{ "schemaVersion": "1.0", "publisher": "脆弱性ナビ", "origin": "https://zeijaku.ittrip.xyz", "terms": [ { "name": "CVE Program", "url": "https://www.cve.org/legal/termsofuse", "notice": "CVE content is used subject to the CVE Program Terms of Use. CVE is a trademark of The MITRE Corporation.", "licenseText": "CVE content: Copyright The MITRE Corporation. CVE is a trademark of The MITRE Corporation.\nCVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.\nDisclaimers: ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE." }, { "name": "NIST NVD", "url": "https://nvd.nist.gov/general/faq", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "name": "JVN", "url": "https://jvn.jp/contact/index.html", "notice": "出典：JVN（JPCERT/CC・IPA）。原文は各レコードの参照先を確認してください。" }, { "name": "CISA KEV", "url": "https://github.com/cisagov/kev-data", "notice": "Known Exploited Vulnerabilities catalog, CISA. CC0." } ], "records": [ { "id": "CVE-2026-22719", "aliases": [], "title": "VMware Aria Operations / VMware Cloud Foundation Operations / Telco Cloud Platform / Telco Cloud Infrastructure：コード実行", "summary": "VMware Aria Operations にコマンドインジェクションの脆弱性があり、認証されていない攻撃者がこの問題を悪用すると、任意のコマンドを実行させられ、サポート支援付きの製品移行が進行中の間に VMware Aria Operations でリモートコード実行が起こる可能性があります。対策として、VMSA‑2026‑0001 の「Response Matrix」に記載された「Fixed Version」列のベンダーパッチを適用してください。また、同マトリックスの「Workarounds」列に記載された回避策も利用可能です。", "risk": "攻撃者が任意のコマンドを実行でき、VMware Aria Operations 上でリモートコード実行が発生する恐れがあります。", "product": "VMware Aria Operations / VMware Cloud Foundation Operations / Telco Cloud Platform / Telco Cloud Infrastructure", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "vmware", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "VMware Aria Operations", "range": ">= 8.18.x / < 8.18.6" }, { "product": "VMware Aria Operations", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" }, { "product": "VMware Cloud Foundation Operations", "range": ">= 9.0 / < 9.0.2" }, { "product": "VMware Cloud Foundation Operations", "range": ">= 4.0 / < 5.2.3" }, { "product": "VMware Cloud Foundation Operations", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" }, { "product": "Telco Cloud Platform", "range": ">= 2.0 / < 5.2.3" }, { "product": "Telco Cloud Platform", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" }, { "product": "Telco Cloud Infrastructure", "range": ">= 2.0 / < 5.2.3" }, { "product": "Telco Cloud Infrastructure", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "VMSA‑2026‑0001 の「Response Matrix」に記載されたベンダーパッチを適用してください。固定バージョンは VMware Aria Operations 8.18.6（8.x 系）および VMware Cloud Foundation Operations 9.0.2.0（9.x 系）です。", "「CVE-2026-22719」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22719", "label": "CVE公式レコード" }, { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "label": "CISAが示す関連情報" }, { "url": "https://knowledge.broadcom.com/external/article/430349", "label": "CISAが示す関連情報" }, { "url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "label": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719)" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22719", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-25T19:18:59.269Z", "modifiedAt": "2026-04-14T10:38:25.169Z", "fetchedAt": "2026-10-23T02:43:47.913Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001", "sourceTitle": "VMware Aria Operations command injection vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "VMware", "product": "VMware Aria Operations", "packageName": "VMware Aria Operations", "versions": [ { "status": "affected", "version": "8.18.x", "lessThan": "8.18.6", "versionType": "custom" } ], "defaultStatus": "affected" }, { "vendor": "VMware", "product": "VMware Cloud Foundation Operations", "packageName": "VMware Cloud Foundation Operations", "versions": [ { "status": "affected", "version": "9.0", "lessThan": "9.0.2", "versionType": "custom" }, { "status": "unaffected", "version": "9.0.2", "versionType": "custom" }, { "status": "affected", "version": "4.0", "lessThan": "5.2.3", "versionType": "custom" }, { "status": "unaffected", "version": "5.2.3" } ], "defaultStatus": "affected" }, { "vendor": "VMware", "product": "Telco Cloud Platform", "packageName": "vmware-telco-cloud-platform", "versions": [ { "status": "affected", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom" }, { "status": "unaffected", "version": "5.2.3", "versionType": "custom" } ], "defaultStatus": "affected" }, { "vendor": "VMware", "product": "Telco Cloud Infrastructure", "packageName": "vmware-telco-cloud-infrastructure", "versions": [ { "status": "affected", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom" }, { "status": "unaffected", "version": "5.2.3" } ], "defaultStatus": "affected" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-22719", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "fetchedAt": "2026-10-23T02:43:47.913Z", "publishedAt": "2026-02-25T19:18:59.269Z", "modifiedAt": "2026-04-14T10:38:25.169Z", "state": "published", "provider": "vmware", "title": "VMware Aria Operations command injection vulnerability", "descriptions": [ { "lang": "en", "value": "VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "VMware", "product": "VMware Aria Operations", "sourcePath": "/containers/cna/affected/0", "packageName": "VMware Aria Operations", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "8.18.x", "lessThan": "8.18.6", "versionType": "custom", "status": "affected" } ] }, { "vendor": "VMware", "product": "VMware Cloud Foundation Operations", "sourcePath": "/containers/cna/affected/1", "packageName": "VMware Cloud Foundation Operations", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "9.0", "lessThan": "9.0.2", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "9.0.2", "versionType": "custom", "status": "unaffected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "4.0", "lessThan": "5.2.3", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "5.2.3", "status": "unaffected" } ] }, { "vendor": "VMware", "product": "Telco Cloud Platform", "sourcePath": "/containers/cna/affected/2", "packageName": "vmware-telco-cloud-platform", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "5.2.3", "versionType": "custom", "status": "unaffected" } ] }, { "vendor": "VMware", "product": "Telco Cloud Infrastructure", "sourcePath": "/containers/cna/affected/3", "packageName": "vmware-telco-cloud-infrastructure", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/1", "version": "5.2.3", "status": "unaffected" } ] } ], "solutions": [ { "lang": "en", "value": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [ { "lang": "en", "value": "Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.", "sourcePath": "/containers/cna/workarounds/0/value" } ], "exploits": [], "rejectedReasons": [], "problemTypes": [], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "vmware", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "label": "VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22719)", "tags": [ "vendor-advisory" ], "provider": "vmware", "sourcePath": "/containers/cna/references/0" }, { "url": "https://knowledge.broadcom.com/external/article/430349", "label": "KB430349: Workaround instructions for CVE-2026-22719", "tags": [ "mitigation" ], "provider": "vmware", "sourcePath": "/containers/cna/references/1" }, { "url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "label": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719)", "tags": [ "release-notes" ], "provider": "vmware", "sourcePath": "/containers/cna/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"VMware\",\"product\":\"VMware Aria Operations\",\"packageName\":\"VMware Aria Operations\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.18.x\",\"lessThan\":\"8.18.6\",\"versionType\":\"custom\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"VMware\",\"product\":\"VMware Cloud Foundation Operations\",\"packageName\":\"VMware Cloud Foundation Operations\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.0\",\"lessThan\":\"9.0.2\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"9.0.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"VMware\",\"product\":\"Telco Cloud Platform\",\"packageName\":\"vmware-telco-cloud-platform\",\"versions\":[{\"status\":\"affected\",\"version\":\"2.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\",\"versionType\":\"custom\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"VMware\",\"product\":\"Telco Cloud Infrastructure\",\"packageName\":\"vmware-telco-cloud-infrastructure\",\"versions\":[{\"status\":\"affected\",\"version\":\"2.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\"}],\"defaultStatus\":\"affected\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/workarounds/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/workarounds/0/value", "text": "Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.1,\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-14T10:38:25.169Z", "fetchedAt": "2026-10-23T02:43:47.913Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-03-03T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "VMware Aria Operations / VMware Cloud Foundation Operations / Telco Cloud Platform / Telco Cloud Infrastructureにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:44.818Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "fbb3c6dd4405efa3f2d971df68566bf63e106e7bd3cd03f13b995de33c9458d6", "sourceModifiedAt": "2026-04-14T10:38:25.169Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "VMware Aria Operations にコマンドインジェクションの脆弱性があり、認証されていない攻撃者がこの問題を悪用すると、任意のコマンドを実行させられ、サポート支援付きの製品移行が進行中の間に VMware Aria Operations でリモートコード実行が起こる可能性があります。対策として、VMSA‑2026‑0001 の「Response Matrix」に記載された「Fixed Version」列のベンダーパッチを適用してください。