T13:32:51.312Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "不完全なパッチにより、N-central の認証バイパスと管理者アカウント乗っ取りが可能になる。説明では 2026.3.1 までのバージョンが影響を受けると記載されているが、影響範囲の構造化データでは 2026.3 以下が影響対象で、2026.3.1 は含まれない。", "risk": "認証がバイパスされ、管理者アカウントが乗っ取られる可能性がある。", "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "N-central のバージョンが 2026.3.1 までのものは影響を受ける可能性がある（説明による）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "構造化データでは、2026.3 以下のバージョンが影響対象とされ、2026.3.1 は含まれない。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E2", "E3" ] }, { "text": "公式の対象表：N-able / N-central。影響ありとして記載：2026.3以下の版。影響なしとして記載：2026.3.1.7。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E2" ] }, { "text": "「N-central」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-18577", "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "https://www.cve.org/CVERecord?id=CVE-2026-18556", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-18577" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-18577", "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "https://www.cve.org/CVERecord?id=CVE-2026-18556", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-18577" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-18577", "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "https://www.cve.org/CVERecord?id=CVE-2026-18556", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-18577" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "label": "CVE：N-able" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18577", "label": "CVE公式レコード" }, { "url": "https://documentation.n-able.com/N-central/Release_Notes/GA/Content/N-central_2026.3_HF1_Release_Notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18556", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18577", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"N-able\",\"product\":\"N-central\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\",\"lessThanOrEqual\":\"2026.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"2026.3.1.7\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18577.json", "sourceField": "/containers/cna/title", "excerpt": "Incomplete patch leads to administrative account takeover", "language": null }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-18577", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-18577\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-18577（N-central）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・N-central のバージョンが 2026.3.1 までのものは影響を受ける可能性がある（説明による）。\n・構造化データでは、2026.3 以下のバージョンが影響対象とされ、2026.3.1 は含まれない。\n・公式の対象表：N-able / N-central。影響ありとして記載：2026.3以下の版。影響なしとして記載：2026.3.1.7。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-18577", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:01.929Z", "lastSuccess": "2026-10-23T03:23:01.929Z", "sourceCheckedAt": "2026-10-23T02:43:46.926Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-7260", "aliases": [ "GHSA-vc5h-9ppw-p5f3" ], "title": "PHP：細工したアーカイブ内のリンクで処理が停止するおそれ", "summary": "PharDataなどで外部のTAR形式アーカイブを扱い、中にあるファイルを読む機能が対象です。アーカイブ内でリンクが循環するとPHPが止まる問題です。", "risk": "参照先が循環したリンクを際限なく追い、PHPの処理プロセスがクラッシュするおそれがあります。繰り返し処理させられるとサービス停止につながります。", "product": "PHP", "category": "php", "component": "core", "severity": "medium", "cvss": 5.4, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.33" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.33" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.24" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.9" } ], "fixed": [ "8.2.33", "8.3.33", "8.4.24", "8.5.9" ], "steps": [ "この問題の修正が入った版は 8.2.33 / 8.3.33 / 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "該当するWeb処理・バッチ処理で使うPHPを修正版へ更新します。外部アーカイブを扱う入口を一覧にして、更新漏れを確認します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7260", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-07-30T11:03:15.000Z", "modifiedAt": "2026-10-06T20:13:35.000Z", "fetchedAt": "2026-10-23T02:43:50.259Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "sourceTitle": "Stack overflow in phar with circular symlinks", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-phar", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-7260", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7260.json", "fetchedAt": "2026-10-23T02:43:50.259Z", "publishedAt": "2026-07-30T11:22:53.918Z", "modifiedAt": "2026-10-06T20:13:35.000Z", "state": "published", "provider": "php", "title": "Stack overflow in phar with circular symlinks", "descriptions": [ { "lang": "en", "value": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "`phar_get_link_source()` in `ext/phar/util.c` recursively follows symbolic links in phar archives without any depth limit or cycle detection. A crafted tar-based phar archive containing circular symlinks causes unbounded recursion, exhausting the C stack and crashing the PHP process.\r\n\r\nhttps://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/phar/util.c#L60-L82\r\n\r\n```bash\r\npython3 -c \"\r\nimport tarfile\r\nwith tarfile.open('circular_symlinks.tar', 'w') as tar:\r\n a = tarfile.TarInfo(name='file_a'); a.type = tarfile.SYMTYPE; a.linkname = 'file_b'; tar.addfile(a)\r\n b = tarfile.TarInfo(name='file_b'); b.type = tarfile.SYMTYPE; b.linkname = 'file_a'; tar.addfile(b)\r\n\"\r\n\r\nphp -r '\r\n$p = new PharData(\"circular_symlinks.tar\");\r\n$p[\"file_a\"]->getContent();\r\n'\n\n# Expected: Segmentation fault (stack overflow)\r\n```", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-phar", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.2.33; patched versions: 8.2.33", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.3.33; patched versions: 8.3.33", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.4.24; patched versions: 8.4.24", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3" }, { "lang": "en", "value": "Package ext-phar; vulnerable range: <8.5.9; patched versions: 8.5.9", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based buffer overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U", "baseScore": 5.4, "baseSeverity": "MEDIUM", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7260.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-phar\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.33\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.33\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.24\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7260.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7260.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-121\",\"description\":\"CWE-121 Stack-based buffer overflow\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/7xxx/CVE-2026-7260.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"UNREPORTED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"MEDIUM\",\"baseScore\":5.4,\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vc5h-9ppw-p5f3:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "sourcePath": "/description", "text": "`phar_get_link_source()` in `ext/phar/util.c` recursively follows symbolic links in phar archives without any depth limit or cycle detection. A crafted tar-based phar archive containing circular symlinks causes unbounded recursion, exhausting the C stack and crashing the PHP process.\r\n\r\nhttps://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/phar/util.c#L60-L82\r\n\r\n```bash\r\npython3 -c \"\r\nimport tarfile\r\nwith tarfile.open('circular_symlinks.tar', 'w') as tar:\r\n a = tarfile.TarInfo(name='file_a'); a.type = tarfile.SYMTYPE; a.linkname = 'file_b'; tar.addfile(a)\r\n b = tarfile.TarInfo(name='file_b'); b.type = tarfile.SYMTYPE; b.linkname = 'file_a'; tar.addfile(b)\r\n\"\r\n\r\nphp -r '\r\n$p = new PharData(\"circular_symlinks.tar\");\r\n$p[\"file_a\"]->getContent();\r\n'\n\n# Expected: Segmentation fault (stack overflow)\r\n```", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-vc5h-9ppw-p5f3:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.2.33\",\"patched_versions\":\"8.2.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vc5h-9ppw-p5f3:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.3.33\",\"patched_versions\":\"8.3.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vc5h-9ppw-p5f3:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.4.24\",\"patched_versions\":\"8.4.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-vc5h-9ppw-p5f3:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-phar\"},\"vulnerable_version_range\":\"<8.5.9\",\"patched_versions\":\"8.5.9\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-30T12:15:22.862Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-vc5h-9ppw-p5f3", "modifiedAt": "2026-10-06T20:13:35.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-30T12:15:22.862Z", "fetchedAt": "2026-10-23T02:43:50.259Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-10-06T20:13:35.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PharDataなどで外部のTAR形式アーカイブを扱い、中にあるファイルを読む機能が対象です。アーカイブ内でリンクが循環するとPHPが止まる問題です。", "risk": "参照先が循環したリンクを際限なく追い、PHPの処理プロセスがクラッシュするおそれがあります。繰り返し処理させられるとサービス停止につながります。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.33未満、8.3系の8.3.33未満、8.4系の8.4.24未満、8.5系の8.5.9未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "ext-pharで、循環するシンボリックリンクを含むTAR形式のpharアーカイブを処理する場合です。攻撃者がそのアーカイブをアプリに扱わせる必要があります。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "取り込み・バックアップ・更新の担当者へ「外部から受け取ったTARをPharDataで読み込む処理があるか」を確認します。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-7260", "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.33 / 8.3.33 / 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "該当するWeb処理・バッチ処理で使うPHPを修正版へ更新します。外部アーカイブを扱う入口を一覧にして、更新漏れを確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "修正前は信頼できないTARアーカイブの取り込み・参照を止めることを検討します。処理のタイムアウトを延ばす対応では原因は解消しません。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] } ], "verification": [ { "text": "通常のアーカイブ取り込みが成功し、PHPが異常終了しないことを確認します。Webとコマンド実行でPHPの版が別になっていないかも確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-7260（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-7260について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-7260", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7260", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:4ea1b4c8298b234069d8d4159fcafbe042b71a11c29ee6795c6102073750c2ed", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-17544", "aliases": [ "GHSA-x692-q9x7-8c3f" ], "title": "PHP：数値比較に外部入力を渡すとメモリーを壊されるおそれ", "summary": "PHP 8.4・8.5のBCMathでbccomp()を使い、外部から渡された数値を比較する処理が確認対象です。すべての算術計算や、すべてのPHP系列を対象とする説明ではありません。", "risk": "比較する数値と小数点以下の桁数の組み合わせにより、確保した範囲外へ書き込み、PHPのメモリーを壊すおそれがあります。実際の影響はアプリとメモリー配置に依存します。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 8.1, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N", "affected": [ { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.24" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.9" } ], "fixed": [ "8.4.24", "8.5.9" ], "steps": [ "この問題の修正が入った版は 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHP 8.4系は8.4.24、8.5系は8.5.9、または修正を含む後続版へ更新します。入力する数値の長さ・形式・必要な桁数も仕様に合わせて見直します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17544", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/language.types.float.php", "label": "PHP公式：浮動小数の精度の制限" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-07-30T11:03:07.000Z", "modifiedAt": "2026-07-31T03:55:47.261Z", "fetchedAt": "2026-10-23T02:43:46.856Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.", "sourceTitle": "Out-of-bounds write in bccomp() via crafted operand and scale", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-bcmath", "versions": [ { "status": "affected", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-17544", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17544.json", "fetchedAt": "2026-10-23T02:43:46.856Z", "publishedAt": "2026-07-30T11:22:24.023Z", "modifiedAt": "2026-07-31T03:55:47.261Z", "state": "published", "provider": "php", "title": "Out-of-bounds write in bccomp() via crafted operand and scale", "descriptions": [ { "lang": "en", "value": "Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "A call to `bccomp()` with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in `bc_str2num()` when the scale truncates a number whose trailing zeros are subsequently trimmed.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L169-L185\r\n\r\n`str_scale` later determines the number of digits after the decimal point in the resulting string.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L203\r\n\r\nThe string is later populated using `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)`.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L213\r\n\r\nNote that we have shortened the allocated string (`str_scale -= fractional_end - fractional_new_end;`) but have not adjusted `fractional_end` itself. Consequently, `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)` will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write.\r\n\r\nBCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated.\r\n\r\nThe patch adds `fractional_end = fractional_new_end;` after the zero truncation.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-bcmath", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-bcmath; vulnerable range: <8.4.24; patched versions: 8.4.24", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f" }, { "lang": "en", "value": "Package ext-bcmath; vulnerable range: <8.5.9; patched versions: 8.5.9", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds write", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17544.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-bcmath\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.24\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17544.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17544.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-787\",\"description\":\"CWE-787 Out-of-bounds write\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17544.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NO\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.1,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-x692-q9x7-8c3f:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f", "sourcePath": "/description", "text": "A call to `bccomp()` with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in `bc_str2num()` when the scale truncates a number whose trailing zeros are subsequently trimmed.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L169-L185\r\n\r\n`str_scale` later determines the number of digits after the decimal point in the resulting string.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L203\r\n\r\nThe string is later populated using `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)`.\r\n\r\nhttps://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L213\r\n\r\nNote that we have shortened the allocated string (`str_scale -= fractional_end - fractional_new_end;`) but have not adjusted `fractional_end` itself. Consequently, `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)` will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write.\r\n\r\nBCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated.\r\n\r\nThe patch adds `fractional_end = fractional_new_end;` after the zero truncation.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-x692-q9x7-8c3f:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-bcmath\"},\"vulnerable_version_range\":\"<8.4.24\",\"patched_versions\":\"8.4.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-x692-q9x7-8c3f:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-bcmath\"},\"vulnerable_version_range\":\"<8.5.9\",\"patched_versions\":\"8.5.9\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-31T03:55:47.261Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-x692-q9x7-8c3f", "modifiedAt": "2026-07-30T11:03:07.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-31T03:55:47.261Z", "fetchedAt": "2026-10-23T02:43:46.856Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-07-30T11:03:07.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PHP 8.4・8.5のBCMathでbccomp()を使い、外部から渡された数値を比較する処理が確認対象です。すべての算術計算や、すべてのPHP系列を対象とする説明ではありません。", "risk": "比較する数値と小数点以下の桁数の組み合わせにより、確保した範囲外へ書き込み、PHPのメモリーを壊すおそれがあります。実際の影響はアプリとメモリー配置に依存します。", "applicability": [ { "text": "修正前の対象系列は、8.4系の8.4.24未満、8.5系の8.5.9未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "攻撃者が与えた入力をbccomp()で処理し、指定桁数で切り詰めた後に末尾のゼロを除く経路が対象です。開発元がこの告知で修正版を示している系列は8.4と8.5です。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "計算・金額・数量を扱う機能の開発者へ「BCMathのbccomp()へ外部入力を渡す箇所と、scaleの決め方」を確認します。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-17544", "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "PHP 8.4系は8.4.24、8.5系は8.5.9、または修正を含む後続版へ更新します。入力する数値の長さ・形式・必要な桁数も仕様に合わせて見直します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "更新まで、外部入力の数値を直接この関数へ渡す機能の停止・制限を検討します。金額計算を安易に浮動小数へ置き換えると計算誤差が出るため、開発者が影響を確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f", "https://www.php.net/manual/en/language.types.float.php" ] } ], "verification": [ { "text": "普段の金額・数量の比較と境界値が期待どおりになることを、既存の計算結果と照らして確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-17544（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-17544について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-17544", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17544", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/language.types.float.php", "label": "PHP公式：浮動小数の精度の制限" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:e0114e495adafe2247c916e9f4dd7e0c24fff09463b802cac7961472ae777513", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-17543", "aliases": [ "GHSA-7qpv-r5mr-78m4" ], "title": "PHP：PostgreSQLの検索・更新に不正な命令を混ぜられるおそれ", "summary": "PostgreSQLへ接続し、pg_insert()、pg_update()、pg_select()、pg_delete()で利用者入力を処理するアプリが確認対象です。MySQLだけを使う一般的なWordPress構成とは条件が異なります。", "risk": "本来は文字列として扱う入力をSQLの一部として解釈させられ、予定外の検索やデータ操作につながるおそれがあります。被害の範囲は接続用DBユーザーの権限にも左右されます。", "product": "PHP", "category": "php", "component": "core", "severity": "high", "cvss": 8.1, "cvssVersion": "4.0", "cvssSource": "php", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U", "affected": [ { "product": "PHP 8.2系", "range": "8.2.* / < 8.2.33" }, { "product": "PHP 8.3系", "range": "8.3.* / < 8.3.33" }, { "product": "PHP 8.4系", "range": "8.4.* / < 8.4.24" }, { "product": "PHP 8.5系", "range": "8.5.* / < 8.5.9" } ], "fixed": [ "8.2.33", "8.3.33", "8.4.24", "8.5.9" ], "steps": [ "この問題の修正が入った版は 8.2.33 / 8.3.33 / 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "PHPを修正版へ更新し、影響する検索・登録・更新・削除処理を確認します。DB接続ユーザーが不要な管理権限を持っていないかも見直します。", "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。" ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17543", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/function.pg-query-params.php", "label": "PHP公式：SQLと入力値を分離する方法" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "publishedAt": "2026-07-30T11:02:39.000Z", "modifiedAt": "2026-07-31T03:55:46.475Z", "fetchedAt": "2026-10-23T02:43:46.854Z", "exploitStatus": "unknown", "sources": [ "CVE", "PHP Security" ], "originalText": "Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "sourceTitle": "SQL injection in ext-pgsql via E'...' backslash breakout", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "PHP Group", "product": "PHP", "packageName": "ext-pgsql", "versions": [ { "status": "affected", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver" }, { "status": "affected", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver" }, { "status": "affected", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver" }, { "status": "affected", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-17543", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17543.json", "fetchedAt": "2026-10-23T02:43:46.854Z", "publishedAt": "2026-07-30T11:22:04.549Z", "modifiedAt": "2026-07-31T03:55:46.475Z", "state": "published", "provider": "php", "title": "SQL injection in ext-pgsql via E'...' backslash breakout", "descriptions": [ { "lang": "en", "value": "Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "sourcePath": "/containers/cna/descriptions/0/value" }, { "lang": "en", "value": "`php_pgsql_convert()` is used to convert and escape user-provided parameters in `pg_insert()`, `pg_update()`, `pg_select()`, and `pg_delete()`. It does so using `PQescapeStringConn()` and then wraps the result in an escape string constant, `E'...'` (via `php_pgsql_add_quotes()`).\r\n\r\nhttps://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/pgsql/pgsql.c#L4751-L4757\r\n\r\nWith `standard_conforming_strings = on` (the default since PostgreSQL 9.1), `PQescapeStringConn()` does not correctly escape values for the escape string constant `E'...'`, as it does not escape `\\` under this configuration. When `PQescapeStringConn()` escapes `'` as `''`, an attacker can trivially terminate the string by escaping the first single quote.\r\n\r\n\r\n\r\nNote that the doubled `\\\\` is a PHP escape sequence and that the `\\` appears only once in the parameter. Also note that `pg_select()` escapes the `'` by doubling it but does not escape the `\\`. Consequently, the first of the two `'` characters is escaped (meaning that it represents a literal `'`), while the second terminates the string. Everything after that is interpreted as part of the query.\r\n\r\nThe solution changes `php_pgsql_convert()` to wrap parameters in non-escaping string constants instead.", "sourcePath": "/description", "representation": "defensive_sections", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4" } ], "affected": [ { "vendor": "PHP Group", "product": "PHP", "sourcePath": "/containers/cna/affected/0", "packageName": "ext-pgsql", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.2.*", "lessThan": "8.2.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "8.3.*", "lessThan": "8.3.33", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "8.4.*", "lessThan": "8.4.24", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "8.5.*", "lessThan": "8.5.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Package ext-pgsql; vulnerable range: <8.2.33; patched versions: 8.2.33", "sourcePath": "/vulnerabilities/0/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4" }, { "lang": "en", "value": "Package ext-pgsql; vulnerable range: <8.3.33; patched versions: 8.3.33", "sourcePath": "/vulnerabilities/1/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4" }, { "lang": "en", "value": "Package ext-pgsql; vulnerable range: <8.4.24; patched versions: 8.4.24", "sourcePath": "/vulnerabilities/2/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4" }, { "lang": "en", "value": "Package ext-pgsql; vulnerable range: <8.5.9; patched versions: 8.5.9", "sourcePath": "/vulnerabilities/3/patched_versions", "representation": "structured_field_summary", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "php", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4", "label": "PHP開発元のアドバイザリ", "provider": "PHP Security", "sourcePath": "/html_url" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17543.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"PHP Group\",\"product\":\"PHP\",\"packageName\":\"ext-pgsql\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.2.*\",\"lessThan\":\"8.2.33\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.3.*\",\"lessThan\":\"8.3.33\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.4.*\",\"lessThan\":\"8.4.24\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"8.5.*\",\"lessThan\":\"8.5.9\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17543.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17543.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-89\",\"description\":\"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/17xxx/CVE-2026-17543.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"YES\",\"Recovery\":\"USER\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.1,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:Y/R:U\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qpv-r5mr-78m4:/description", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "sourcePath": "/description", "text": "`php_pgsql_convert()` is used to convert and escape user-provided parameters in `pg_insert()`, `pg_update()`, `pg_select()`, and `pg_delete()`. It does so using `PQescapeStringConn()` and then wraps the result in an escape string constant, `E'...'` (via `php_pgsql_add_quotes()`).\r\n\r\nhttps://github.com/php/php-src/blob/cbc0489126a7682796aad1e5fb4e51de74af162c/ext/pgsql/pgsql.c#L4751-L4757\r\n\r\nWith `standard_conforming_strings = on` (the default since PostgreSQL 9.1), `PQescapeStringConn()` does not correctly escape values for the escape string constant `E'...'`, as it does not escape `\\` under this configuration. When `PQescapeStringConn()` escapes `'` as `''`, an attacker can trivially terminate the string by escaping the first single quote.\r\n\r\n\r\n\r\nNote that the doubled `\\\\` is a PHP escape sequence and that the `\\` appears only once in the parameter. Also note that `pg_select()` escapes the `'` by doubling it but does not escape the `\\`. Consequently, the first of the two `'` characters is escaped (meaning that it represents a literal `'`), while the second terminates the string. Everything after that is interpreted as part of the query.\r\n\r\nThe solution changes `php_pgsql_convert()` to wrap parameters in non-escaping string constants instead.", "truncated": false, "representation": "defensive_sections", "filtered": true }, { "evidenceId": "php:GHSA-7qpv-r5mr-78m4:/vulnerabilities/0", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "sourcePath": "/vulnerabilities/0", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pgsql\"},\"vulnerable_version_range\":\"<8.2.33\",\"patched_versions\":\"8.2.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qpv-r5mr-78m4:/vulnerabilities/1", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "sourcePath": "/vulnerabilities/1", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pgsql\"},\"vulnerable_version_range\":\"<8.3.33\",\"patched_versions\":\"8.3.33\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qpv-r5mr-78m4:/vulnerabilities/2", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "sourcePath": "/vulnerabilities/2", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pgsql\"},\"vulnerable_version_range\":\"<8.4.24\",\"patched_versions\":\"8.4.24\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "php:GHSA-7qpv-r5mr-78m4:/vulnerabilities/3", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "sourcePath": "/vulnerabilities/3", "text": "{\"package\":{\"ecosystem\":\"php\",\"name\":\"ext-pgsql\"},\"vulnerable_version_range\":\"<8.5.9\",\"patched_versions\":\"8.5.9\",\"vulnerable_functions\":[]}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record_with_vendor_advisory", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 PHP開発元のアドバイザリ本文・明記された修正版を追加し、各抜粋の実際の取得元URLを保持しています。" }, "primaryModifiedAt": "2026-07-31T03:55:46.475Z", "supplementarySources": [ { "sourceType": "PHP Security", "sourceUrl": "https://api.github.com/repos/php/php-src/security-advisories/GHSA-7qpv-r5mr-78m4", "modifiedAt": "2026-07-30T11:02:39.000Z", "provider": "The PHP Group", "limits": { "completeness": "official_advisory", "truncatedFields": [], "note": "PHP開発元のアドバイザリです。要約・影響・対策と構造化された対象範囲・修正版を取得しています。攻撃実証コードと再現手順は除外しています。" } } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-31T03:55:46.475Z", "fetchedAt": "2026-10-23T02:43:46.854Z", "state": "published" }, { "source": "PHP Security", "modifiedAt": "2026-07-30T11:02:39.000Z", "fetchedAt": "2026-10-22T22:18:00.744Z", "state": "published" } ], "sourceSummary": "PHPにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:04:18.000Z", "reviewState": "current", "summary": "PostgreSQLへ接続し、pg_insert()、pg_update()、pg_select()、pg_delete()で利用者入力を処理するアプリが確認対象です。MySQLだけを使う一般的なWordPress構成とは条件が異なります。", "risk": "本来は文字列として扱う入力をSQLの一部として解釈させられ、予定外の検索やデータ操作につながるおそれがあります。被害の範囲は接続用DBユーザーの権限にも左右されます。", "applicability": [ { "text": "修正前の対象系列は、8.2系の8.2.33未満、8.3系の8.3.33未満、8.4系の8.4.24未満、8.5系の8.5.9未満です。系列を取り違えず、下の利用条件と合わせて確認します。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "ext-pgsqlの上記関数で入力を変換する処理と、PostgreSQLのstandard_conforming_strings=onの組み合わせが問題になります。このDB設定はPostgreSQL 9.1以降の既定です。", "kind": "fact", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "開発担当者へ「PostgreSQLを使用しているか、上記4関数にフォームなどの入力を渡しているか」を確認します。画面上でDB名を見つけられない場合は管理者に問い合わせます。", "kind": "check", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "最初に「PHP」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-17543", "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] } ], "versionChecks": [ { "text": "WordPressを使っている場合は、管理画面の「ツール」→「サイトヘルス」→「情報」→「サーバー」で「PHPバージョン」を控えます。PHPはサーバー側のソフトウェアなので、WordPress本体の更新だけではPHPの更新にはなりません。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://www.php.net/manual/en/install.general.php" ] }, { "text": "それ以外は、契約しているレンタルサーバーの管理画面で、対象ドメインに割り当てられたPHPの版を確認します。画面に番号が出ない場合は、ドメイン名と下の問い合わせ文をサーバー会社へ送ってください。複数のサイトがある場合は、サイトごとに確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php" ] } ], "actions": [ { "text": "この問題の修正が入った版は 8.2.33 / 8.3.33 / 8.4.24 / 8.5.9 です。サーバー管理者に、使っている系列の修正版、または修正を含む新しい版への更新を依頼してください。", "kind": "fix", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "PHPを修正版へ更新し、影響する検索・登録・更新・削除処理を確認します。DB接続ユーザーが不要な管理権限を持っていないかも見直します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "レンタルサーバーは、サーバー会社に対象サイトのPHP更新を依頼するか、同社の管理画面で修正を含む提供版へ変更します。自分で管理しているサーバーは、管理者がOS・配布元の正規パッケージで更新し、必要なサービスの再起動まで行ってください。系列を変える場合はアプリの互換性も確認します。", "kind": "procedure", "sourceUrls": [ "https://www.php.net/manual/en/install.general.php", "https://www.php.net/supported-versions.php", "https://documentation.ubuntu.com/security/security-updates/" ] } ], "temporaryMitigations": [ { "text": "修正まで、該当する外部入力を受ける機能を制限するか、開発者が値とSQLを分離するパラメーター化された処理へ変更することを検討します。利用者側で入力文字を手作業で置換する方法だけに頼らないでください。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4", "https://www.php.net/manual/en/function.pg-query-params.php" ] } ], "verification": [ { "text": "通常の日本語・引用符を含む正規の入力で検索や保存が成功し、意図した件数・対象だけが処理されることを検証環境で確認します。", "kind": "procedure", "sourceUrls": [ "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4" ] }, { "text": "更新後は、実際にWebサイトを動かしているPHPの版を管理画面・サイトヘルスで再確認し、ログインやフォーム送信などを試します。古い番号を保った修正パッケージの場合は、このCVEの修正が適用済みであることを提供元に確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://access.redhat.com/solutions/57665" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-17543（PHP）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-17543について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-17543", "sources": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4", "label": "PHP開発元の個別アドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-17543", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://www.php.net/manual/en/install.general.php", "label": "PHP公式：実行環境とインストール" }, { "url": "https://www.php.net/supported-versions.php", "label": "PHP公式：サポート対象の系列" }, { "url": "https://documentation.ubuntu.com/security/security-updates/", "label": "Ubuntu公式：セキュリティ更新と修正の確認" }, { "url": "https://www.php.net/manual/en/function.pg-query-params.php", "label": "PHP公式：SQLと入力値を分離する方法" }, { "url": "https://access.redhat.com/solutions/57665", "label": "Red Hat公式：古い版への修正の取り込み" } ], "reviewedSourceFingerprint": "reviewed-source-v1:aa4f81f186c8f82fc4c27fe0b209f67e1eabc57851f31f439e8a37dfa6502593", "reviewedSourceScope": "official_evidence", "glossary": [ { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-20316", "aliases": [], "title": "Cisco Secure Firewall Management Center (FMC)：脆弱性情報", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに静的な低権限アカウントが存在し、認証されていないリモート攻撃者がそのアカウントでログインできるため、影響を受けたデバイスに対して機密データへアクセスできる可能性があります。この脆弱性は、低権限アカウントの固定パスワードが原因であり、攻撃者はそのアカウントを使用してシステムにログインできます。なお、FMC の管理インターフェースがインターネットに公開されていない場合、攻撃対象となる範囲は縮小されます。Cisco はこの脆弱性を他の FMC 脆弱性と組み合わせて特権昇格に利用できる点から、スコアが示すよりも高い「High」のセキュリティインパクト評価 (SIR) を付与しています。", "risk": "攻撃者が低権限ユーザーとしてログインし、機密データにアクセスできる可能性があります。", "product": "Cisco Secure Firewall Management Center (FMC)", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "affected": [ { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.3.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.1.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.5.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.3.1.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.6.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.9" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.7" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.8.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.2.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.10.2" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.10.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.2.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.3" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.11" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "10.0.0" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.4" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.0.9" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.2.11" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.7.12" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.6.5" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.6" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "10.0.1" }, { "product": "Cisco Secure Firewall Management Center (FMC)", "range": "7.4.7" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-29T16:22:08.888Z", "modifiedAt": "2026-09-16T20:14:18.851Z", "fetchedAt": "2026-10-23T02:43:47.475Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. \r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.  \r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.", "sourceTitle": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "versions": [ { "version": "7.0.0", "status": "affected" }, { "version": "7.0.0.1", "status": "affected" }, { "version": "7.0.1", "status": "affected" }, { "version": "7.0.1.1", "status": "affected" }, { "version": "7.0.2", "status": "affected" }, { "version": "7.2.0", "status": "affected" }, { "version": "7.0.2.1", "status": "affected" }, { "version": "7.0.3", "status": "affected" }, { "version": "7.2.0.1", "status": "affected" }, { "version": "7.0.4", "status": "affected" }, { "version": "7.2.1", "status": "affected" }, { "version": "7.0.5", "status": "affected" }, { "version": "7.3.0", "status": "affected" }, { "version": "7.2.2", "status": "affected" }, { "version": "7.3.1", "status": "affected" }, { "version": "7.2.3", "status": "affected" }, { "version": "7.2.3.1", "status": "affected" }, { "version": "7.2.4", "status": "affected" }, { "version": "7.0.6", "status": "affected" }, { "version": "7.2.4.1", "status": "affected" }, { "version": "7.2.5", "status": "affected" }, { "version": "7.3.1.1", "status": "affected" }, { "version": "7.4.0", "status": "affected" }, { "version": "7.0.6.1", "status": "affected" }, { "version": "7.2.5.1", "status": "affected" }, { "version": "7.4.1", "status": "affected" }, { "version": "7.2.6", "status": "affected" }, { "version": "7.4.1.1", "status": "affected" }, { "version": "7.0.6.2", "status": "affected" }, { "version": "7.2.7", "status": "affected" }, { "version": "7.2.5.2", "status": "affected" }, { "version": "7.3.1.2", "status": "affected" }, { "version": "7.2.8", "status": "affected" }, { "version": "7.6.0", "status": "affected" }, { "version": "7.4.2", "status": "affected" }, { "version": "7.2.8.1", "status": "affected" }, { "version": "7.0.6.3", "status": "affected" }, { "version": "7.4.2.1", "status": "affected" }, { "version": "7.2.9", "status": "affected" }, { "version": "7.0.7", "status": "affected" }, { "version": "7.7.0", "status": "affected" }, { "version": "7.4.2.2", "status": "affected" }, { "version": "7.2.10", "status": "affected" }, { "version": "7.6.1", "status": "affected" }, { "version": "7.4.2.3", "status": "affected" }, { "version": "7.0.8", "status": "affected" }, { "version": "7.6.2", "status": "affected" }, { "version": "7.7.10", "status": "affected" }, { "version": "7.2.10.1", "status": "affected" }, { "version": "7.0.8.1", "status": "affected" }, { "version": "7.6.2.1", "status": "affected" }, { "version": "7.2.10.2", "status": "affected" }, { "version": "7.7.10.1", "status": "affected" }, { "version": "7.4.2.4", "status": "affected" }, { "version": "7.4.3", "status": "affected" }, { "version": "7.6.3", "status": "affected" }, { "version": "7.7.11", "status": "affected" }, { "version": "7.6.4", "status": "affected" }, { "version": "10.0.0", "status": "affected" }, { "version": "7.4.4", "status": "affected" }, { "version": "7.4.5", "status": "affected" }, { "version": "7.0.9", "status": "affected" }, { "version": "7.2.11", "status": "affected" }, { "version": "7.7.12", "status": "affected" }, { "version": "7.6.5", "status": "affected" }, { "version": "7.4.6", "status": "affected" }, { "version": "10.0.1", "status": "affected" }, { "version": "7.4.7", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20316", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "fetchedAt": "2026-10-23T02:43:47.475Z", "publishedAt": "2026-07-29T16:22:08.888Z", "modifiedAt": "2026-09-16T20:14:18.851Z", "state": "published", "provider": "cisco", "title": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. \r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.  \r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Secure Firewall Management Center (FMC)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "7.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "7.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "7.0.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "7.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "7.2.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "7.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "7.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "7.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "7.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "7.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "7.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "7.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "7.2.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "7.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "7.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "7.2.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "7.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "7.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "7.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "7.0.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "7.2.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "7.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "7.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "7.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "7.0.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "7.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "7.2.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "7.3.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "7.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "7.6.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "7.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "7.2.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "7.0.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "7.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "7.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "7.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "7.7.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "7.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "7.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "7.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "7.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "7.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "7.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "7.7.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "7.2.