また、同マトリックスの「Workarounds」列に記載された回避策も利用可能です。", "risk": "攻撃者が任意のコマンドを実行でき、VMware Aria Operations 上でリモートコード実行が発生する恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "VMware Aria Operations のバージョン 8.18.x で、8.18.6 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "VMware Cloud Foundation Operations のバージョン 9.0 で、9.0.2 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "VMware Cloud Foundation Operations のバージョン 4.0 で、5.2.3 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Telco Cloud Platform のバージョン 2.0 で、5.2.3 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Telco Cloud Infrastructure のバージョン 2.0 で、5.2.3 未満のものは影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "攻撃者は認証されていない状態でこの脆弱性を悪用できます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：VMware / VMware Aria Operations。影響ありとして記載：8.18系のうち、8.18.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：VMware / VMware Cloud Foundation Operations。影響ありとして記載：9.0以上、9.0.2未満。影響なしとして記載：9.0.2。影響ありとして記載：4.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：VMware / Telco Cloud Platform。影響ありとして記載：2.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：VMware / Telco Cloud Infrastructure。影響ありとして記載：2.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E6" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719" ], "evidenceIds": [ "E9" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E3" ] }, { "text": "「VMware Aria Operations / VMware Cloud Foundation Operations / Telco Cloud Platform / Telco Cloud Infrastructure」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-22719", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "https://knowledge.broadcom.com/external/article/430349", "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "https://nvd.nist.gov/vuln/detail/CVE-2026-22719" ] } ], "actions": [ { "text": "VMSA‑2026‑0001 の「Response Matrix」に記載されたベンダーパッチを適用してください。固定バージョンは VMware Aria Operations 8.18.6（8.x 系）および VMware Cloud Foundation Operations 9.0.2.0（9.x 系）です。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E7" ] }, { "text": "「CVE-2026-22719」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-22719", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "https://knowledge.broadcom.com/external/article/430349", "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "https://nvd.nist.gov/vuln/detail/CVE-2026-22719" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-22719", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "https://knowledge.broadcom.com/external/article/430349", "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "https://nvd.nist.gov/vuln/detail/CVE-2026-22719" ] } ], "temporaryMitigations": [ { "text": "即時にパッチ適用ができない環境向けに、ベンダーが提供する回避策（VMSA‑2026‑0001 の KB430349）を利用してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E8" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-22719", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "https://knowledge.broadcom.com/external/article/430349", "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "https://nvd.nist.gov/vuln/detail/CVE-2026-22719" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "label": "CVE：vmware" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22719", "label": "CVE公式レコード" }, { "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "label": "CISAが示す関連情報" }, { "url": "https://knowledge.broadcom.com/external/article/430349", "label": "CISAが示す関連情報" }, { "url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "label": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719)" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22719", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/title", "excerpt": "VMware Aria Operations command injection vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"VMware\",\"product\":\"VMware Aria Operations\",\"packageName\":\"VMware Aria Operations\",\"versions\":[{\"status\":\"affected\",\"version\":\"8.18.x\",\"lessThan\":\"8.18.6\",\"versionType\":\"custom\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"VMware\",\"product\":\"VMware Cloud Foundation Operations\",\"packageName\":\"VMware Cloud Foundation Operations\",\"versions\":[{\"status\":\"affected\",\"version\":\"9.0\",\"lessThan\":\"9.0.2\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"9.0.2\",\"versionType\":\"custom\"},{\"status\":\"affected\",\"version\":\"4.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"VMware\",\"product\":\"Telco Cloud Platform\",\"packageName\":\"vmware-telco-cloud-platform\",\"versions\":[{\"status\":\"affected\",\"version\":\"2.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\",\"versionType\":\"custom\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"VMware\",\"product\":\"Telco Cloud Infrastructure\",\"packageName\":\"vmware-telco-cloud-infrastructure\",\"versions\":[{\"status\":\"affected\",\"version\":\"2.0\",\"lessThan\":\"5.2.3\",\"versionType\":\"custom\"},{\"status\":\"unaffected\",\"version\":\"5.2.3\"}],\"defaultStatus\":\"affected\"}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).", "language": "en", "representation": "source_excerpt" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22719.json", "sourceField": "/containers/cna/workarounds/0/value", "excerpt": "Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.", "language": "en", "representation": "source_excerpt" }, { "id": "E9", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22719", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-22719\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-22719（VMware Aria Operations / VMware Cloud Foundation Operations / Telco Cloud Platform / Telco Cloud Infrastructure）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・VMware Aria Operations のバージョン 8.18.x で、8.18.6 未満のものは影響を受けます。\n・VMware Cloud Foundation Operations のバージョン 9.0 で、9.0.2 未満のものは影響を受けます。\n・VMware Cloud Foundation Operations のバージョン 4.0 で、5.2.3 未満のものは影響を受けます。\n・Telco Cloud Platform のバージョン 2.0 で、5.2.3 未満のものは影響を受けます。\n・Telco Cloud Infrastructure のバージョン 2.0 で、5.2.3 未満のものは影響を受けます。\n・攻撃者は認証されていない状態でこの脆弱性を悪用できます。\n・公式の対象表：VMware / VMware Aria Operations。影響ありとして記載：8.18系のうち、8.18.6未満。個別に例外が記されていない版も、原資料では影響ありとされています。\n・公式の対象表：VMware / VMware Cloud Foundation Operations。影響ありとして記載：9.0以上、9.0.2未満。影響なしとして記載：9.0.2。影響ありとして記載：4.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。\n・公式の対象表：VMware / Telco Cloud Platform。影響ありとして記載：2.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。\n・公式の対象表：VMware / Telco Cloud Infrastructure。影響ありとして記載：2.0以上、5.2.3未満。影響なしとして記載：5.2.3。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-22719", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:44.818Z", "lastSuccess": "2026-10-23T03:24:44.818Z", "sourceCheckedAt": "2026-10-23T02:43:47.913Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2022-20775", "aliases": [], "title": "Cisco Catalyst SD-WAN / Cisco Catalyst SD-WAN Manager / Cisco SD-WAN vContainer / Cisco SD-WAN vEdge Cloud / Cisco SD-WAN vEdge Router：権限の奪取", "summary": "Cisco SD-WAN ソフトウェアの CLI において、認証済みのローカル攻撃者が細工したコマンドを実行すると、権限が昇格し、root ユーザーとして任意のコマンドを実行できる可能性があります。", "risk": "攻撃者が root 権限で任意のコマンドを実行できる。", "product": "Cisco Catalyst SD-WAN / Cisco Catalyst SD-WAN Manager / Cisco SD-WAN vContainer / Cisco SD-WAN vEdge Cloud / Cisco SD-WAN vEdge Router", "category": "other", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Cisco Catalyst SD-WAN", "range": "18.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.3.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.303" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.0.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.9" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.7" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.2.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.10" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.8" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.302" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.7" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.098" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.099" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.8" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.0.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.1.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.6" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.097" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.3.6" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.0" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.11" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.12" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.1.0a" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.1ESM1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.1ESM2" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.2.1LA" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.1ESM3" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.929" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.31" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.32" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.2ESM1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.2.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "18.4.6" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.2ESM2" }, { "product": "Cisco Catalyst SD-WAN", "range": "19.2.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.809" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.5.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.811" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.1.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.4.2.2527" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.4.2ES1" }, { "product": "Cisco Catalyst SD-WAN", "range": "17.3.2ESM3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.7.