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "7.0.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "7.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "7.2.10.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "7.7.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "7.4.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "7.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "7.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "7.7.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "7.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "10.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "7.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "7.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "7.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "7.2.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "7.7.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "7.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "7.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "10.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "7.4.7", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-259", "lang": "en", "description": "Use of Hard-coded Password", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "label": "cisco-sa-fmc-static-cred-BET3Cjh", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20316", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.6.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"},{\"version\":\"7.0.9\",\"status\":\"affected\"},{\"version\":\"7.2.11\",\"status\":\"affected\"},{\"version\":\"7.7.12\",\"status\":\"affected\"},{\"version\":\"7.6.5\",\"status\":\"affected\"},{\"version\":\"7.4.6\",\"status\":\"affected\"},{\"version\":\"10.0.1\",\"status\":\"affected\"},{\"version\":\"7.4.7\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. \r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.  \r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Use of Hard-coded Password\",\"type\":\"cwe\",\"cweId\":\"CWE-259\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-16T20:14:18.851Z", "fetchedAt": "2026-10-23T02:43:47.475Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-29T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Cisco Secure Firewall Management Center (FMC)に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:03.324Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "91b983a1e6c5a795e642ee3b43dc0c327c0e1fb70dc21acf6f54a4b8ec1ecea8", "sourceModifiedAt": "2026-09-16T20:14:18.851Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに静的な低権限アカウントが存在し、認証されていないリモート攻撃者がそのアカウントでログインできるため、影響を受けたデバイスに対して機密データへアクセスできる可能性があります。この脆弱性は、低権限アカウントの固定パスワードが原因であり、攻撃者はそのアカウントを使用してシステムにログインできます。なお、FMC の管理インターフェースがインターネットに公開されていない場合、攻撃対象となる範囲は縮小されます。Cisco はこの脆弱性を他の FMC 脆弱性と組み合わせて特権昇格に利用できる点から、スコアが示すよりも高い「High」のセキュリティインパクト評価 (SIR) を付与しています。", "risk": "攻撃者が低権限ユーザーとしてログインし、機密データにアクセスできる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに静的な低権限アカウントが設定されていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "認証なしのリモート攻撃者がその低権限アカウントを使用してログインできること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "FMC の管理インターフェースがインターネットに公開されている場合に攻撃対象となり、公開されていない場合は攻撃面が減少すること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.0.1.1。影響ありとして記載：7.0.2。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.6.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。影響ありとして記載：7.0.9。影響ありとして記載：7.2.11。影響ありとして記載：7.7.12。影響ありとして記載：7.6.5。影響ありとして記載：7.4.6。影響ありとして記載：10.0.1。影響ありとして記載：7.4.7。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Secure Firewall Management Center (FMC)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20316", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20316" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20316", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20316" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20316", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-20316" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20316", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20316", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.\r\n\r\nThis vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user. \r\nNote: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.  \r\nCisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Secure Firewall Management Center Software Static Credential Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20316.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Secure Firewall Management Center (FMC)\",\"versions\":[{\"version\":\"7.0.0\",\"status\":\"affected\"},{\"version\":\"7.0.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.2\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"status\":\"affected\"},{\"version\":\"7.0.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.3\",\"status\":\"affected\"},{\"version\":\"7.2.0.1\",\"status\":\"affected\"},{\"version\":\"7.0.4\",\"status\":\"affected\"},{\"version\":\"7.2.1\",\"status\":\"affected\"},{\"version\":\"7.0.5\",\"status\":\"affected\"},{\"version\":\"7.3.0\",\"status\":\"affected\"},{\"version\":\"7.2.2\",\"status\":\"affected\"},{\"version\":\"7.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.3\",\"status\":\"affected\"},{\"version\":\"7.2.3.1\",\"status\":\"affected\"},{\"version\":\"7.2.4\",\"status\":\"affected\"},{\"version\":\"7.0.6\",\"status\":\"affected\"},{\"version\":\"7.2.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.5\",\"status\":\"affected\"},{\"version\":\"7.3.1.1\",\"status\":\"affected\"},{\"version\":\"7.4.0\",\"status\":\"affected\"},{\"version\":\"7.0.6.1\",\"status\":\"affected\"},{\"version\":\"7.2.5.1\",\"status\":\"affected\"},{\"version\":\"7.4.1\",\"status\":\"affected\"},{\"version\":\"7.2.6\",\"status\":\"affected\"},{\"version\":\"7.4.1.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.2\",\"status\":\"affected\"},{\"version\":\"7.2.7\",\"status\":\"affected\"},{\"version\":\"7.2.5.2\",\"status\":\"affected\"},{\"version\":\"7.3.1.2\",\"status\":\"affected\"},{\"version\":\"7.2.8\",\"status\":\"affected\"},{\"version\":\"7.6.0\",\"status\":\"affected\"},{\"version\":\"7.4.2\",\"status\":\"affected\"},{\"version\":\"7.2.8.1\",\"status\":\"affected\"},{\"version\":\"7.0.6.3\",\"status\":\"affected\"},{\"version\":\"7.4.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.9\",\"status\":\"affected\"},{\"version\":\"7.0.7\",\"status\":\"affected\"},{\"version\":\"7.7.0\",\"status\":\"affected\"},{\"version\":\"7.4.2.2\",\"status\":\"affected\"},{\"version\":\"7.2.10\",\"status\":\"affected\"},{\"version\":\"7.6.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.3\",\"status\":\"affected\"},{\"version\":\"7.0.8\",\"status\":\"affected\"},{\"version\":\"7.6.2\",\"status\":\"affected\"},{\"version\":\"7.7.10\",\"status\":\"affected\"},{\"version\":\"7.2.10.1\",\"status\":\"affected\"},{\"version\":\"7.0.8.1\",\"status\":\"affected\"},{\"version\":\"7.6.2.1\",\"status\":\"affected\"},{\"version\":\"7.2.10.2\",\"status\":\"affected\"},{\"version\":\"7.7.10.1\",\"status\":\"affected\"},{\"version\":\"7.4.2.4\",\"status\":\"affected\"},{\"version\":\"7.4.3\",\"status\":\"affected\"},{\"version\":\"7.6.3\",\"status\":\"affected\"},{\"version\":\"7.7.11\",\"status\":\"affected\"},{\"version\":\"7.6.4\",\"status\":\"affected\"},{\"version\":\"10.0.0\",\"status\":\"affected\"},{\"version\":\"7.4.4\",\"status\":\"affected\"},{\"version\":\"7.4.5\",\"status\":\"affected\"},{\"version\":\"7.0.9\",\"status\":\"affected\"},{\"version\":\"7.2.11\",\"status\":\"affected\"},{\"version\":\"7.7.12\",\"status\":\"affected\"},{\"version\":\"7.6.5\",\"status\":\"affected\"},{\"version\":\"7.4.6\",\"status\":\"affected\"},{\"version\":\"10.0.1\",\"status\":\"affected\"},{\"version\":\"7.4.7\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20316", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20316\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20316（Cisco Secure Firewall Management Center (FMC)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Secure Firewall Management Center (FMC) のウェブインターフェースに静的な低権限アカウントが設定されていること。\n・認証なしのリモート攻撃者がその低権限アカウントを使用してログインできること。\n・FMC の管理インターフェースがインターネットに公開されている場合に攻撃対象となり、公開されていない場合は攻撃面が減少すること。\n・公式の対象表：Cisco / Cisco Secure Firewall Management Center (FMC)。影響ありとして記載：7.0.0。影響ありとして記載：7.0.0.1。影響ありとして記載：7.0.1。影響ありとして記載：7.0.1.1。影響ありとして記載：7.0.2。影響ありとして記載：7.2.0。影響ありとして記載：7.0.2.1。影響ありとして記載：7.0.3。影響ありとして記載：7.2.0.1。影響ありとして記載：7.0.4。影響ありとして記載：7.2.1。影響ありとして記載：7.0.5。影響ありとして記載：7.3.0。影響ありとして記載：7.2.2。影響ありとして記載：7.3.1。影響ありとして記載：7.2.3。影響ありとして記載：7.2.3.1。影響ありとして記載：7.2.4。影響ありとして記載：7.0.6。影響ありとして記載：7.2.4.1。影響ありとして記載：7.2.5。影響ありとして記載：7.3.1.1。影響ありとして記載：7.4.0。影響ありとして記載：7.0.6.1。影響ありとして記載：7.2.5.1。影響ありとして記載：7.4.1。影響ありとして記載：7.2.6。影響ありとして記載：7.4.1.1。影響ありとして記載：7.0.6.2。影響ありとして記載：7.2.7。影響ありとして記載：7.2.5.2。影響ありとして記載：7.3.1.2。影響ありとして記載：7.2.8。影響ありとして記載：7.6.0。影響ありとして記載：7.4.2。影響ありとして記載：7.2.8.1。影響ありとして記載：7.0.6.3。影響ありとして記載：7.4.2.1。影響ありとして記載：7.2.9。影響ありとして記載：7.0.7。影響ありとして記載：7.7.0。影響ありとして記載：7.4.2.2。影響ありとして記載：7.2.10。影響ありとして記載：7.6.1。影響ありとして記載：7.4.2.3。影響ありとして記載：7.0.8。影響ありとして記載：7.6.2。影響ありとして記載：7.7.10。影響ありとして記載：7.2.10.1。影響ありとして記載：7.0.8.1。影響ありとして記載：7.6.2.1。影響ありとして記載：7.2.10.2。影響ありとして記載：7.7.10.1。影響ありとして記載：7.4.2.4。影響ありとして記載：7.4.3。影響ありとして記載：7.6.3。影響ありとして記載：7.7.11。影響ありとして記載：7.6.4。影響ありとして記載：10.0.0。影響ありとして記載：7.4.4。影響ありとして記載：7.4.5。影響ありとして記載：7.0.9。影響ありとして記載：7.2.11。影響ありとして記載：7.7.12。影響ありとして記載：7.6.5。影響ありとして記載：7.4.6。影響ありとして記載：10.0.1。影響ありとして記載：7.4.7。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20316", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:03.324Z", "lastSuccess": "2026-10-23T03:23:03.324Z", "sourceCheckedAt": "2026-10-23T02:43:47.475Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-68686", "aliases": [], "title": "FortiOS：情報の漏えい", "summary": "Fortinet FortiOS 7.6.0 から 7.6.1、7.4.0 から 7.4.6、7.2 系列全バージョン、7.0 系列全バージョン、6.4 系列全バージョンにおいて、認証されていないリモート攻撃者が細工した HTTP リクエストを送ることで、シンボリックリンク永続化機構用に開発されたパッチを回避できる可能性があります。ただし、攻撃者はまず別の脆弱性を利用してファイルシステムレベルで製品を侵害している必要があります。", "risk": "機密情報が不正な者に漏洩する恐れがあります。", "product": "FortiOS", "category": "other", "component": "package", "severity": "medium", "cvss": 5.3, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "affected": [ { "product": "FortiOS", "range": ">= 7.6.0 / <= 7.6.1" }, { "product": "FortiOS", "range": ">= 7.4.0 / <= 7.4.6" }, { "product": "FortiOS", "range": ">= 7.2.0 / <= 7.2.13" }, { "product": "FortiOS", "range": ">= 7.0.0 / <= 7.0.19" }, { "product": "FortiOS", "range": ">= 6.4.0 / <= 6.4.16" } ], "fixed": [], "steps": [ "FortiOS をバージョン 7.6.2 以上にアップグレードする。", "FortiOS をバージョン 7.4.7 以上にアップグレードする。", "「CVE-2025-68686」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68686", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68686", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-10T15:39:12.777Z", "modifiedAt": "2026-07-28T03:55:36.619Z", "fetchedAt": "2026-10-23T02:43:40.323Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiOS", "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "7.6.0", "lessThanOrEqual": "7.6.1", "status": "affected" }, { "versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.6", "status": "affected" }, { "versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.13", "status": "affected" }, { "versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "status": "affected" }, { "versionType": "semver", "version": "6.4.0", "lessThanOrEqual": "6.4.16", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-68686", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "fetchedAt": "2026-10-23T02:43:40.323Z", "publishedAt": "2026-02-10T15:39:12.777Z", "modifiedAt": "2026-07-28T03:55:36.619Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiOS", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "7.6.0", "lessThanOrEqual": "7.6.1", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.4.0", "lessThanOrEqual": "7.4.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.2.0", "lessThanOrEqual": "7.2.13", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.0", "lessThanOrEqual": "7.0.19", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "6.4.0", "lessThanOrEqual": "6.4.16", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiOS version 7.6.2 or above\nUpgrade to FortiOS version 7.4.7 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-200", "lang": "en", "description": "Information disclosure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C", "baseScore": 5.3, "baseSeverity": "MEDIUM", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68686", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.1\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.6\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.16\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiOS version 7.6.2 or above\nUpgrade to FortiOS version 7.4.7 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-200\",\"description\":\"Information disclosure\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-28T03:55:36.619Z", "fetchedAt": "2026-10-23T02:43:40.323Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "FortiOSに情報の漏えいに関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来公開しない情報を読み取られる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:04.181Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ebb23c380d15d2b87a32a09fabeb0445532e81524cb7e0afbcbafe969fe26551", "sourceModifiedAt": "2026-07-28T03:55:36.619Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Fortinet FortiOS 7.6.0 から 7.6.1、7.4.0 から 7.4.6、7.2 系列全バージョン、7.0 系列全バージョン、6.4 系列全バージョンにおいて、認証されていないリモート攻撃者が細工した HTTP リクエストを送ることで、シンボリックリンク永続化機構用に開発されたパッチを回避できる可能性があります。ただし、攻撃者はまず別の脆弱性を利用してファイルシステムレベルで製品を侵害している必要があります。", "risk": "機密情報が不正な者に漏洩する恐れがあります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1", "E2" ], "applicability": [ { "text": "対象製品は FortiOS 7.6.0 から 7.6.1、7.4.0 から 7.4.6、7.2 系列全バージョン、7.0 系列全バージョン、6.4 系列全バージョンです。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E3" ] }, { "text": "攻撃を実行できるのは、認証なしのリモート攻撃者で、事前に別の脆弱性によりファイルシステムレベルで製品に侵入している必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.1以下。影響ありとして記載：7.4.0以上、7.4.6以下。影響ありとして記載：7.2.0以上、7.2.13以下。影響ありとして記載：7.0.0以上、7.0.19以下。影響ありとして記載：6.4.0以上、6.4.16以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FortiOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68686", "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] } ], "actions": [ { "text": "FortiOS をバージョン 7.6.2 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiOS をバージョン 7.4.7 以上にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2025-68686」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-68686", "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68686", "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-68686", "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68686", "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2025-68686" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68686", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-934", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68686", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"cweId\":\"CWE-200\",\"description\":\"Information disclosure\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiOS\",\"cpes\":[\"cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.19:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"7.6.0\",\"lessThanOrEqual\":\"7.6.1\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.4.0\",\"lessThanOrEqual\":\"7.4.6\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.2.0\",\"lessThanOrEqual\":\"7.2.13\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"7.0.0\",\"lessThanOrEqual\":\"7.0.19\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"6.4.0\",\"lessThanOrEqual\":\"6.4.16\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68686.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiOS version 7.6.2 or above\nUpgrade to FortiOS version 7.4.7 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68686", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-68686\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-68686（FortiOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は FortiOS 7.6.0 から 7.6.1、7.4.0 から 7.4.6、7.2 系列全バージョン、7.0 系列全バージョン、6.4 系列全バージョンです。\n・攻撃を実行できるのは、認証なしのリモート攻撃者で、事前に別の脆弱性によりファイルシステムレベルで製品に侵入している必要があります。\n・公式の対象表：Fortinet / FortiOS。影響ありとして記載：7.6.0以上、7.6.1以下。影響ありとして記載：7.4.0以上、7.4.6以下。影響ありとして記載：7.2.0以上、7.2.13以下。影響ありとして記載：7.0.0以上、7.0.19以下。影響ありとして記載：6.4.0以上、6.4.16以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-68686", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:04.181Z", "lastSuccess": "2026-10-23T03:23:04.181Z", "sourceCheckedAt": "2026-10-23T02:43:40.323Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-16812", "aliases": [], "title": "VeloCloud Orchestrator On-Prem：コード実行", "summary": "VeloCloud Orchestrator (VCO) のオンプレミス版に、リモート攻撃者が特権的な内部機能にアクセスし、VCO ホストに影響を与える可能性があるセキュリティ問題があります。成功すると、オーケストレータおよびオーケストレータが管理するデータの機密性、完全性、可用性が損なわれる恐れがあります。この機能は本来内部利用のみを想定しており、リモートからのアクセスは想定されていません。Hosted および Dedicated バージョンは本通知が出る前にすでにパッチが適用されています。この問題は外部で発見され、実際に悪用が確認されています。", "risk": "機密性、完全性、可用性が損なわれる可能性があります。", "product": "VeloCloud Orchestrator On-Prem", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "Arista", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "VeloCloud Orchestrator On-Prem", "range": ">= 5.2.0 / < 5.2.3.14" }, { "product": "VeloCloud Orchestrator On-Prem", "range": ">= 6.1.0 / < 6.1.3.4" }, { "product": "VeloCloud Orchestrator On-Prem", "range": ">= 6.4.0 / < 6.4.2.4" }, { "product": "VeloCloud Orchestrator On-Prem", "range": ">= 7.0.0 / < 7.0.0.1" } ], "fixed": [], "steps": [ "影響を受ける VCO のリリースをできるだけ早く、5.2 系列では 5.2.3.14 以降、6.1 系列では 6.1.3.4 以降、6.4 系列では 6.4.2.4 以降にアップグレードしてください。", "「CVE-2026-16812」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "label": "CVE：Arista" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16812", "label": "CVE公式レコード" }, { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16812", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-27T16:11:00.968Z", "modifiedAt": "2026-07-28T03:56:40.567Z", "fetchedAt": "2026-10-23T02:43:46.764Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited.", "sourceTitle": "VeloCloud Orchestrator OS Command Injection", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "versions": [ { "status": "affected", "version": "5.2.0", "lessThan": "5.2.3.14", "versionType": "custom" }, { "status": "affected", "version": "6.1.0", "lessThan": "6.1.3.4", "versionType": "custom" }, { "status": "affected", "version": "6.4.0", "lessThan": "6.4.2.4", "versionType": "custom" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.0.0.1", "versionType": "custom" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-16812", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "fetchedAt": "2026-10-23T02:43:46.764Z", "publishedAt": "2026-07-27T16:11:00.968Z", "modifiedAt": "2026-07-28T03:56:40.567Z", "state": "published", "provider": "Arista", "title": "VeloCloud Orchestrator OS Command Injection", "descriptions": [ { "lang": "en", "value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.2.0", "lessThan": "5.2.3.14", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "6.1.0", "lessThan": "6.1.3.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "6.4.0", "lessThan": "6.4.2.4", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "7.0.0", "lessThan": "7.0.0.1", "versionType": "custom", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThis vulnerability has been fixed in the following releases:\n\n \n\n * VCO 5.2.3.14 and later in the 5.2 train\n * VCO 6.1.3.4 and later in the 6.1 train\n * VCO 6.4.2.4 and later in the 6.4 train", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "Arista", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" }, { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "Arista", "sourcePath": "/containers/cna/metrics/1/cvssV4_0" } ], "references": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "label": "Security Advisory 0144", "tags": [ "vendor-advisory" ], "provider": "Arista", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16812", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Arista Networks\",\"product\":\"VeloCloud Orchestrator On-Prem\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.2.0\",\"lessThan\":\"5.2.3.14\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.1.0\",\"lessThan\":\"6.1.3.