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.2.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.4.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.5.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.2.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.4.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.2.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.2.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.5.1.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.7.1.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.7.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.6" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.7" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.4.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.3.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.4.2.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.1.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.4.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.3.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.7.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.5.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.1.3.1" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.3.3" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.7.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.4.2" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.5.5" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.3.4" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.3.8" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.6" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.7" }, { "product": "Cisco Catalyst SD-WAN", "range": "20.6.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.12" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.3.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.099" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.0.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.1.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.302" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.303" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.097" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.098" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.0.1a" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.501_ES" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.929" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.31" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.32" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_925" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1_927" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.2_937" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_928" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_929" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1_930" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.0.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_937" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.1.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.01" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.02" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.14" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.17" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.0.18.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.0.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.0.18.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.16" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1EFT2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.11" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.18" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.813" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.19" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.814" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.20" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.24" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.25" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.26" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.8" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.5" }, { "product": "Cisco SD-WAN vContainer", "range": "20.1.12" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.6" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.1" }, { "product": "Cisco SD-WAN vContainer", "range": "19.3.0" }, { "product": "Cisco SD-WAN vContainer", "range": "20.1.1" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.2" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.8" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.3" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.4" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.302" }, { "product": "Cisco SD-WAN vContainer", "range": "19.1.0" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.303" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.0" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.098" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.10" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.7" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.1" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.099" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.097" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.4" }, { "product": "Cisco SD-WAN vContainer", "range": "18.2.0" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.5" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.1" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.5" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.7" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.8" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.9" }, { "product": "Cisco SD-WAN vContainer", "range": "18.4.0" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.6" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.0" }, { "product": "Cisco SD-WAN vContainer", "range": "17.2.4" }, { "product": "Cisco SD-WAN vContainer", "range": "18.3.3" }, { "product": "Cisco SD-WAN vContainer", "range": "19.2.3" }, { "product": "Cisco SD-WAN vContainer", "range": "20.3.1" }, { "product": "Cisco SD-WAN vContainer", "range": "20.1.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.1.12" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.3.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.8" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.1.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.6" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.302" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.5" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.303" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.098" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.1.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.10" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.0.1a" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.099" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.7" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.097" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.9" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.2.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.5" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.5" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.7" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.6" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.8" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.3.0" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "17.2.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.1.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.929" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.31" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.32" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "18.4.6" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.4.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "19.2.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.4.1.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.5.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.1.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.4.1.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.4.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.7.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.5" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.7.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.6" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.5" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.7" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.4.2.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.4.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.4.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.3.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.5.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.5.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.7.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.3.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.1.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.1.3.1" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.5.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.3.3" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.7.2" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.5.4" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.3.8" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.6" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.7" }, { "product": "Cisco SD-WAN vEdge Cloud", "range": "20.6.8" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.303" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.7" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.3.