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.4.0\",\"lessThan\":\"6.4.2.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.0.0.1\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThis vulnerability has been fixed in the following releases:\n\n \n\n * VCO 5.2.3.14 and later in the 5.2 train\n * VCO 6.1.3.4 and later in the 6.1 train\n * VCO 6.4.2.4 and later in the 6.4 train", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":10,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"Safety\":\"PRESENT\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"version\":\"4.0\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":10,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-28T03:56:40.567Z", "fetchedAt": "2026-10-23T02:43:46.764Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-27T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "VeloCloud Orchestrator On-Premにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:04.969Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "2b588b38d3bc40865d8652588f9fbf76407b9980ab57464ec49b6a685ac244ad", "sourceModifiedAt": "2026-07-28T03:56:40.567Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "VeloCloud Orchestrator (VCO) のオンプレミス版に、リモート攻撃者が特権的な内部機能にアクセスし、VCO ホストに影響を与える可能性があるセキュリティ問題があります。成功すると、オーケストレータおよびオーケストレータが管理するデータの機密性、完全性、可用性が損なわれる恐れがあります。この機能は本来内部利用のみを想定しており、リモートからのアクセスは想定されていません。Hosted および Dedicated バージョンは本通知が出る前にすでにパッチが適用されています。この問題は外部で発見され、実際に悪用が確認されています。", "risk": "機密性、完全性、可用性が損なわれる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "バージョン 5.2.0 から 5.2.3.14 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 6.1.0 から 6.1.3.4 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 6.4.0 から 6.4.2.4 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "バージョン 7.0.0 から 7.0.0.1 未満は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Arista Networks / VeloCloud Orchestrator On-Prem。影響ありとして記載：5.2.0以上、5.2.3.14未満。影響ありとして記載：6.1.0以上、6.1.3.4未満。影響ありとして記載：6.4.0以上、6.4.2.4未満。影響ありとして記載：7.0.0以上、7.0.0.1未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3" ] }, { "text": "「VeloCloud Orchestrator On-Prem」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-16812", "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] } ], "actions": [ { "text": "影響を受ける VCO のリリースをできるだけ早く、5.2 系列では 5.2.3.14 以降、6.1 系列では 6.1.3.4 以降、6.4 系列では 6.4.2.4 以降にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2026-16812」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-16812", "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-16812", "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] } ], "temporaryMitigations": [ { "text": "修正ソフトウェアが展開できるまで、以下の防御策を実施してください：VCO のウェブインターフェースへのアクセスを信頼できる管理ネットワークに限定する、既知の悪意ある送信元 IP からのアクセスを監視する、VCO ホストからの予期しない外部通信を監視する、管理者の最近の操作を確認し予期しない変更がないかチェックする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E5" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-16812", "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16812" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "label": "CVE：Arista" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16812", "label": "CVE公式レコード" }, { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16812", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\n\n\n\nThis functionality was intended to be for internal use only and is not intended to be remotely accessible.\n\n\n\n\nHosted and Dedicated versions of VCO have already been patched in advance of this notice going out.\n\n\n\n\nThis issue was discovered externally and is known to be actively exploited.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourceField": "/containers/cna/title", "excerpt": "VeloCloud Orchestrator OS Command Injection", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Arista Networks\",\"product\":\"VeloCloud Orchestrator On-Prem\",\"versions\":[{\"status\":\"affected\",\"version\":\"5.2.0\",\"lessThan\":\"5.2.3.14\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.1.0\",\"lessThan\":\"6.1.3.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"6.4.0\",\"lessThan\":\"6.4.2.4\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.0.0.1\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\nThis vulnerability has been fixed in the following releases:\n\n \n\n * VCO 5.2.3.14 and later in the 5.2 train\n * VCO 6.1.3.4 and later in the 6.1 train\n * VCO 6.4.2.4 and later in the 6.4 train", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16812.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "The recommended resolution is to upgrade to a fixed VCO release as soon as it is available. For VCOs which are not on a supported release train, customers can contact TAC to discuss possible upgrade options for your release.\n\n\n\n\nUntil the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16812", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-16812\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-16812（VeloCloud Orchestrator On-Prem）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・バージョン 5.2.0 から 5.2.3.14 未満は影響を受けます。\n・バージョン 6.1.0 から 6.1.3.4 未満は影響を受けます。\n・バージョン 6.4.0 から 6.4.2.4 未満は影響を受けます。\n・バージョン 7.0.0 から 7.0.0.1 未満は影響を受けます。\n・公式の対象表：Arista Networks / VeloCloud Orchestrator On-Prem。影響ありとして記載：5.2.0以上、5.2.3.14未満。影響ありとして記載：6.1.0以上、6.1.3.4未満。影響ありとして記載：6.4.0以上、6.4.2.4未満。影響ありとして記載：7.0.0以上、7.0.0.1未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16812", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:04.969Z", "lastSuccess": "2026-10-23T03:23:04.969Z", "sourceCheckedAt": "2026-10-23T02:43:46.764Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-16232", "aliases": [], "title": "Quantum Security Management / Multi-Domain Security Management：認証の回避", "summary": "認証バイパスの脆弱性により、認証されていないリモート攻撃者が Check Point SmartConsole のログインプロセスでアプリケーションのログイントークンを取得し、フル管理者権限で認証できるようになります。これに成功すると、攻撃者はセキュリティポリシーや設定を変更できます。遠隔からの攻撃には、管理サーバーの IP アドレスへインターネット経由でアクセスでき、かつ Trusted Clients を制限しない構成であることが必要です。Check Point はこの脆弱性が実際に悪用されており、影響を受けた顧客はごく少数であることを認識しています。", "risk": "攻撃者がフル管理者権限で認証できるため、セキュリティポリシーや設定が不正に変更される可能性があります。", "product": "Quantum Security Management / Multi-Domain Security Management", "category": "other", "component": "package", "severity": "critical", "cvss": 9.3, "cvssVersion": "4.0", "cvssSource": "checkpoint", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "Quantum Security Management", "range": "R82.10 with Jumbo Hotfix Take 36 or below" }, { "product": "Quantum Security Management", "range": "R82 with Jumbo Hotfix Take 118 or below" }, { "product": "Quantum Security Management", "range": "R81.20 with Jumbo Hotfix Take 158 or below" }, { "product": "Quantum Security Management", "range": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30" }, { "product": "Multi-Domain Security Management", "range": "R82.10 with Jumbo Hotfix Take 36 or below" }, { "product": "Multi-Domain Security Management", "range": "R82 with Jumbo Hotfix Take 118 or below" }, { "product": "Multi-Domain Security Management", "range": "R81.20 with Jumbo Hotfix Take 158 or below" }, { "product": "Multi-Domain Security Management", "range": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16232", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk185169", "label": "CVE掲載の参考情報" }, { "url": "https://support.checkpoint.com/results/sk/sk185169/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16232", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-22T13:53:09.830Z", "modifiedAt": "2026-08-10T18:34:01.548Z", "fetchedAt": "2026-10-23T02:43:46.648Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.", "sourceTitle": "Authentication Bypass in the SmartConsole Login Process Using an Application Token", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "Quantum Security Management", "vendor": "checkpoint", "versions": [ { "status": "affected", "version": "R82.10 with Jumbo Hotfix Take 36 or below" }, { "status": "affected", "version": "R82 with Jumbo Hotfix Take 118 or below" }, { "status": "affected", "version": "R81.20 with Jumbo Hotfix Take 158 or below" }, { "status": "affected", "version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30" } ] }, { "product": "Multi-Domain Security Management", "vendor": "checkpoint", "versions": [ { "status": "affected", "version": "R82.10 with Jumbo Hotfix Take 36 or below" }, { "status": "affected", "version": "R82 with Jumbo Hotfix Take 118 or below" }, { "status": "affected", "version": "R81.20 with Jumbo Hotfix Take 158 or below" }, { "status": "affected", "version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-16232", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "fetchedAt": "2026-10-23T02:43:46.648Z", "publishedAt": "2026-07-22T13:53:09.830Z", "modifiedAt": "2026-08-10T18:34:01.548Z", "state": "published", "provider": "checkpoint", "title": "Authentication Bypass in the SmartConsole Login Process Using an Application Token", "descriptions": [ { "lang": "en", "value": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "checkpoint", "product": "Quantum Security Management", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "R82.10 with Jumbo Hotfix Take 36 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "R82 with Jumbo Hotfix Take 118 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "R81.20 with Jumbo Hotfix Take 158 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30", "status": "affected" } ] }, { "vendor": "checkpoint", "product": "Multi-Domain Security Management", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "R82.10 with Jumbo Hotfix Take 36 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "R82 with Jumbo Hotfix Take 118 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "R81.20 with Jumbo Hotfix Take 158 or below", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 9.3, "baseSeverity": "CRITICAL", "provider": "checkpoint", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://support.checkpoint.com/results/sk/sk185169", "label": "checkpoint", "tags": [], "provider": "checkpoint", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"Quantum Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 36 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 118 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 158 or below\"},{\"status\":\"affected\",\"version\":\"R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"product\":\"Multi-Domain Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 36 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 118 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 158 or below\"},{\"status\":\"affected\",\"version\":\"R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-287\",\"description\":\"CWE-287: Improper Authentication.\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"version\":\"4.0\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-10T18:34:01.548Z", "fetchedAt": "2026-10-23T02:43:46.648Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Quantum Security Management / Multi-Domain Security Managementに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:05.122Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "3497c28f2809b9150223af1253da0153b49d552a9390270dfb38ca2e87eb7f70", "sourceModifiedAt": "2026-08-10T18:34:01.548Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "認証バイパスの脆弱性により、認証されていないリモート攻撃者が Check Point SmartConsole のログインプロセスでアプリケーションのログイントークンを取得し、フル管理者権限で認証できるようになります。これに成功すると、攻撃者はセキュリティポリシーや設定を変更できます。遠隔からの攻撃には、管理サーバーの IP アドレスへインターネット経由でアクセスでき、かつ Trusted Clients を制限しない構成であることが必要です。Check Point はこの脆弱性が実際に悪用されており、影響を受けた顧客はごく少数であることを認識しています。", "risk": "攻撃者がフル管理者権限で認証できるため、セキュリティポリシーや設定が不正に変更される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Quantum Security Management が R82.10 (Jumbo Hotfix Take 36 以下)、R82 (Jumbo Hotfix Take 118 以下)、R81.20 (Jumbo Hotfix Take 158 以下)、R81.10、R81、R80.30、R80.20、R80.10、R80、R77.30 の各バージョンで影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Multi-Domain Security Management が R82.10 (Jumbo Hotfix Take 36 以下)、R82 (Jumbo Hotfix Take 118 以下)、R81.20 (Jumbo Hotfix Take 158 以下)、R81.10、R81、R80.30、R80.20、R80.10、R80、R77.30 の各バージョンで影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "公式の対象表：checkpoint / Quantum Security Management。影響ありとして記載：R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：checkpoint / Multi-Domain Security Management。影響ありとして記載：R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Quantum Security Management / Multi-Domain Security Management」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16232" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16232" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "https://support.checkpoint.com/results/sk/sk185169/", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-16232" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "label": "CVE：checkpoint" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16232", "label": "CVE公式レコード" }, { "url": "https://support.checkpoint.com/results/sk/sk185169", "label": "CVE掲載の参考情報" }, { "url": "https://support.checkpoint.com/results/sk/sk185169/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16232", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourceField": "/containers/cna/title", "excerpt": "Authentication Bypass in the SmartConsole Login Process Using an Application Token", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"Quantum Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 36 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 118 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 158 or below\"},{\"status\":\"affected\",\"version\":\"R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/16xxx/CVE-2026-16232.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"product\":\"Multi-Domain Security Management\",\"vendor\":\"checkpoint\",\"versions\":[{\"status\":\"affected\",\"version\":\"R82.10 with Jumbo Hotfix Take 36 or below\"},{\"status\":\"affected\",\"version\":\"R82 with Jumbo Hotfix Take 118 or below\"},{\"status\":\"affected\",\"version\":\"R81.20 with Jumbo Hotfix Take 158 or below\"},{\"status\":\"affected\",\"version\":\"R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-16232", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-16232\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-16232（Quantum Security Management / Multi-Domain Security Management）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Quantum Security Management が R82.10 (Jumbo Hotfix Take 36 以下)、R82 (Jumbo Hotfix Take 118 以下)、R81.20 (Jumbo Hotfix Take 158 以下)、R81.10、R81、R80.30、R80.20、R80.10、R80、R77.30 の各バージョンで影響を受けます。\n・Multi-Domain Security Management が R82.10 (Jumbo Hotfix Take 36 以下)、R82 (Jumbo Hotfix Take 118 以下)、R81.20 (Jumbo Hotfix Take 158 以下)、R81.10、R81、R80.30、R80.20、R80.10、R80、R77.30 の各バージョンで影響を受けます。\n・公式の対象表：checkpoint / Quantum Security Management。影響ありとして記載：R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30。\n・公式の対象表：checkpoint / Multi-Domain Security Management。影響ありとして記載：R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-16232", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:05.122Z", "lastSuccess": "2026-10-23T03:23:05.122Z", "sourceCheckedAt": "2026-10-23T02:43:46.648Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-50522", "aliases": [], "title": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition：コード実行", "summary": "Microsoft Office SharePoint における信頼できないデータのデシリアライズにより、認可されていない攻撃者がネットワーク上でコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "product": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition", "category": "windows", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft SharePoint Enterprise Server 2016", "range": ">= 16.0.0 / < 16.0.5561.1001（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server 2019", "range": ">= 16.0.0 / < 16.0.10417.20175（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server Subscription Edition", "range": ">= 16.0.0 / < 16.0.19725.20434（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50522", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50522", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-14T17:05:27.656Z", "modifiedAt": "2026-10-08T18:13:38.322Z", "fetchedAt": "2026-10-23T02:43:49.332Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft SharePoint Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.5561.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.10417.20175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.19725.20434", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-50522", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "fetchedAt": "2026-10-23T02:43:49.332Z", "publishedAt": "2026-07-14T17:05:27.656Z", "modifiedAt": "2026-10-08T18:13:38.322Z", "state": "published", "provider": "microsoft", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.0", "lessThan": "16.0.5561.1001", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.0", "lessThan": "16.0.10417.20175", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "16.0.19725.20434", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en-US", "description": "CWE-502: Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "label": "Microsoft SharePoint Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5561.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20434\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-502: Deserialization of Untrusted Data\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-502\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-08T18:13:38.322Z", "fetchedAt": "2026-10-23T02:43:49.332Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-22T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:05.554Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "452ac3247f52dae16aaf4e1fdd016d0af5681bd015d3bb8a77b4ecc9f4979e08", "sourceModifiedAt": "2026-10-08T18:13:38.322Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office SharePoint における信頼できないデータのデシリアライズにより、認可されていない攻撃者がネットワーク上でコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft SharePoint Enterprise Server 2016 の x64 系統で、バージョン 16.0.0 以上 16.0.5561.1001 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Microsoft SharePoint Server 2019 の x64 系統で、バージョン 16.0.0 以上 16.0.10417.20175 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Microsoft SharePoint Server Subscription Edition の x64 系統で、バージョン 16.0.0 以上 16.0.19725.20434 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5561.1001未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20175未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20434未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-50522", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-50522" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-50522", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-50522" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-50522", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-50522" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50522", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50522", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft SharePoint Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5561.1001\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20175\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50522.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20434\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50522", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-50522\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-50522（Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft SharePoint Enterprise Server 2016 の x64 系統で、バージョン 16.0.0 以上 16.0.5561.1001 未満が影響を受ける。\n・Microsoft SharePoint Server 2019 の x64 系統で、バージョン 16.0.0 以上 16.0.10417.20175 未満が影響を受ける。\n・Microsoft SharePoint Server Subscription Edition の x64 系統で、バージョン 16.0.0 以上 16.0.19725.20434 未満が影響を受ける。\n・公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5561.1001未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20175未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20434未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-50522", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:05.554Z", "lastSuccess": "2026-10-23T03:23:05.554Z", "sourceCheckedAt": "2026-10-23T02:43:49.332Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2021-27137", "aliases": [], "title": "DD-WRT：脆弱性情報", "summary": "DD-WRT 45724 未満の router/upnp/src/ssdp.c に問題があり、UPnP 処理機能で unsafe strcpy が使用されているため、認証されていないリモート攻撃者がリクエストを送信して内部の固定バッファをオーバーフローさせることができる。利用には DD-WRT で UPnP を有効にしている必要がある（デフォルトでは無効で、内部インターフェースのみでリッスン）。この問題は ssdp_msearch（M-SEARCH リクエストで到達可能）で発生する。", "risk": "内部固定バッファがオーバーフローする可能性がある。", "product": "DD-WRT", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "DD-WRT", "range": "< 45724" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-27137", "label": "CVE公式レコード" }, { "url": "https://svn.dd-wrt.com/changeset/45724", "label": "CISAが示す関連情報" }, { "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "label": "CVE掲載の参考情報" }, { "url": "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "label": "CVE掲載の参考情報" }, { "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27137", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-16T00:00:00.000Z", "modifiedAt": "2026-07-22T03:55:45.793Z", "fetchedAt": "2026-10-23T02:43:16.319Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "DD-WRT", "vendor": "DD-WRT", "versions": [ { "lessThan": "45724", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-27137", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "fetchedAt": "2026-10-23T02:43:16.319Z", "publishedAt": "2026-07-16T00:00:00.000Z", "modifiedAt": "2026-07-22T03:55:45.793Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "DD-WRT", "product": "DD-WRT", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "45724", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-121", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://svn.dd-wrt.com/changeset/45724", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27137", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"DD-WRT\",\"vendor\":\"DD-WRT\",\"versions\":[{\"lessThan\":\"45724\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-121\",\"description\":\"CWE-121 Stack-based Buffer Overflow\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-22T03:55:45.793Z", "fetchedAt": "2026-10-23T02:43:16.319Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "DD-WRTに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:05.849Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "71356129536eae585572a58ee2eb5c9949b091576616b0521da674112deeb100", "sourceModifiedAt": "2026-07-22T03:55:45.793Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "DD-WRT 45724 未満の router/upnp/src/ssdp.c に問題があり、UPnP 処理機能で unsafe strcpy が使用されているため、認証されていないリモート攻撃者がリクエストを送信して内部の固定バッファをオーバーフローさせることができる。利用には DD-WRT で UPnP を有効にしている必要がある（デフォルトでは無効で、内部インターフェースのみでリッスン）。この問題は ssdp_msearch（M-SEARCH リクエストで到達可能）で発生する。", "risk": "内部固定バッファがオーバーフローする可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "対象は DD-WRT バージョン 45724 未満である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E2" ] }, { "text": "攻撃者は認証されていないリモートからである。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E1" ] }, { "text": "UPnP が有効になっている必要がある。（デフォルトでは無効で、内部インターフェースのみでリッスン）", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E1" ] }, { "text": "脆弱なコードは ssdp_msearch 関数で、M-SEARCH リクエストにより到達可能である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E1" ] }, { "text": "攻撃は内部インターフェース経由で行われる可能性がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：DD-WRT / DD-WRT。影響ありとして記載：45724未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E2" ] }, { "text": "「DD-WRT」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-27137", "https://svn.dd-wrt.com/changeset/45724", "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2021-27137" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-27137", "https://svn.dd-wrt.com/changeset/45724", "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2021-27137" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-27137", "https://svn.dd-wrt.com/changeset/45724", "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2021-27137" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-27137", "label": "CVE公式レコード" }, { "url": "https://svn.dd-wrt.com/changeset/45724", "label": "CISAが示す関連情報" }, { "url": "https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/", "label": "CVE掲載の参考情報" }, { "url": "https://securityaffairs.com/193290/uncategorized/iot-botnet-c0xmo-adds-competitor-killing-capability.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.bleepingcomputer.com/news/security/c0xmo-botnet-spreads-via-dd-wrt-router-flaw-kills-rival-malware/", "label": "CVE掲載の参考情報" }, { "url": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo", "label": "CVE掲載の参考情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27137", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/27xxx/CVE-2021-27137.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"DD-WRT\",\"vendor\":\"DD-WRT\",\"versions\":[{\"lessThan\":\"45724\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-27137", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-27137\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-27137（DD-WRT）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象は DD-WRT バージョン 45724 未満である。\n・攻撃者は認証されていないリモートからである。\n・UPnP が有効になっている必要がある。（デフォルトでは無効で、内部インターフェースのみでリッスン）\n・脆弱なコードは ssdp_msearch 関数で、M-SEARCH リクエストにより到達可能である。\n・攻撃は内部インターフェース経由で行われる可能性がある。\n・公式の対象表：DD-WRT / DD-WRT。影響ありとして記載：45724未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-27137", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:05.849Z", "lastSuccess": "2026-10-23T03:23:05.849Z", "sourceCheckedAt": "2026-10-23T02:43:16.319Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-0770", "aliases": [], "title": "Langflow：コード実行", "summary": "Langflow の exec_globals パラメータの処理に問題があり、信頼できない制御領域から機能が取り込まれることで、認証不要でリモートから任意のコードを実行できる脆弱性が存在します。", "risk": "攻撃者は対象の Langflow インストール上で任意のコードを実行でき、root 権限での実行が可能になります。", "product": "Langflow", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.0", "cvssSource": "zdi", "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Langflow", "range": "1.4.2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "label": "CVE：zdi" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0770", "label": "CVE公式レコード" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "label": "ZDI-26-036" }, { "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0770", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-23T03:28:52.286Z", "modifiedAt": "2026-07-22T03:55:44.396Z", "fetchedAt": "2026-10-23T02:43:40.581Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.", "sourceTitle": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Langflow", "product": "Langflow", "versions": [ { "version": "1.4.2", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-0770", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "fetchedAt": "2026-10-23T02:43:40.581Z", "publishedAt": "2026-01-23T03:28:52.286Z", "modifiedAt": "2026-07-22T03:55:44.396Z", "state": "published", "provider": "zdi", "title": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en", "value": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Langflow", "product": "Langflow", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.4.2", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "zdi", "sourcePath": "/containers/cna/metrics/0/cvssV3_0" } ], "references": [ { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "label": "ZDI-26-036", "tags": [ "x_research-advisory" ], "provider": "zdi", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Langflow\",\"product\":\"Langflow\",\"versions\":[{\"version\":\"1.4.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-829\",\"description\":\"CWE-829: Inclusion of Functionality from Untrusted Control Sphere\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-22T03:55:44.396Z", "fetchedAt": "2026-10-23T02:43:40.581Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Langflowにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:06.220Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bba564ce1dca8b46283b51f86d8b855478a0813ba9ac778395c5c40a30315a05", "sourceModifiedAt": "2026-07-22T03:55:44.396Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Langflow の exec_globals パラメータの処理に問題があり、信頼できない制御領域から機能が取り込まれることで、認証不要でリモートから任意のコードを実行できる脆弱性が存在します。", "risk": "攻撃者は対象の Langflow インストール上で任意のコードを実行でき、root 権限での実行が可能になります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Langflow バージョン 1.4.2 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Langflow / Langflow。影響ありとして記載：1.4.2。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Langflow」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-0770", "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-0770" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-0770", "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-0770" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-0770", "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-0770" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "label": "CVE：zdi" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0770", "label": "CVE公式レコード" }, { "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-036/", "label": "ZDI-26-036" }, { "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.9.0", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0770", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourceField": "/containers/cna/title", "excerpt": "Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/0xxx/CVE-2026-0770.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Langflow\",\"product\":\"Langflow\",\"versions\":[{\"version\":\"1.4.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-0770\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-0770（Langflow）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Langflow バージョン 1.4.2 が影響を受けます。\n・公式の対象表：Langflow / Langflow。影響ありとして記載：1.4.2。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-0770", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:06.220Z", "lastSuccess": "2026-10-23T03:23:06.220Z", "sourceCheckedAt": "2026-10-23T02:43:40.581Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-60137", "aliases": [], "title": "WordPress本体：プラグインやテーマの入力を通じて、データベースを不正に照会される", "summary": "WordPress本体の6.8.0～6.8.5、6.9.0～6.9.4、7.0.0～7.0.1が対象です。プラグインやテーマが外部から受け取った値を特定の検索条件へ渡す場合に、データベースを不正に照会されるおそれがあります。", "risk": "データベースの情報を読み取られる可能性があります。WordPress公式は、6.9以降では別の脆弱性と組み合わせるとサーバー上のコード実行につながるとも説明しています。これらの成立条件を省いて、すべてのサイトでこの問題単独のコード実行ができるとは扱いません。", "product": "WordPress", "category": "wordpress", "component": "core", "severity": "medium", "cvss": 5.9, "cvssVersion": "3.1", "cvssSource": "WPScan", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "affected": [ { "product": "WordPress", "range": ">= 6.8.0 / < 6.8.6" }, { "product": "WordPress", "range": ">= 6.9.0 / < 6.9.5" }, { "product": "WordPress", "range": ">= 7.0.0 / < 7.0.2" } ], "fixed": [ "WordPress 6.8系: 6.8.6", "WordPress 6.9系: 6.9.5", "WordPress 7.0系: 7.0.2" ], "steps": [ "公式の修正版は6.8.6、6.9.5、7.0.2です。実際の更新では、その修正を含む現在利用可能な最新の安定版を選んでください。", "データベースとファイルのバックアップを確保し、「ダッシュボード」→「更新」から本体を更新してください。保守会社に管理を任せている場合は、本体の版とこのCVEへの対応状況を確認してください。", "ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。" ], "references": [ { "url": "https://cveawg.mitre.org/api/cve/CVE-2026-60137", "label": "CVE採番機関の公式登録情報" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf", "label": "WordPress公式セキュリティアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "label": "CISAが示す関連情報" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式更新手順" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-07-17T19:14:12.159Z", "modifiedAt": "2026-10-07T18:16:21.040Z", "fetchedAt": "2026-10-23T02:43:49.764Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.", "sourceTitle": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "vendor": "WordPress", "product": "WordPress", "versions": [ { "status": "affected", "version": "6.8.0", "lessThan": "6.8.6", "versionType": "semver" }, { "status": "affected", "version": "6.9.0", "lessThan": "6.9.5", "versionType": "semver" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.0.2", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-60137", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/60xxx/CVE-2026-60137.json", "fetchedAt": "2026-10-23T02:43:49.764Z", "publishedAt": "2026-07-17T19:14:12.159Z", "modifiedAt": "2026-10-07T18:16:21.040Z", "state": "published", "provider": "WPScan", "title": "WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query", "descriptions": [ { "lang": "en", "value": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "WordPress", "product": "WordPress", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "6.8.0", "lessThan": "6.8.6", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "6.9.0", "lessThan": "6.9.5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "7.0.0", "lessThan": "7.0.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-89 SQL Injection", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "provider": "WPScan", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf", "label": "WPScan", "tags": [ "vdb-entry", "technical-description" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/0" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "WPScan", "tags": [ "release-notes", "vendor-advisory" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/60xxx/CVE-2026-60137.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"status\":\"affected\",\"version\":\"6.8.0\",\"lessThan\":\"6.8.6\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"6.9.0\",\"lessThan\":\"6.9.5\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.0.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/60xxx/CVE-2026-60137.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/60xxx/CVE-2026-60137.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-89 SQL Injection\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/60xxx/CVE-2026-60137.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T18:16:21.040Z", "fetchedAt": "2026-10-23T02:43:49.764Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "WordPressにデータベースへの不正操作に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "データベースに不正な命令を送られ、情報の閲覧や変更につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T02:05:17.524Z", "reviewState": "current", "summary": "WordPress本体の6.8.0～6.8.5、6.9.0～6.9.4、7.0.0～7.0.1が対象です。プラグインやテーマが外部から受け取った値を特定の検索条件へ渡す場合に、データベースを不正に照会されるおそれがあります。", "risk": "データベースの情報を読み取られる可能性があります。WordPress公式は、6.9以降では別の脆弱性と組み合わせるとサーバー上のコード実行につながるとも説明しています。これらの成立条件を省いて、すべてのサイトでこの問題単独のコード実行ができるとは扱いません。", "applicability": [ { "text": "対象はWordPressの6.8.0～6.8.5、6.9.0～6.9.4、7.0.0～7.0.1です。", "kind": "fact", "sourceUrls": [ "https://cveawg.mitre.org/api/cve/CVE-2026-60137", "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf" ] }, { "text": "外部から受け取った入力を、プラグインやテーマがWP_Queryのauthor__not_in（除外する投稿者を指定する内部の検索条件）へ渡す場合に問題になります。", "kind": "fact", "sourceUrls": [ "https://cveawg.mitre.org/api/cve/CVE-2026-60137" ] }, { "text": "この条件は管理画面を見るだけでは判断しにくいため、対象版なら本体更新を優先してください。独自テーマ・独自プラグインがある場合は、保守担当者にこのCVE番号と検索条件名を伝えてください。", "kind": "check", "sourceUrls": [ "https://cveawg.mitre.org/api/cve/CVE-2026-60137" ] }, { "text": "最初に「WordPress」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-60137", "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf", "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-60137" ] } ], "versionChecks": [ { "text": "WordPressの管理画面で「ツール」→「サイトヘルス」→「情報」→「WordPress」を開き、本体のバージョンを控えます。プラグインやPHPの番号とは別です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "公式の修正版は6.8.6、6.9.5、7.0.2です。実際の更新では、その修正を含む現在利用可能な最新の安定版を選んでください。", "kind": "fix", "sourceUrls": [ "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf" ] }, { "text": "データベースとファイルのバックアップを確保し、「ダッシュボード」→「更新」から本体を更新してください。保守会社に管理を任せている場合は、本体の版とこのCVEへの対応状況を確認してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/" ] }, { "text": "ファイルとデータベースのバックアップを取り、管理画面の「ダッシュボード」→「更新」でWordPress本体の更新を実行します。更新が表示されない有料製品などは、購入先・開発元の正規の配布経路を利用してください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/", "https://wordpress.org/documentation/article/manage-plugins/" ] } ], "temporaryMitigations": [ { "text": "すぐに更新できない場合は、外部入力を該当の検索条件へ渡す独自機能があるか保守担当者に調査を依頼し、確認できた機能の公開停止を検討してください。未確認のまま「プラグインは安全」と判断しないでください。", "kind": "procedure", "sourceUrls": [ "https://cveawg.mitre.org/api/cve/CVE-2026-60137" ] } ], "verification": [ { "text": "更新後のWordPressの版と、投稿一覧・検索・独自テーマの動作を確認してください。不審な操作があった場合は、データベースとサーバーの記録を保守担当者に調査してもらってください。", "kind": "procedure", "sourceUrls": [ "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf", "https://wordpress.org/documentation/article/updating-wordpress/" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [], "supportRequest": "件名：CVE-2026-60137（WordPress）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-60137について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-60137", "sources": [ { "url": "https://cveawg.mitre.org/api/cve/CVE-2026-60137", "label": "CVE採番機関の公式登録情報" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf", "label": "WordPress公式セキュリティアドバイザリ" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137", "label": "CVE公式レコード" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60137", "label": "CISAが示す関連情報" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式更新手順" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "reviewedSourceFingerprint": "reviewed-source-v1:57050511815d78726409c5fc515510a061f4867865f8c4662462ff8ec2e431c4", "reviewedSourceScope": "official_evidence", "glossary": [] } }, { "id": "CVE-2026-63030", "aliases": [], "title": "WordPress：コード実行", "summary": "WordPress 6.9.x（6.9.5 未満）および 7.0.x（7.0.2 未満）では、REST API のバッチエンドポイントでルートが混乱する問題があり、これが author__not_in WP_Query の SQL インジェクション（CVE-2026-60137）と組み合わさると、攻撃者が SQL インジェクションを実行し、サーバー上で任意のコードを実行できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、サーバー上で任意のコードを実行させられる（リモートコード実行）恐れがあります。", "product": "WordPress", "category": "wordpress", "component": "core", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "WPScan", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "WordPress", "range": ">= 6.9.0 / < 6.9.5" }, { "product": "WordPress", "range": ">= 7.0.0 / < 7.0.2" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "label": "CVE：WPScan" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030", "label": "CVE公式レコード" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q", "label": "CVE掲載の参考情報" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "publishedAt": "2026-07-17T19:14:12.910Z", "modifiedAt": "2026-10-07T18:26:30.478Z", "fetchedAt": "2026-10-23T02:43:49.836Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.", "sourceTitle": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "WordPress", "product": "WordPress", "versions": [ { "status": "affected", "version": "6.9.0", "lessThan": "6.9.5", "versionType": "semver" }, { "status": "affected", "version": "7.0.0", "lessThan": "7.0.2", "versionType": "semver" } ], "defaultStatus": "unaffected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-63030", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "fetchedAt": "2026-10-23T02:43:49.836Z", "publishedAt": "2026-07-17T19:14:12.910Z", "modifiedAt": "2026-10-07T18:26:30.478Z", "state": "published", "provider": "WPScan", "title": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "descriptions": [ { "lang": "en", "value": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "WordPress", "product": "WordPress", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "6.9.0", "lessThan": "6.9.5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "7.0.0", "lessThan": "7.0.2", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "CWE-436 Interpretation Conflict", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "WPScan", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q", "label": "WPScan", "tags": [ "vdb-entry", "technical-description" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/0" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "WPScan", "tags": [ "release-notes", "vendor-advisory" ], "provider": "WPScan", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"status\":\"affected\",\"version\":\"6.9.0\",\"lessThan\":\"6.9.5\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.0.