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.2.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.1.12" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.099" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.10" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.6" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.0.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.6" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.1.01" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.098" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.302" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.5" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.9" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.1.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.1.11" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.097" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.5" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.5" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.8" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.8" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.3.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.0.1a" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.1.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "17.2.7" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.0" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.1.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.929" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.31" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.32" }, { "product": "Cisco SD-WAN vEdge Router", "range": "18.4.6" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.4.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "19.2.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.4.1.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.5.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.1.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.4.1.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.4.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.7.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.7.1.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.5" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.7.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.6" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.5" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.7" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.5.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.3.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.4.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.3.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.4.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.5.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.7.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.5.1" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.1.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.5.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.3.3" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.7.2" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.5.4" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.3.8" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.6" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.7" }, { "product": "Cisco SD-WAN vEdge Router", "range": "20.6.8" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-20775", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "label": "cisco-sa-sd-wan-priv-E6e8tEdF" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20775", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2022-09-30T18:45:26.687Z", "modifiedAt": "2026-03-02T13:12:09.231Z", "fetchedAt": "2026-10-23T02:43:20.800Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.\r\n\r\nThis vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "sourceTitle": "Cisco SD-WAN Software Privilege Escalation Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN", "versions": [ { "version": "18.3.1", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "18.4.0.1", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "19.0.0", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "18.3.3.1", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "20.1.1.1", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "20.1.11", "status": "affected" }, { "version": "20.1.12", "status": "affected" }, { "version": "19.1.0a", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "17.3.1ESM1", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "17.3.1ESM2", "status": "affected" }, { "version": "17.2.1LA", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "17.3.1ESM3", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "17.3.2ESM1", "status": "affected" }, { "version": "20.3.2.1", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "17.3.2ESM2", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "20.3.809", "status": "affected" }, { "version": "20.3.3.1", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.3.811", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "17.4.2.2527", "status": "affected" }, { "version": "17.4.2ES1", "status": "affected" }, { "version": "17.3.2ESM3", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "20.6.1.1", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.4.2.1", "status": "affected" }, { "version": "20.3.4.1", "status": "affected" }, { "version": "20.5.1.1", "status": "affected" }, { "version": "20.6.2.1", "status": "affected" }, { "version": "20.3.4.2", "status": "affected" }, { "version": "20.4.2.2", "status": "affected" }, { "version": "20.6.2.2", "status": "affected" }, { "version": "20.5.1.2", "status": "affected" }, { "version": "20.7.1.1", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "20.7.2", "status": "affected" }, { "version": "20.6.3.1", "status": "affected" }, { "version": "20.6.4", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.6.5", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.6.5.1", "status": "affected" }, { "version": "20.6.4.1", "status": "affected" }, { "version": "20.6.3.2", "status": "affected" }, { "version": "20.4.2.3", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.6.5.2", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.1.3.1", "status": "affected" }, { "version": "20.6.5.3", "status": "affected" }, { "version": "20.6.3.3", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.6.5.4", "status": "affected" }, { "version": "20.6.4.2", "status": "affected" }, { "version": "20.6.5.5", "status": "affected" }, { "version": "20.6.3.4", "status": "affected" }, { "version": "20.3.8", "status": "affected" }, { "version": "20.6.6", "status": "affected" }, { "version": "20.6.7", "status": "affected" }, { "version": "20.6.8", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [ { "version": "20.1.12", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "20.1.1.1", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "19.0.0", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "18.3.6.1", "status": "affected" }, { "version": "19.0.1a", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.3.1", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.3.1.1", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "18.4.0.1", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "18.4.501_ES", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "20.3.2_925", "status": "affected" }, { "version": "20.3.2.1", "status": "affected" }, { "version": "20.3.2.1_927", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "20.1.2_937", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "20.3.2_928", "status": "affected" }, { "version": "20.3.2_929", "status": "affected" }, { "version": "20.4.1.0.1", "status": "affected" }, { "version": "20.3.2.1_930", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "20.5.0.1.1", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "19.2.4.0.1", "status": "affected" }, { "version": "20.3.2_937", "status": "affected" }, { "version": "20.3.3.1", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.3.3.0.4", "status": "affected" }, { "version": "20.3.3.1.2", "status": "affected" }, { "version": "20.3.3.1.1", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "20.3.3.0.2", "status": "affected" }, { "version": "20.4.1.1.5", "status": "affected" }, { "version": "20.4.1.0.01", "status": "affected" }, { "version": "20.4.1.0.02", "status": "affected" }, { "version": "20.3.3.1.7", "status": "affected" }, { "version": "20.3.3.1.5", "status": "affected" }, { "version": "20.5.1.0.1", "status": "affected" }, { "version": "20.3.3.1.10", "status": "affected" }, { "version": "20.3.3.0.8", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "20.4.2.0.1", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.3.3.0.14", "status": "affected" }, { "version": "19.2.4.0.8", "status": "affected" }, { "version": "19.2.4.0.9", "status": "affected" }, { "version": "20.3.4.0.1", "status": "affected" }, { "version": "20.3.2.0.5", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "20.5.1.0.2", "status": "affected" }, { "version": "20.3.3.0.17", "status": "affected" }, { "version": "20.6.1.1", "status": "affected" }, { "version": "20.6.0.18.3", "status": "affected" }, { "version": "20.3.2.0.6", "status": "affected" }, { "version": "20.6.0.18.4", "status": "affected" }, { "version": "20.4.2.0.2", "status": "affected" }, { "version": "20.3.3.0.16", "status": "affected" }, { "version": "20.3.4.0.5", "status": "affected" }, { "version": "20.6.1.0.1", "status": "affected" }, { "version": "20.3.4.0.6", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "20.7.1EFT2", "status": "affected" }, { "version": "20.3.4.0.9", "status": "affected" }, { "version": "20.3.4.0.11", "status": "affected" }, { "version": "20.4.2.0.4", "status": "affected" }, { "version": "20.3.3.0.18", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.6.2.1", "status": "affected" }, { "version": "20.3.4.1", "status": "affected" }, { "version": "20.5.1.1", "status": "affected" }, { "version": "20.4.2.1", "status": "affected" }, { "version": "20.4.2.1.1", "status": "affected" }, { "version": "20.3.4.1.1", "status": "affected" }, { "version": "20.3.813", "status": "affected" }, { "version": "20.3.4.0.19", "status": "affected" }, { "version": "20.4.2.2.1", "status": "affected" }, { "version": "20.5.1.2", "status": "affected" }, { "version": "20.3.4.2", "status": "affected" }, { "version": "20.3.814", "status": "affected" }, { "version": "20.4.2.2", "status": "affected" }, { "version": "20.6.2.2", "status": "affected" }, { "version": "20.3.4.2.1", "status": "affected" }, { "version": "20.7.1.1", "status": "affected" }, { "version": "20.3.4.1.2", "status": "affected" }, { "version": "20.6.2.2.2", "status": "affected" }, { "version": "20.3.4.0.20", "status": "affected" }, { "version": "20.6.2.2.3", "status": "affected" }, { "version": "20.4.2.2.2", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.6.2.0.4", "status": "affected" }, { "version": "20.4.2.2.3", "status": "affected" }, { "version": "20.3.4.0.24", "status": "affected" }, { "version": "20.6.2.2.7", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "20.3.4.2.2", "status": "affected" }, { "version": "20.4.2.2.4", "status": "affected" }, { "version": "20.7.1.0.2", "status": "affected" }, { "version": "20.3.5.0.8", "status": "affected" }, { "version": "20.3.5.0.9", "status": "affected" }, { "version": "20.3.5.0.7", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.3.4.0.25", "status": "affected" }, { "version": "20.6.2.2.4", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.3.4.0.26", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.3.8", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco SD-WAN vContainer", "versions": [ { "version": "18.4.5", "status": "affected" }, { "version": "20.1.12", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "20.1.2", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco SD-WAN vEdge Cloud", "versions": [ { "version": "19.2.1", "status": "affected" }, { "version": "20.1.12", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "19.0.1a", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "20.7.2", "status": "affected" }, { "version": "20.6.4", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.6.5", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.4.2.3", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.6.4.1", "status": "affected" }, { "version": "20.6.3.2", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.6.5.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.1.3.1", "status": "affected" }, { "version": "20.6.5.3", "status": "affected" }, { "version": "20.6.3.3", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.6.5.4", "status": "affected" }, { "version": "20.3.8", "status": "affected" }, { "version": "20.6.6", "status": "affected" }, { "version": "20.6.7", "status": "affected" }, { "version": "20.6.8", "status": "affected" } ], "defaultStatus": "unknown" }, { "vendor": "Cisco", "product": "Cisco SD-WAN vEdge Router", "versions": [ { "version": "18.4.303", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "20.1.12", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "19.0.0", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "19.1.01", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "20.1.11", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "19.0.1a", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.7.1.2", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "20.7.2", "status": "affected" }, { "version": "20.6.4", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.6.5", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.6.5.1", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.6.4.1", "status": "affected" }, { "version": "20.6.3.2", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.6.5.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.6.5.3", "status": "affected" }, { "version": "20.6.3.3", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.6.5.4", "status": "affected" }, { "version": "20.3.8", "status": "affected" }, { "version": "20.6.6", "status": "affected" }, { "version": "20.6.7", "status": "affected" }, { "version": "20.6.8", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2022-20775", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "fetchedAt": "2026-10-23T02:43:20.800Z", "publishedAt": "2022-09-30T18:45:26.687Z", "modifiedAt": "2026-03-02T13:12:09.231Z", "state": "published", "provider": "cisco", "title": "Cisco SD-WAN Software Privilege Escalation Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.\r\n\r\nThis vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "18.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "19.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "18.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "20.1.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "20.1.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "19.1.0a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "17.3.1ESM1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "17.3.1ESM2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "17.2.1LA", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "17.3.1ESM3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "17.3.2ESM1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "20.3.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "17.3.2ESM2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "20.3.809", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "20.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "20.3.811", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "17.4.2.2527", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "17.4.2ES1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "17.3.2ESM3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "20.6.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "20.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "20.3.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "20.5.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "20.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "20.3.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "20.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "20.6.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "20.5.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "20.7.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "20.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "20.6.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "20.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "20.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "20.6.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "20.6.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "20.6.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "20.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "20.6.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "20.1.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "20.6.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "20.6.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "20.6.5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "20.6.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "20.6.5.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "20.6.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "20.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "20.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "20.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "20.6.8", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/1", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/2", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/3", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/4", "version": "20.1.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/5", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/6", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/7", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/8", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/9", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/10", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/11", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/12", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/13", "version": "19.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/14", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/15", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/16", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/17", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/18", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/19", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/20", "version": "18.3.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/21", "version": "19.0.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/22", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/23", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/24", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/25", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/26", "version": "18.