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-436 Interpretation Conflict\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-07T18:26:30.478Z", "fetchedAt": "2026-10-23T02:43:49.836Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-21T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "WordPressにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:06.503Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b9b0cd371784cf841ee25ef63749514b025c311748fee8037e9692adf4857262", "sourceModifiedAt": "2026-10-07T18:26:30.478Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "WordPress 6.9.x（6.9.5 未満）および 7.0.x（7.0.2 未満）では、REST API のバッチエンドポイントでルートが混乱する問題があり、これが author__not_in WP_Query の SQL インジェクション（CVE-2026-60137）と組み合わさると、攻撃者が SQL インジェクションを実行し、サーバー上で任意のコードを実行できる可能性があります。", "risk": "攻撃者がこの脆弱性を利用すると、サーバー上で任意のコードを実行させられる（リモートコード実行）恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "WordPress 6.9.0 以上 6.9.5 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "WordPress 7.0.0 以上 7.0.2 未満のバージョンは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "この脆弱性は、author__not_in WP_Query に関する SQL インジェクション（CVE-2026-60137）と組み合わせた場合にのみ、SQL インジェクションおよびリモートコード実行が可能になります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：WordPress / WordPress。影響ありとして記載：6.9.0以上、6.9.5未満。影響ありとして記載：7.0.0以上、7.0.2未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3" ] }, { "text": "WordPressの管理画面で「ツール」→「サイトヘルス」→「情報」→「WordPress」を開き、本体のバージョンを控えます。プラグインやPHPの番号とは別です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/" ] }, { "text": "管理画面に入れない、または同じ名前の製品を判別できない場合は、下の問い合わせ文をサイトの制作会社・管理担当者に送ってください。名前が見つからないという理由だけで、安全とは判定しないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/site-health-screen/", "https://wordpress.org/documentation/article/plugins-screen/" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "更新できない場合は、対象機能の停止や公開範囲の制限が使えるかを管理担当者と検討し、実施内容と更新予定日を記録してください。プラグインの「無効化」だけでこの脆弱性を防げるかは個別に確認が必要です。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/plugins-screen/", "https://www.cve.org/CVERecord?id=CVE-2026-63030", "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q", "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-63030" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に同じ管理画面を開き直してバージョンを記録します。修正対象の系列・版と一致するかを照合し、サイト表示、ログイン、フォームや購入など普段使う主要な操作も確認してください。更新ボタンを押しただけでは完了としないでください。", "kind": "procedure", "sourceUrls": [ "https://wordpress.org/documentation/article/updating-wordpress/", "https://wordpress.org/documentation/article/dashboard-updates-screen/" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "label": "CVE：WPScan" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030", "label": "CVE公式レコード" }, { "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q", "label": "CVE掲載の参考情報" }, { "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63030", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://wordpress.org/documentation/article/site-health-screen/", "label": "WordPress公式：サイトヘルスの情報" }, { "url": "https://wordpress.org/documentation/article/plugins-screen/", "label": "WordPress公式：プラグイン一覧" }, { "url": "https://wordpress.org/documentation/article/updating-wordpress/", "label": "WordPress公式：本体の更新" }, { "url": "https://wordpress.org/documentation/article/dashboard-updates-screen/", "label": "WordPress公式：更新画面" }, { "url": "https://wordpress.org/documentation/article/manage-plugins/", "label": "WordPress公式：プラグインの確認と更新" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourceField": "/containers/cna/title", "excerpt": "WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/63xxx/CVE-2026-63030.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"WordPress\",\"product\":\"WordPress\",\"versions\":[{\"status\":\"affected\",\"version\":\"6.9.0\",\"lessThan\":\"6.9.5\",\"versionType\":\"semver\"},{\"status\":\"affected\",\"version\":\"7.0.0\",\"lessThan\":\"7.0.2\",\"versionType\":\"semver\"}],\"defaultStatus\":\"unaffected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-63030\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-63030（WordPress）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・WordPress 6.9.0 以上 6.9.5 未満のバージョンは影響を受けます。\n・WordPress 7.0.0 以上 7.0.2 未満のバージョンは影響を受けます。\n・この脆弱性は、author__not_in WP_Query に関する SQL インジェクション（CVE-2026-60137）と組み合わせた場合にのみ、SQL インジェクションおよびリモートコード実行が可能になります。\n・公式の対象表：WordPress / WordPress。影響ありとして記載：6.9.0以上、6.9.5未満。影響ありとして記載：7.0.0以上、7.0.2未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-63030", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:06.503Z", "lastSuccess": "2026-10-23T03:23:06.503Z", "sourceCheckedAt": "2026-10-23T02:43:49.836Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" }, { "term": "SQLインジェクション", "meaning": "入力した値がデータベースへの命令として扱われ、意図しない問い合わせや操作をされる問題です。読み取り・書き換えなど、可能なことは脆弱性ごとに異なります。", "sourceUrl": "https://cwe.mitre.org/data/definitions/89.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-25089", "aliases": [], "title": "FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS：コード実行", "summary": "Fortinet FortiSandbox 5.0.0 から 5.0.5、FortiSandbox 4.4.0 から 4.4.8、FortiSandbox 4.2 のすべてのバージョン、FortiSandbox Cloud 5.0.4 から 5.0.5、FortiSandbox PaaS 5.0.4 から 5.0.5 において、特別に細工した HTTP リクエストを送ることで、認証されていない攻撃者が OS コマンドを不正に実行できる可能性がある。", "risk": "認証されていない攻撃者が不正な OS コマンドを実行できる可能性がある。", "product": "FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.1, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "FortiSandbox", "range": ">= 5.0.0 / <= 5.0.5" }, { "product": "FortiSandbox", "range": ">= 4.4.0 / <= 4.4.8" }, { "product": "FortiSandbox", "range": ">= 4.2.1 / <= 4.2.8" }, { "product": "FortiSandbox Cloud", "range": ">= 5.0.4 / <= 5.0.5" }, { "product": "FortiSandbox PaaS", "range": ">= 5.0.4 / <= 5.0.5" } ], "fixed": [], "steps": [ "FortiSandbox をバージョン 5.2.0 以降（未リリース）にアップグレードする。", "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSandbox をバージョン 5.0.6 以降にアップグレードする。", "FortiSandbox をバージョン 4.4.9 以降にアップグレードする。", "FortiSandbox PaaS をバージョン 5.2.0 以降（未リリース）にアップグレードする。", "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSandbox PaaS をバージョン 5.0.6 以降にアップグレードする。", "FortiSandbox Cloud はバージョン 5.2.0（未リリース）で修正済みのため、追加の対応は不要である。", "FortiSandbox Cloud はバージョン 5.0.6（未リリース）で修正済みのため、追加の対応は不要である。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25089", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-06-09T14:27:47.492Z", "modifiedAt": "2026-07-17T03:56:23.142Z", "fetchedAt": "2026-10-23T02:43:48.095Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiSandbox", "cpes": [ "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "5.0.0", "lessThanOrEqual": "5.0.5", "status": "affected" }, { "versionType": "semver", "version": "4.4.0", "lessThanOrEqual": "4.4.8", "status": "affected" }, { "versionType": "semver", "version": "4.2.1", "lessThanOrEqual": "4.2.8", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox Cloud", "cpes": [ "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "5.0.4", "lessThanOrEqual": "5.0.5", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox PaaS", "cpes": [ "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "5.0.4", "lessThanOrEqual": "5.0.5", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-25089", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "fetchedAt": "2026-10-23T02:43:48.095Z", "publishedAt": "2026-06-09T14:27:47.492Z", "modifiedAt": "2026-07-17T03:56:23.142Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiSandbox", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.0.0", "lessThanOrEqual": "5.0.5", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "4.4.0", "lessThanOrEqual": "4.4.8", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "4.2.1", "lessThanOrEqual": "4.2.8", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox Cloud", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "5.0.4", "lessThanOrEqual": "5.0.5", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox PaaS", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "5.0.4", "lessThanOrEqual": "5.0.5", "versionType": "semver", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to upcoming FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to upcoming FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nFortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 9.1, "baseSeverity": "CRITICAL", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25089", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.0\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"4.4.0\",\"lessThanOrEqual\":\"4.4.8\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"4.2.1\",\"lessThanOrEqual\":\"4.2.8\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox Cloud\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox PaaS\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to upcoming FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to upcoming FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nFortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-78\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-17T03:56:23.142Z", "fetchedAt": "2026-10-23T02:43:48.095Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:06.524Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8fcb5eaac83cb1af423b0a473f7de50ebfd71006cc84a282084dca1ffdf2ed07", "sourceModifiedAt": "2026-07-17T03:56:23.142Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Fortinet FortiSandbox 5.0.0 から 5.0.5、FortiSandbox 4.4.0 から 4.4.8、FortiSandbox 4.2 のすべてのバージョン、FortiSandbox Cloud 5.0.4 から 5.0.5、FortiSandbox PaaS 5.0.4 から 5.0.5 において、特別に細工した HTTP リクエストを送ることで、認証されていない攻撃者が OS コマンドを不正に実行できる可能性がある。", "risk": "認証されていない攻撃者が不正な OS コマンドを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "FortiSandbox 5.0.0 から 5.0.5 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "FortiSandbox 4.4.0 から 4.4.8 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "FortiSandbox 4.2.1 から 4.2.8 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "FortiSandbox Cloud 5.0.4 から 5.0.5 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E3" ] }, { "text": "FortiSandbox PaaS 5.0.4 から 5.0.5 が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Fortinet / FortiSandbox。影響ありとして記載：5.0.0以上、5.0.5以下。影響ありとして記載：4.4.0以上、4.4.8以下。影響ありとして記載：4.2.1以上、4.2.8以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Fortinet / FortiSandbox Cloud。影響ありとして記載：5.0.4以上、5.0.5以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiSandbox PaaS。影響ありとして記載：5.0.4以上、5.0.5以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "「FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-25089", "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-25089" ] } ], "actions": [ { "text": "FortiSandbox をバージョン 5.2.0 以降（未リリース）にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSandbox をバージョン 5.0.6 以降にアップグレードする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "FortiSandbox をバージョン 4.4.9 以降にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "FortiSandbox PaaS をバージョン 5.2.0 以降（未リリース）にアップグレードする。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対策欄では、次の対応は公開予定の版について示されています。入手できることを前提にせず、現在の提供状況と適用時期を管理担当者・提供元に確認してください。公開された場合の対応：FortiSandbox PaaS をバージョン 5.0.6 以降にアップグレードする。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "FortiSandbox Cloud はバージョン 5.2.0（未リリース）で修正済みのため、追加の対応は不要である。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] }, { "text": "FortiSandbox Cloud はバージョン 5.0.6（未リリース）で修正済みのため、追加の対応は不要である。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E5" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-25089", "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-25089" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-25089", "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-25089" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25089", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-141", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25089", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandbox:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:5.0.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.0\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"4.4.0\",\"lessThanOrEqual\":\"4.4.8\",\"status\":\"affected\"},{\"versionType\":\"semver\",\"version\":\"4.2.1\",\"lessThanOrEqual\":\"4.2.8\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox Cloud\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxcloud:5.0.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox PaaS\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:5.0.4:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"5.0.4\",\"lessThanOrEqual\":\"5.0.5\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25089.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to upcoming FortiSandbox version 5.2.0 or above\nUpgrade to FortiSandbox version 5.0.6 or above\nUpgrade to FortiSandbox version 4.4.9 or above\nUpgrade to upcoming FortiSandbox PaaS version 5.2.0 or above\nUpgrade to FortiSandbox PaaS version 5.0.6 or above\nFortinet remediated this issue in FortiSandbox Cloud version 5.2.0 (not released) and hence customers do not need to perform any action.\nFortinet remediated this issue in FortiSandbox Cloud version 5.0.6 (not released) and hence customers do not need to perform any action.", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25089", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-25089\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-25089（FortiSandbox / FortiSandbox Cloud / FortiSandbox PaaS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・FortiSandbox 5.0.0 から 5.0.5 が影響を受ける。\n・FortiSandbox 4.4.0 から 4.4.8 が影響を受ける。\n・FortiSandbox 4.2.1 から 4.2.8 が影響を受ける。\n・FortiSandbox Cloud 5.0.4 から 5.0.5 が影響を受ける。\n・FortiSandbox PaaS 5.0.4 から 5.0.5 が影響を受ける。\n・公式の対象表：Fortinet / FortiSandbox。影響ありとして記載：5.0.0以上、5.0.5以下。影響ありとして記載：4.4.0以上、4.4.8以下。影響ありとして記載：4.2.1以上、4.2.8以下。\n・公式の対象表：Fortinet / FortiSandbox Cloud。影響ありとして記載：5.0.4以上、5.0.5以下。\n・公式の対象表：Fortinet / FortiSandbox PaaS。影響ありとして記載：5.0.4以上、5.0.5以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-25089\n\n公式資料で追加確認が必要な点：\n・公式情報では 5.2.0 が公開予定または未リリースとして記載されています。\n・公式情報では 5.0.6 が公開予定または未リリースとして記載されています。", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [ { "code": "planned_release", "text": "公式情報では 5.2.0 が公開予定または未リリースとして記載されています。", "evidenceIds": [ "E5" ] }, { "code": "planned_release", "text": "公式情報では 5.0.6 が公開予定または未リリースとして記載されています。", "evidenceIds": [ "E5" ] } ], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:06.524Z", "lastSuccess": "2026-10-23T03:23:06.524Z", "sourceCheckedAt": "2026-10-23T02:43:48.095Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-39808", "aliases": [], "title": "FortiSandbox / FortiSandbox PaaS：コード実行", "summary": "Fortinet FortiSandbox 4.4.0 から 4.4.8 において、特別な要素の不適切な無効化に起因する OS コマンドインジェクションの脆弱性が存在し、攻撃者が を通じて不正なコードやコマンドを実行できる可能性があります。", "risk": "攻撃者が不正なコードやコマンドを実行できる可能性があります。", "product": "FortiSandbox / FortiSandbox PaaS", "category": "other", "component": "package", "severity": "critical", "cvss": 9.1, "cvssVersion": "3.1", "cvssSource": "fortinet", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "FortiSandbox", "range": ">= 4.4.0 / <= 4.4.8" }, { "product": "FortiSandbox PaaS", "range": "23.4.4374" }, { "product": "FortiSandbox PaaS", "range": "23.4.4350" }, { "product": "FortiSandbox PaaS", "range": "23.3.4329" }, { "product": "FortiSandbox PaaS", "range": "23.1.4245" }, { "product": "FortiSandbox PaaS", "range": "22.2.4151" }, { "product": "FortiSandbox PaaS", "range": "22.2.4134" }, { "product": "FortiSandbox PaaS", "range": "22.1.4113" }, { "product": "FortiSandbox PaaS", "range": "21.4.4072" }, { "product": "FortiSandbox PaaS", "range": "21.3.4055" } ], "fixed": [], "steps": [ "FortiSandbox をバージョン 4.4.9 以上にアップグレードしてください。", "FortiSandbox PaaS をバージョン 5.0.2 以上にアップグレードしてください。", "「CVE-2026-39808」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39808", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-04-14T15:38:02.089Z", "modifiedAt": "2026-07-17T03:56:21.793Z", "fetchedAt": "2026-10-23T02:43:48.742Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via ", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Fortinet", "product": "FortiSandbox", "cpes": [ "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "versionType": "semver", "version": "4.4.0", "lessThanOrEqual": "4.4.8", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox PaaS", "cpes": [ "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "versions": [ { "version": "23.4.4374", "status": "affected" }, { "version": "23.4.4350", "status": "affected" }, { "version": "23.3.4329", "status": "affected" }, { "version": "23.1.4245", "status": "affected" }, { "version": "22.2.4151", "status": "affected" }, { "version": "22.2.4134", "status": "affected" }, { "version": "22.1.4113", "status": "affected" }, { "version": "21.4.4072", "status": "affected" }, { "version": "21.3.4055", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-39808", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "fetchedAt": "2026-10-23T02:43:48.742Z", "publishedAt": "2026-04-14T15:38:02.089Z", "modifiedAt": "2026-07-17T03:56:21.793Z", "state": "published", "provider": "fortinet", "title": "", "descriptions": [ { "lang": "en", "value": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via ", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Fortinet", "product": "FortiSandbox", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "4.4.0", "lessThanOrEqual": "4.4.8", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Fortinet", "product": "FortiSandbox PaaS", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [ "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*" ], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "23.4.4374", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "23.4.4350", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "23.3.4329", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "23.1.4245", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "22.2.4151", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "22.2.4134", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "22.1.4113", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "21.4.4072", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "21.3.4055", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Upgrade to FortiSandbox version 4.4.9 or above\nUpgrade to FortiSandbox PaaS version 5.0.2 or above", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "Execute unauthorized code or commands", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 9.1, "baseSeverity": "CRITICAL", "provider": "fortinet", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "label": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "tags": [], "provider": "fortinet", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/samu-delucas/CVE-2026-39808", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"4.4.0\",\"lessThanOrEqual\":\"4.4.8\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox PaaS\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"23.4.4374\",\"status\":\"affected\"},{\"version\":\"23.4.4350\",\"status\":\"affected\"},{\"version\":\"23.3.4329\",\"status\":\"affected\"},{\"version\":\"23.1.4245\",\"status\":\"affected\"},{\"version\":\"22.2.4151\",\"status\":\"affected\"},{\"version\":\"22.2.4134\",\"status\":\"affected\"},{\"version\":\"22.1.4113\",\"status\":\"affected\"},{\"version\":\"21.4.4072\",\"status\":\"affected\"},{\"version\":\"21.3.4055\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via ", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Upgrade to FortiSandbox version 4.4.9 or above\nUpgrade to FortiSandbox PaaS version 5.0.2 or above", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-78\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-17T03:56:21.793Z", "fetchedAt": "2026-10-23T02:43:48.742Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "FortiSandbox / FortiSandbox PaaSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:07.395Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8264149f69fe72c71e625b808561a14995c7c71cb60e72a8e4952e0508b5fc06", "sourceModifiedAt": "2026-07-17T03:56:21.793Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Fortinet FortiSandbox 4.4.0 から 4.4.8 において、特別な要素の不適切な無効化に起因する OS コマンドインジェクションの脆弱性が存在し、攻撃者が を通じて不正なコードやコマンドを実行できる可能性があります。", "risk": "攻撃者が不正なコードやコマンドを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "FortiSandbox のバージョン 4.4.0 から 4.4.8 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E3" ] }, { "text": "FortiSandbox PaaS のバージョン 23.4.4374 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 23.4.4350 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 23.3.4329 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 23.1.4245 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 22.2.4151 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 22.2.4134 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 22.1.4113 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 21.4.4072 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "FortiSandbox PaaS のバージョン 21.3.4055 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Fortinet / FortiSandbox。