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/27", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/28", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/29", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/30", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/31", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/32", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/33", "version": "18.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/34", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/35", "version": "18.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/36", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/37", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/38", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/39", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/40", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/41", "version": "18.4.501_ES", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/42", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/43", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/44", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/45", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/46", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/47", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/48", "version": "20.3.2_925", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/49", "version": "20.3.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/50", "version": "20.3.2.1_927", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/51", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/52", "version": "20.1.2_937", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/53", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/54", "version": "20.3.2_928", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/55", "version": "20.3.2_929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/56", "version": "20.4.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/57", "version": "20.3.2.1_930", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/58", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/59", "version": "20.5.0.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/60", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/61", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/62", "version": "19.2.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/63", "version": "20.3.2_937", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/64", "version": "20.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/65", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/66", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/67", "version": "20.3.3.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/68", "version": "20.3.3.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/69", "version": "20.3.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/70", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/71", "version": "20.3.3.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/72", "version": "20.4.1.1.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/73", "version": "20.4.1.0.01", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/74", "version": "20.4.1.0.02", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/75", "version": "20.3.3.1.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/76", "version": "20.3.3.1.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/77", "version": "20.5.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/78", "version": "20.3.3.1.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/79", "version": "20.3.3.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/80", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/81", "version": "20.4.2.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/82", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/83", "version": "20.3.3.0.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/84", "version": "19.2.4.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/85", "version": "19.2.4.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/86", "version": "20.3.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/87", "version": "20.3.2.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/88", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/89", "version": "20.5.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/90", "version": "20.3.3.0.17", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/91", "version": "20.6.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/92", "version": "20.6.0.18.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/93", "version": "20.3.2.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/94", "version": "20.6.0.18.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/95", "version": "20.4.2.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/96", "version": "20.3.3.0.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/97", "version": "20.3.4.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/98", "version": "20.6.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/99", "version": "20.3.4.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/100", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/101", "version": "20.7.1EFT2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/102", "version": "20.3.4.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/103", "version": "20.3.4.0.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/104", "version": "20.4.2.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/105", "version": "20.3.3.0.18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/106", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/107", "version": "20.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/108", "version": "20.3.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/109", "version": "20.5.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/110", "version": "20.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/111", "version": "20.4.2.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/112", "version": "20.3.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/113", "version": "20.3.813", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/114", "version": "20.3.4.0.19", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/115", "version": "20.4.2.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/116", "version": "20.5.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/117", "version": "20.3.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/118", "version": "20.3.814", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/119", "version": "20.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/120", "version": "20.6.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/121", "version": "20.3.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/122", "version": "20.7.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/123", "version": "20.3.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/124", "version": "20.6.2.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/125", "version": "20.3.4.0.20", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/126", "version": "20.6.2.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/127", "version": "20.4.2.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/128", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/129", "version": "20.6.2.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/130", "version": "20.4.2.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/131", "version": "20.3.4.0.24", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/132", "version": "20.6.2.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/133", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/134", "version": "20.3.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/135", "version": "20.4.2.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/136", "version": "20.7.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/137", "version": "20.3.5.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/138", "version": "20.3.5.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/139", "version": "20.3.5.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/140", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/141", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/142", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/143", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/144", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/145", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/146", "version": "20.3.4.0.25", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/147", "version": "20.6.2.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/148", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/149", "version": "20.3.4.0.26", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/150", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/1/versions/151", "version": "20.3.8", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco SD-WAN vContainer", "sourcePath": "/containers/cna/affected/2", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/1", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/2", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/3", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/4", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/5", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/6", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/7", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/8", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/9", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/10", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/11", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/12", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/13", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/14", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/15", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/16", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/17", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/18", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/19", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/20", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/21", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/22", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/23", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/24", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/25", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/26", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/27", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/28", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/29", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/30", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/31", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/32", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/33", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/34", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/2/versions/35", "version": "20.1.2", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco SD-WAN vEdge Cloud", "sourcePath": "/containers/cna/affected/3", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/1", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/2", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/3", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/4", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/5", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/6", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/7", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/8", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/9", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/10", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/11", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/12", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/13", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/14", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/15", "version": "19.0.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/16", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/17", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/18", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/19", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/20", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/21", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/22", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/23", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/24", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/25", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/26", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/27", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/28", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/29", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/30", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/31", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/32", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/33", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/34", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/35", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/36", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/37", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/38", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/39", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/40", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/41", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/42", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/43", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/44", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/45", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/46", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/47", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/48", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/49", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/50", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/51", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/52", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/53", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/54", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/55", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/56", "version": "20.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/57", "version": "20.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/58", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/59", "version": "20.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/60", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/61", "version": "20.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/62", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/63", "version": "20.6.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/64", "version": "20.6.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/65", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/66", "version": "20.6.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/67", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/68", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/69", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/70", "version": "20.1.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/71", "version": "20.6.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/72", "version": "20.6.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/73", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/74", "version": "20.6.5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/75", "version": "20.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/76", "version": "20.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/77", "version": "20.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/3/versions/78", "version": "20.6.8", "status": "affected" } ] }, { "vendor": "Cisco", "product": "Cisco SD-WAN vEdge Router", "sourcePath": "/containers/cna/affected/4", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/1", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/2", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/3", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/4", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/5", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/6", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/7", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/8", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/9", "version": "19.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/10", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/11", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/12", "version": "19.1.01", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/13", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/14", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/15", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/16", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/17", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/18", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/19", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/20", "version": "20.1.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/21", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/22", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/23", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/24", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/25", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/26", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/27", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/28", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/29", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/30", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/31", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/32", "version": "19.0.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/33", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/34", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/35", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/36", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/37", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/38", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/39", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/40", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/41", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/42", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/43", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/44", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/45", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/46", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/47", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/48", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/49", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/50", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/51", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/52", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/53", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/54", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/55", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/56", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/57", "version": "20.7.