影響ありとして記載：4.4.0以上、4.4.8以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Fortinet / FortiSandbox PaaS。影響ありとして記載：23.4.4374。影響ありとして記載：23.4.4350。影響ありとして記載：23.3.4329。影響ありとして記載：23.1.4245。影響ありとして記載：22.2.4151。影響ありとして記載：22.2.4134。影響ありとして記載：22.1.4113。影響ありとして記載：21.4.4072。影響ありとして記載：21.3.4055。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E4" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FortiSandbox / FortiSandbox PaaS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-39808", "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] } ], "actions": [ { "text": "FortiSandbox をバージョン 4.4.9 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E5" ] }, { "text": "FortiSandbox PaaS をバージョン 5.0.2 以上にアップグレードしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E5" ] }, { "text": "「CVE-2026-39808」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-39808", "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-39808", "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-39808", "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-39808", "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-39808" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "label": "CVE：fortinet" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39808", "label": "CVE公式レコード" }, { "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via ", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"cweId\":\"CWE-78\",\"description\":\"Execute unauthorized code or commands\",\"type\":\"CWE\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"versionType\":\"semver\",\"version\":\"4.4.0\",\"lessThanOrEqual\":\"4.4.8\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Fortinet\",\"product\":\"FortiSandbox PaaS\",\"cpes\":[\"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*\",\"cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*\"],\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"23.4.4374\",\"status\":\"affected\"},{\"version\":\"23.4.4350\",\"status\":\"affected\"},{\"version\":\"23.3.4329\",\"status\":\"affected\"},{\"version\":\"23.1.4245\",\"status\":\"affected\"},{\"version\":\"22.2.4151\",\"status\":\"affected\"},{\"version\":\"22.2.4134\",\"status\":\"affected\"},{\"version\":\"22.1.4113\",\"status\":\"affected\"},{\"version\":\"21.4.4072\",\"status\":\"affected\"},{\"version\":\"21.3.4055\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/39xxx/CVE-2026-39808.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Upgrade to FortiSandbox version 4.4.9 or above\nUpgrade to FortiSandbox PaaS version 5.0.2 or above", "language": "en", "representation": "source_excerpt" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-39808", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-39808\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-39808（FortiSandbox / FortiSandbox PaaS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・FortiSandbox のバージョン 4.4.0 から 4.4.8 が影響を受けます。\n・FortiSandbox PaaS のバージョン 23.4.4374 が影響を受けます。\n・FortiSandbox PaaS のバージョン 23.4.4350 が影響を受けます。\n・FortiSandbox PaaS のバージョン 23.3.4329 が影響を受けます。\n・FortiSandbox PaaS のバージョン 23.1.4245 が影響を受けます。\n・FortiSandbox PaaS のバージョン 22.2.4151 が影響を受けます。\n・FortiSandbox PaaS のバージョン 22.2.4134 が影響を受けます。\n・FortiSandbox PaaS のバージョン 22.1.4113 が影響を受けます。\n・FortiSandbox PaaS のバージョン 21.4.4072 が影響を受けます。\n・FortiSandbox PaaS のバージョン 21.3.4055 が影響を受けます。\n・公式の対象表：Fortinet / FortiSandbox。影響ありとして記載：4.4.0以上、4.4.8以下。\n・公式の対象表：Fortinet / FortiSandbox PaaS。影響ありとして記載：23.4.4374。影響ありとして記載：23.4.4350。影響ありとして記載：23.3.4329。影響ありとして記載：23.1.4245。影響ありとして記載：22.2.4151。影響ありとして記載：22.2.4134。影響ありとして記載：22.1.4113。影響ありとして記載：21.4.4072。影響ありとして記載：21.3.4055。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-39808", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:07.395Z", "lastSuccess": "2026-10-23T03:23:07.395Z", "sourceCheckedAt": "2026-10-23T02:43:48.742Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-58644", "aliases": [], "title": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition：コード実行", "summary": "Microsoft Office SharePoint で信頼できないデータを逆シリアライズできるため、認可されていない攻撃者がネットワーク上でコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "product": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition", "category": "windows", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Microsoft SharePoint Enterprise Server 2016", "range": ">= 16.0.0 / < 16.0.5556.1005（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server 2019", "range": ">= 16.0.0 / < 16.0.10417.20153（環境: x64-based Systems）" }, { "product": "Microsoft SharePoint Server Subscription Edition", "range": ">= 16.0.0 / < 16.0.19725.20384（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58644", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58644", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-14T17:05:37.431Z", "modifiedAt": "2026-10-08T18:13:46.314Z", "fetchedAt": "2026-10-23T02:43:49.641Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft SharePoint Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.5556.1005", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.10417.20153", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "16.0.19725.20384", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-58644", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "fetchedAt": "2026-10-23T02:43:49.641Z", "publishedAt": "2026-07-14T17:05:37.431Z", "modifiedAt": "2026-10-08T18:13:46.314Z", "state": "published", "provider": "microsoft", "title": "Microsoft SharePoint Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft SharePoint Enterprise Server 2016", "sourcePath": "/containers/cna/affected/0", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.0", "lessThan": "16.0.5556.1005", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server 2019", "sourcePath": "/containers/cna/affected/1", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.0", "lessThan": "16.0.10417.20153", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft SharePoint Server Subscription Edition", "sourcePath": "/containers/cna/affected/2", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "16.0.19725.20384", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en-US", "description": "CWE-502: Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "label": "Microsoft SharePoint Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5556.1005\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20153\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20384\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-502: Deserialization of Untrusted Data\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-502\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-08T18:13:46.314Z", "fetchedAt": "2026-10-23T02:43:49.641Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-16T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Editionにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:07.440Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "ce4e57040c3071176379d12f71a50832ad46eaf90ce1aa6689d73a57deafce76", "sourceModifiedAt": "2026-10-08T18:13:46.314Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office SharePoint で信頼できないデータを逆シリアライズできるため、認可されていない攻撃者がネットワーク上でコードを実行できる。", "risk": "攻撃者がサーバー上で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft SharePoint Enterprise Server 2016（x64 系統） のバージョン 16.0.0 から 16.0.5556.1005 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Microsoft SharePoint Server 2019（x64 系統） のバージョン 16.0.0 から 16.0.10417.20153 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Microsoft SharePoint Server Subscription Edition（x64 系統） のバージョン 16.0.0 から 16.0.19725.20384 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5556.1005未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20153未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20384未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644" ], "evidenceIds": [ "E6" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-58644", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58644" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-58644", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58644" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-58644", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-58644" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58644", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58644", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft SharePoint Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Enterprise Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.5556.1005\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.10417.20153\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58644.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft SharePoint Server Subscription Edition\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.0.19725.20384\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-58644", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-58644\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-58644（Microsoft SharePoint Enterprise Server 2016 / Microsoft SharePoint Server 2019 / Microsoft SharePoint Server Subscription Edition）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft SharePoint Enterprise Server 2016（x64 系統） のバージョン 16.0.0 から 16.0.5556.1005 未満が影響を受ける。\n・Microsoft SharePoint Server 2019（x64 系統） のバージョン 16.0.0 から 16.0.10417.20153 未満が影響を受ける。\n・Microsoft SharePoint Server Subscription Edition（x64 系統） のバージョン 16.0.0 から 16.0.19725.20384 未満が影響を受ける。\n・公式の対象表：Microsoft / Microsoft SharePoint Enterprise Server 2016。影響ありとして記載：16.0.0以上、16.0.5556.1005未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server 2019。影響ありとして記載：16.0.0以上、16.0.10417.20153未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Microsoft SharePoint Server Subscription Edition。影響ありとして記載：16.0.0以上、16.0.19725.20384未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-58644", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:07.440Z", "lastSuccess": "2026-10-23T03:23:07.440Z", "sourceCheckedAt": "2026-10-23T02:43:49.641Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2023-4346", "aliases": [], "title": "KNX Protocol Connection Authorization Option 1：脆弱性情報", "summary": "KNX Connection Authorization の Option 1 を使用し、実装によってはデバイスがロックされ、ユーザーがリセットできなくなる可能性があります。BCU キー機能でデバイス用のパスワードを作成できますが、現在のパスワードを入力しない限りリセットできないことが多いです。デバイスがネットワークに接続されている場合、ネットワークにアクセスできる攻撃者が KNX 設置に介入し、追加のセキュリティオプションが有効でない限りすべてのデバイスをパージし、BCU キーを設定してデバイスをロックできます。ネットワーク未接続でも、物理的にデバイスに触れられる攻撃者が同様にこの脆弱性を悪用できます。", "risk": "この脆弱性が成功裏に悪用されると、ユーザーはデバイスへのアクセスを失い、リセット手段がない可能性があります。", "product": "KNX Protocol Connection Authorization Option 1", "category": "other", "component": "package", "severity": "high", "cvss": 7.5, "cvssVersion": "3.1", "cvssSource": "icscert", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "affected": [ { "product": "KNX Protocol Connection Authorization Option 1", "range": "0" } ], "fixed": [], "steps": [ "KNX Association は、既に完了したすべての KNX プロジェクトおよび将来委託されるプロジェクトで必ず BCU キーを設定し、プロジェクト文書の一部として建物所有者に引き渡すことを推奨しています。", "「CVE-2023-4346」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4346", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4346", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2023-08-29T19:38:55.399Z", "modifiedAt": "2026-07-16T03:55:23.364Z", "fetchedAt": "2026-10-23T02:43:28.725Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "KNX Protocol Connection Authorization Option 1", "vendor": "KNX Association", "versions": [ { "status": "affected", "version": "0" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2023-4346", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "fetchedAt": "2026-10-23T02:43:28.725Z", "publishedAt": "2023-08-29T19:38:55.399Z", "modifiedAt": "2026-07-16T03:55:23.364Z", "state": "published", "provider": "icscert", "title": "", "descriptions": [ { "lang": "en", "value": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "KNX Association", "product": "KNX Protocol Connection Authorization Option 1", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "status": "affected" } ] } ], "solutions": [], "workarounds": [ { "lang": "en", "value": "The KNX Association recommends users always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-645", "lang": "en", "description": "CWE-645 Overly Restrictive Account Lockout Mechanism", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "provider": "icscert", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "label": "CVE", "tags": [ "government-resource", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4346", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"KNX Protocol Connection Authorization Option 1\",\"vendor\":\"KNX Association\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "The KNX Association recommends users always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-645\",\"description\":\"CWE-645 Overly Restrictive Account Lockout Mechanism\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "sourcePath": "article:summary-vulnerabilities-remediations", "text": "KNX Protocol | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v3 7.5\n\nATTENTION: Exploitable remotely/low attack complexity/known public exploitation\n\nVendor: KNX Association\n\nEquipment: KNX devices using KNX Connection Authorization\n\nVulnerability: Overly Restrictive Account Lockout Mechanism\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following devices using KNX Protocol are affected:\n\nKNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 OVERLY RESTRICTIVE ACCOUNT LOCKOUT MECHANISM CWE-645\n\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.\n\nCVE-2023-4346 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing Sector\n\nCOUNTRIES/AREAS DEPLOYED: Europe\n\nCOMPANY HEADQUARTERS LOCATION: Belgium\n\n3.4 RESEARCHER\n\nFelix Eberstaller of Limes Security reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nKNX Association recommends all system integrators, installers, ETS users, and end customers to follow common IT security guidelines. KNX Association recommends users follow the recommendations in the KNX Secure Checklist .\n\nThe KNX Association also recommends users always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet .\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\nCISA has received reports of this vulnerability being actively exploited.\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nPlease share your thoughts\n\nWe recently updated our anonymous product survey ; we welcome your feedback.\n\nReturn to top\n\nTopics\n\nSpotlight\n\nResources & Tools\n\nNews & Events\n\nCareers\n\nAbout\n\nCybersecurity & Infrastructure Security Agency\n\nFacebook\n\nX\n\nLinkedIn\n\nYouTube\n\nInstagram\n\nRSS\n\nCISA Central\n1-844-Say-CISA\ncontact@cisa.dhs.gov\n\nDHS Seal\n\nCISA.gov\n\nAn official website of the U.S. Department of Homeland Security\n\nAbout CISA\n\nBudget and Performance\n\nDHS.gov\n\nFOIA Requests\n\nNo FEAR Act\n\nOffice of Inspector General\n\nPrivacy Policy\n\nSubscribe\n\nThe White House\n\nUSA.gov\n\nWebsite Feedback", "truncated": false, "representation": "html_text_excerpt", "relatedCve": "CVE-2023-4346", "relatedCves": [ "CVE-2023-4346" ] } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 当該CVEを本文中に明記した、直接参照された公的機関・開発元の告知を追加しています。複数製品・CVEを含む告知の対策は、その製品・CVEとの対応関係を維持してください。", "excludedLinkedSources": [] }, "supplementarySources": [ { "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "title": "KNX Protocol | CISA", "relatedCves": [ "CVE-2023-4346" ] } ], "relatedDocuments": [ { "type": "html", "sourceType": "CISA ICS", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "title": "KNX Protocol | CISA", "relatedCves": [ "CVE-2023-4346" ], "truncated": false } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-16T03:55:23.364Z", "fetchedAt": "2026-10-23T02:43:28.725Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-15T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "KNX Protocol Connection Authorization Option 1に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:07.966Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "30ac2d608a37674b84eb4e442cc0e9e9eb7e30be2426299793878025b69f95c0", "sourceModifiedAt": "2026-07-16T03:55:23.364Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "KNX Connection Authorization の Option 1 を使用し、実装によってはデバイスがロックされ、ユーザーがリセットできなくなる可能性があります。BCU キー機能でデバイス用のパスワードを作成できますが、現在のパスワードを入力しない限りリセットできないことが多いです。デバイスがネットワークに接続されている場合、ネットワークにアクセスできる攻撃者が KNX 設置に介入し、追加のセキュリティオプションが有効でない限りすべてのデバイスをパージし、BCU キーを設定してデバイスをロックできます。ネットワーク未接続でも、物理的にデバイスに触れられる攻撃者が同様にこの脆弱性を悪用できます。", "risk": "この脆弱性が成功裏に悪用されると、ユーザーはデバイスへのアクセスを失い、リセット手段がない可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "KNX Connection Authorization の Option 1 を使用し、現在 BCU キーが設定されていない KNX デバイスはすべてのバージョンで影響を受けます。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E2", "E3" ] }, { "text": "Option 1 をサポートする KNX デバイスは、実装に依存してロックされ、ユーザーがリセットできなくなる可能性があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：KNX Association / KNX Protocol Connection Authorization Option 1。影響ありとして記載：0。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E3" ] }, { "text": "「KNX Protocol Connection Authorization Option 1」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4346", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] } ], "actions": [ { "text": "KNX Association は、既に完了したすべての KNX プロジェクトおよび将来委託されるプロジェクトで必ず BCU キーを設定し、プロジェクト文書の一部として建物所有者に引き渡すことを推奨しています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2023-4346」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-4346", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4346", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2023-4346", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2023-4346", "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2023-4346" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "label": "CVE：icscert" }, { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "label": "CISAが示す関連情報" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4346", "label": "CVE公式レコード" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4346", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4346", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "sourceField": "article:summary-vulnerabilities-remediations", "excerpt": "KNX Protocol | CISA\n\n1. EXECUTIVE SUMMARY\n\nCVSS v3 7.5\n\nATTENTION: Exploitable remotely/low attack complexity/known public exploitation\n\nVendor: KNX Association\n\nEquipment: KNX devices using KNX Connection Authorization\n\nVulnerability: Overly Restrictive Account Lockout Mechanism\n\n2. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device.\n\n3. TECHNICAL DETAILS\n\n3.1 AFFECTED PRODUCTS\n\nThe following devices using KNX Protocol are affected:\n\nKNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: All versions\n\n3.2 VULNERABILITY OVERVIEW\n\n3.2.1 OVERLY RESTRICTIVE ACCOUNT LOCKOUT MECHANISM CWE-645\n\nKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.\n\nCVE-2023-4346 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ).\n\n3.3 BACKGROUND\n\nCRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing Sector\n\nCOUNTRIES/AREAS DEPLOYED: Europe\n\nCOMPANY HEADQUARTERS LOCATION: Belgium\n\n3.4 RESEARCHER\n\nFelix Eberstaller of Limes Security reported this vulnerability to CISA.\n\n4. MITIGATIONS\n\nKNX Association recommends all system integrators, installers, ETS users, and end customers to follow common IT security guidelines. KNX Association recommends users follow the recommendations in the KNX Secure Checklist .\n\nThe KNX Association also recommends users always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.\n\nCISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet .\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics . Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .\n\nAdditional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies .\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\nCISA has received reports of this vulnerability being actively exploited.\n\nThis product is provided subject to this Notification and this Privacy & Use policy.\n\nPlease share your thoughts\n\nWe recently updated our anonymous product survey ; we welcome your feedback.\n\nReturn to top\n\nTopics\n\nSpotlight\n\nResources & Tools\n\nNews & Events\n\nCareers\n\nAbout\n\nCybersecurity & Infrastructure Security Agency\n\nFacebook\n\nX\n\nLinkedIn\n\nYouTube\n\nInstagram\n\nRSS\n\nCISA Central\n1-844-Say-CISA\ncontact@cisa.dhs.gov\n\nDHS Seal\n\nCISA.gov\n\nAn official website of the U.S. Department of Homeland Security\n\nAbout CISA\n\nBudget and Performance\n\nDHS.gov\n\nFOIA Requests\n\nNo FEAR Act\n\nOffice of Inspector General\n\nPrivacy Policy\n\nSubscribe\n\nThe White House\n\nUSA.gov\n\nWebsite Feedback", "language": null, "representation": "html_text_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"KNX Protocol Connection Authorization Option 1\",\"vendor\":\"KNX Association\",\"versions\":[{\"status\":\"affected\",\"version\":\"0\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/4xxx/CVE-2023-4346.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "The KNX Association recommends users always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2023-4346\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2023-4346（KNX Protocol Connection Authorization Option 1）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・KNX Connection Authorization の Option 1 を使用し、現在 BCU キーが設定されていない KNX デバイスはすべてのバージョンで影響を受けます。\n・Option 1 をサポートする KNX デバイスは、実装に依存してロックされ、ユーザーがリセットできなくなる可能性があります。\n・公式の対象表：KNX Association / KNX Protocol Connection Authorization Option 1。影響ありとして記載：0。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2023-4346", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:07.966Z", "lastSuccess": "2026-10-23T03:23:07.966Z", "sourceCheckedAt": "2026-10-23T02:43:28.725Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-46817", "aliases": [], "title": "Oracle Payments：脆弱性情報", "summary": "Oracle E-Business Suite の Oracle Payments 製品（コンポーネント: File Transmission）に脆弱性があります。影響を受けるサポート対象バージョンは 12.2.3 から 12.2.15 です。ネットワーク上で HTTP によりアクセスできる認証されていない攻撃者が容易にこの脆弱性を利用でき、Oracle Payments を乗っ取ることが可能です。", "risk": "攻撃が成功すると、Oracle Payments が攻撃者に乗っ取られます。", "product": "Oracle Payments", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "oracle", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Oracle Payments", "range": ">= 12.2.3 / <= 12.2.15" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46817", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cspumay2026.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46817", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-05-28T20:17:10.861Z", "modifiedAt": "2026-07-16T03:55:21.823Z", "fetchedAt": "2026-10-23T02:43:49.093Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Oracle Corporation", "product": "Oracle Payments", "versions": [ { "version": "12.2.3", "status": "affected", "lessThanOrEqual": "12.2.15", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-46817", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "fetchedAt": "2026-10-23T02:43:49.093Z", "publishedAt": "2026-05-28T20:17:10.861Z", "modifiedAt": "2026-07-16T03:55:21.823Z", "state": "published", "provider": "oracle", "title": "", "descriptions": [ { "lang": "en-US", "value": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Oracle Corporation", "product": "Oracle Payments", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.2.3", "lessThanOrEqual": "12.2.15", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "oracle", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.oracle.com/security-alerts/cspumay2026.html", "label": "Oracle Advisory", "tags": [ "vendor-advisory" ], "provider": "oracle", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Oracle Corporation\",\"product\":\"Oracle Payments\",\"versions\":[{\"version\":\"12.2.3\",\"status\":\"affected\",\"lessThanOrEqual\":\"12.2.15\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en-US\",\"description\":\"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-07-16T03:55:21.823Z", "fetchedAt": "2026-10-23T02:43:49.093Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-15T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "Oracle Paymentsに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:08.546Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6c0ab852d81b593b68fca586e891f671fde7a18e9aa598d99355ffbc35554eb7", "sourceModifiedAt": "2026-07-16T03:55:21.823Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Oracle E-Business Suite の Oracle Payments 製品（コンポーネント: File Transmission）に脆弱性があります。影響を受けるサポート対象バージョンは 12.2.3 から 12.2.15 です。ネットワーク上で HTTP によりアクセスできる認証されていない攻撃者が容易にこの脆弱性を利用でき、Oracle Payments を乗っ取ることが可能です。", "risk": "攻撃が成功すると、Oracle Payments が攻撃者に乗っ取られます。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1", "E3" ], "applicability": [ { "text": "対象製品は Oracle Payments（Oracle E-Business Suite の一部）です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響を受けるバージョンは 12.2.3 以上 12.2.15 以下です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E2" ] }, { "text": "攻撃者は認証されておらず、ネットワーク経由で HTTP にアクセスできる必要があります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E1", "E3" ] }, { "text": "公式の対象表：Oracle Corporation / Oracle Payments。影響ありとして記載：12.2.3以上、12.2.15以下。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Oracle Payments」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-46817", "https://www.oracle.com/security-alerts/cspumay2026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-46817" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-46817", "https://www.oracle.com/security-alerts/cspumay2026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-46817" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-46817", "https://www.oracle.com/security-alerts/cspumay2026.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-46817" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "label": "CVE：oracle" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46817", "label": "CVE公式レコード" }, { "url": "https://www.oracle.com/security-alerts/cspumay2026.html", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46817", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Oracle Corporation\",\"product\":\"Oracle Payments\",\"versions\":[{\"version\":\"12.2.3\",\"status\":\"affected\",\"lessThanOrEqual\":\"12.2.15\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46817.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en-US\",\"description\":\"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-46817", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-46817\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-46817（Oracle Payments）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・対象製品は Oracle Payments（Oracle E-Business Suite の一部）です。\n・影響を受けるバージョンは 12.2.3 以上 12.2.15 以下です。\n・攻撃者は認証されておらず、ネットワーク経由で HTTP にアクセスできる必要があります。\n・公式の対象表：Oracle Corporation / Oracle Payments。影響ありとして記載：12.2.3以上、12.2.15以下。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-46817", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:08.546Z", "lastSuccess": "2026-10-23T03:23:08.546Z", "sourceCheckedAt": "2026-10-23T02:43:49.093Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-15409", "aliases": [], "title": "SMA1000：脆弱性情報", "summary": "SMA1000 Appliance Work Place インターフェースに SSRF（サーバー側リクエスト偽装）脆弱性があり、リモートの認証されていない攻撃者が装置に意図しない場所へリクエストを送らせる可能性があります。", "risk": "装置が意図しない場所へリクエストを送信させられる可能性があります。", "product": "SMA1000", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA1000", "range": ">= 12.4.3-03245 / <= 12.4.3-03434（環境: Linux）" }, { "product": "SMA1000", "range": ">= 12.5.0-02283 / <= 12.5.0-02800（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15409", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15409", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-14T19:39:34.808Z", "modifiedAt": "2026-08-04T03:56:14.089Z", "fetchedAt": "2026-10-23T02:43:46.445Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "SonicWall", "product": "SMA1000", "platforms": [ "Linux" ], "versions": [ { "status": "affected", "version": "12.4.3-03245", "lessThanOrEqual": "12.4.3-03434", "versionType": "custom" }, { "status": "affected", "version": "12.5.0-02283", "lessThanOrEqual": "12.5.0-02800", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-15409", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "fetchedAt": "2026-10-23T02:43:46.445Z", "publishedAt": "2026-07-14T19:39:34.808Z", "modifiedAt": "2026-08-04T03:56:14.089Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA1000", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4.3-03245", "lessThanOrEqual": "12.4.3-03434", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5.0-02283", "lessThanOrEqual": "12.5.0-02800", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "sonicwall", "tags": [ "vendor-advisory" ], "provider": "sonicwall", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15409", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03245\",\"lessThanOrEqual\":\"12.4.3-03434\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"12.5.0-02283\",\"lessThanOrEqual\":\"12.5.0-02800\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-918\",\"description\":\"CWE-918: Server-Side Request Forgery (SSRF)\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"CHANGED\",\"version\":\"3.1\",\"baseScore\":10,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:56:14.089Z", "fetchedAt": "2026-10-23T02:43:46.445Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-14T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "SMA1000に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:08.786Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "36c0a30144eca5494101781d41c4f59ddf28243ca85bb146544831bf4eb024c6", "sourceModifiedAt": "2026-08-04T03:56:14.089Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SMA1000 Appliance Work Place インターフェースに SSRF（サーバー側リクエスト偽装）脆弱性があり、リモートの認証されていない攻撃者が装置に意図しない場所へリクエストを送らせる可能性があります。", "risk": "装置が意図しない場所へリクエストを送信させられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "SMA1000 Appliance の Work Place インターフェースに SSRF 脆弱性が存在します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E1" ] }, { "text": "リモートから認証されていない攻撃者がこの脆弱性を利用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E1" ] }, { "text": "影響を受けるプラットフォームは Linux で、バージョン 12.4.3-03245 から 12.4.3-03434、12.5.0-02283 から 12.5.0-02800 が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03245以上、12.4.3-03434以下。影響ありとして記載：12.5.0-02283以上、12.5.0-02800以下。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SMA1000」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-15409", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15409" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-15409", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15409" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-15409", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15409" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15409", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15409", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15409.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03245\",\"lessThanOrEqual\":\"12.4.3-03434\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"12.5.0-02283\",\"lessThanOrEqual\":\"12.5.0-02800\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15409", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-15409\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-15409（SMA1000）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・SMA1000 Appliance の Work Place インターフェースに SSRF 脆弱性が存在します。\n・リモートから認証されていない攻撃者がこの脆弱性を利用できます。\n・影響を受けるプラットフォームは Linux で、バージョン 12.4.3-03245 から 12.4.3-03434、12.5.0-02283 から 12.5.0-02800 が対象です。\n・公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03245以上、12.4.3-03434以下。影響ありとして記載：12.5.0-02283以上、12.5.0-02800以下。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-15409", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:08.786Z", "lastSuccess": "2026-10-23T03:23:08.786Z", "sourceCheckedAt": "2026-10-23T02:43:46.445Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2026-15410", "aliases": [], "title": "SMA1000：脆弱性情報", "summary": "SMA1000 Appliance Management Console (AMC) に、認証後にコード生成の制御が不適切になる（コードインジェクション）脆弱性が確認されました。この脆弱性は特定の条件下で、リモートから認証済みの管理者が任意の OS コマンドを実行できる可能性があります。", "risk": "認証済みの管理者が任意の OS コマンドを実行できるため、システムが不正に操作される危険があります。", "product": "SMA1000", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "sonicwall", "cvssVector": null, "affected": [ { "product": "SMA1000", "range": ">= 12.4.3-03245 / <= 12.4.3-03434（環境: Linux）" }, { "product": "SMA1000", "range": ">= 12.5.0-02283 / <= 12.5.0-02800（環境: Linux）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15410", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15410", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-07-14T19:43:03.226Z", "modifiedAt": "2026-08-04T03:56:15.680Z", "fetchedAt": "2026-10-23T02:43:46.516Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "SonicWall", "product": "SMA1000", "platforms": [ "Linux" ], "versions": [ { "status": "affected", "version": "12.4.3-03245", "lessThanOrEqual": "12.4.3-03434", "versionType": "custom" }, { "status": "affected", "version": "12.5.0-02283", "lessThanOrEqual": "12.5.0-02800", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "configurationNotes": "対象環境・機能: Linux。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-15410", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "fetchedAt": "2026-10-23T02:43:46.516Z", "publishedAt": "2026-07-14T19:43:03.226Z", "modifiedAt": "2026-08-04T03:56:15.680Z", "state": "published", "provider": "sonicwall", "title": "", "descriptions": [ { "lang": "en", "value": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SonicWall", "product": "SMA1000", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [ "Linux" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.4.3-03245", "lessThanOrEqual": "12.4.3-03434", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "12.5.0-02283", "lessThanOrEqual": "12.5.0-02800", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "sonicwall", "tags": [ "vendor-advisory" ], "provider": "sonicwall", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-15410", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03245\",\"lessThanOrEqual\":\"12.4.3-03434\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"12.5.0-02283\",\"lessThanOrEqual\":\"12.5.0-02800\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"cweId\":\"CWE-94\",\"description\":\"CWE-94: Improper Control of Generation of Code ('Code Injection')\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.2,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-04T03:56:15.680Z", "fetchedAt": "2026-10-23T02:43:46.516Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-07-14T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "sourceSummary": "SMA1000に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:23:09.412Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "5a565049b587115755f16d27336b61b48bd9c4f60913d731ccec677d467f0447", "sourceModifiedAt": "2026-08-04T03:56:15.680Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SMA1000 Appliance Management Console (AMC) に、認証後にコード生成の制御が不適切になる（コードインジェクション）脆弱性が確認されました。この脆弱性は特定の条件下で、リモートから認証済みの管理者が任意の OS コマンドを実行できる可能性があります。", "risk": "認証済みの管理者が任意の OS コマンドを実行できるため、システムが不正に操作される危険があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "リモートから認証済みの管理者権限を持つ攻撃者が対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03245以上、12.4.3-03434以下。影響ありとして記載：12.5.0-02283以上、12.5.0-02800以下。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json" ], "evidenceIds": [ "E2" ] }, { "text": "「SMA1000」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-15410", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15410" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-15410", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15410" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-15410", "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "https://nvd.nist.gov/vuln/detail/CVE-2026-15410" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "label": "CVE：sonicwall" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15410", "label": "CVE公式レコード" }, { "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15410", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15410.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"SonicWall\",\"product\":\"SMA1000\",\"platforms\":[\"Linux\"],\"versions\":[{\"status\":\"affected\",\"version\":\"12.4.3-03245\",\"lessThanOrEqual\":\"12.4.3-03434\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"12.5.0-02283\",\"lessThanOrEqual\":\"12.5.0-02800\",\"versionType\":\"custom\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-15410", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-15410\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-15410（SMA1000）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・リモートから認証済みの管理者権限を持つ攻撃者が対象となります。\n・公式の対象表：SonicWall / SMA1000。影響ありとして記載：12.4.3-03245以上、12.4.3-03434以下。影響ありとして記載：12.5.0-02283以上、12.5.0-02800以下。対象の環境：Linux。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-15410", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:23:09.412Z", "lastSuccess": "2026-10-23T03:23:09.412Z", "sourceCheckedAt": "2026-10-23T02:43:46.516Z", "errorCode": null }, "glossary": [] } } ], "total": 2188, "limit": 20, "offset": 480, "filters": { "product": "all", "type": "all", "q": "", "page": 25 }, "pagination": { "page": 25, "pageSize": 20, "totalPages": 110 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-23T17:17:50.747Z", "lastAttempt": "2026-10-23T17:17:50.747Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-23T16:17:50.069Z", "lastAttempt": "2026-10-23T17:17:50.747Z", "error": "GitHub API取得上限に到達 (2026-10-23T17:20:59.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-23T17:17:50.747Z", "lastAttempt": "2026-10-23T17:17:50.747Z", "error": null, "recordCount": 1754, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T17:17:50.747Z", "lastAttempt": "2026-10-23T17:17:50.747Z", "error": null, "recordCount": 2, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T16:02:50.069Z 〜 2026-10-23T17:17:50.747Z、全製品の変更 259/259件まで確認、対象2件反映。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CVE", "status": "error", "lastSuccess": "2026-10-23T16:17:50.069Z", "lastAttempt": "2026-10-23T17:17:50.747Z", "error": "Source request timed out", "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。", "cursor": null, "freshness": "fresh", "stale": false } ] }