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/58", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/59", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/60", "version": "20.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/61", "version": "20.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/62", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/63", "version": "20.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/64", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/65", "version": "20.6.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/66", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/67", "version": "20.6.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/68", "version": "20.6.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/69", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/70", "version": "20.6.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/71", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/72", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/73", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/74", "version": "20.6.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/75", "version": "20.6.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/76", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/77", "version": "20.6.5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/78", "version": "20.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/79", "version": "20.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/80", "version": "20.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/4/versions/81", "version": "20.6.8", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "In February 2026, the Cisco PSIRT became aware of attempted exploitation of the vulnerability described in CVE-2022-20775. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-25", "lang": "en", "description": "Path Traversal: '/../filedir'", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "label": "cisco-sa-sd-wan-priv-E6e8tEdF", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-wmjv-552v-pxjc", "label": "CVE", "tags": [ "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-20775", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN\",\"versions\":[{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"20.1.11\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.1.0a\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM1\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM2\",\"status\":\"affected\"},{\"version\":\"17.2.1LA\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM3\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM2\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.809\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.811\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"17.4.2.2527\",\"status\":\"affected\"},{\"version\":\"17.4.2ES1\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM3\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"20.3.2_925\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_927\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.1.2_937\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_928\",\"status\":\"affected\"},{\"version\":\"20.3.2_929\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_930\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.5.0.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_937\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.4.1.1.5\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.01\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.02\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.7\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.5\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.10\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.14\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.8\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.3\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.11\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.813\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.814\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.20\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.7\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.7.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.7\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.26\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vContainer\",\"versions\":[{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vEdge Cloud\",\"versions\":[{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vEdge Router\",\"versions\":[{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"19.1.01\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"20.1.11\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.\r\n\r\nThis vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "In February 2026, the Cisco PSIRT became aware of attempted exploitation of the vulnerability described in CVE-2022-20775. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Path Traversal: '/../filedir'\",\"type\":\"cwe\",\"cweId\":\"CWE-25\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-02T13:12:09.231Z", "fetchedAt": "2026-10-23T02:43:20.800Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-25T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "sourceSummary": "Cisco Catalyst SD-WAN / Cisco Catalyst SD-WAN Manager / Cisco SD-WAN vContainer / Cisco SD-WAN vEdge Cloud / Cisco SD-WAN vEdge Routerに権限の奪取に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "本来与えられていない権限で、操作される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:44.941Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "848b16e8fb9af9a382a89ec3d77edbeddb3914e0dcdc7a0b9cecd9f6d2ce715c", "sourceModifiedAt": "2026-03-02T13:12:09.231Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco SD-WAN ソフトウェアの CLI において、認証済みのローカル攻撃者が細工したコマンドを実行すると、権限が昇格し、root ユーザーとして任意のコマンドを実行できる可能性があります。", "risk": "攻撃者が root 権限で任意のコマンドを実行できる。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "認証済みのローカルユーザーが Cisco SD-WAN ソフトウェアのコマンドラインインタフェース (CLI) にアクセスできる場合に発生します。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "CLI 内のコマンドに対するアクセス制御が不適切であることが原因です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Catalyst SD-WAN が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Cisco Catalyst SD-WAN Manager が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Cisco SD-WAN vContainer が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Cisco SD-WAN vEdge Cloud が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "Cisco SD-WAN vEdge Router が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Catalyst SD-WAN。影響ありとして記載：18.3.1。影響ありとして記載：19.2.1。影響ありとして記載：17.2.4。影響ありとして記載：19.3.0。影響ありとして記載：18.3.0。影響ありとして記載：18.3.4。影響ありとして記載：18.4.303。影響ありとして記載：18.4.0.1。影響ありとして記載：17.2.9。影響ありとして記載：18.3.7。影響ありとして記載：18.2.0。影響ありとして記載：17.2.10。影響ありとして記載：18.4.5。影響ありとして記載：18.4.0。影響ありとして記載：17.2.5。影響ありとして記載：18.3.8。影響ありとして記載：18.4.4。影響ありとして記載：18.4.302。影響ありとして記載：17.2.7。影響ありとして記載：19.2.098。影響ありとして記載：20.1.1。影響ありとして記載：19.2.099。影響ありとして記載：18.3.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.5。影響ありとして記載：19.0.0。影響ありとして記載：18.4.3。影響ありとして記載：19.1.0。影響ありとして記載：17.2.6。影響ありとして記載：18.3.3.1。影響ありとして記載：19.2.097。影響ありとして記載：20.1.1.1。影響ありとして記載：18.3.6。影響ありとして記載：19.2.0。影響ありとして記載：19.2.2。影響ありとして記載：20.1.11。影響ありとして記載：20.1.12。影響ありとして記載：19.1.0a。影響ありとして記載：19.2.3。影響ありとして記載：17.3.1ESM1。影響ありとして記載：20.3.1。影響ありとして記載：17.3.1ESM2。影響ありとして記載：17.2.1LA。影響ありとして記載：20.1.2。影響ありとして記載：17.3.1ESM3。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：17.3.2ESM1。影響ありとして記載：20.3.2.1。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：17.3.2ESM2。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.3.809。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.3.811。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：17.4.2.2527。影響ありとして記載：17.4.2ES1。影響ありとして記載：17.3.2ESM3。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.2。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.5.1.2。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.3.1。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.6.5.1。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.4.2.3。影響ありとして記載：20.6.1.2。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.3.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.5.1。影響ありとして記載：20.1.3.1。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.6.4.2。影響ありとして記載：20.6.5.5。影響ありとして記載：20.6.3.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.3.0。影響ありとして記載：19.2.2。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：18.3.8。影響ありとして記載：19.0.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.302。影響ありとして記載：18.4.303。影響ありとして記載：19.2.097。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.6.1。影響ありとして記載：19.0.1a。影響ありとして記載：18.2.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：17.2.5。影響ありとして記載：18.3.1.1。影響ありとして記載：18.3.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.4。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：20.3.2_925。影響ありとして記載：20.3.2.1。影響ありとして記載：20.3.2.1_927。影響ありとして記載：18.4.6。影響ありとして記載：20.1.2_937。影響ありとして記載：20.4.1。影響ありとして記載：20.3.2_928。影響ありとして記載：20.3.2_929。影響ありとして記載：20.4.1.0.1。影響ありとして記載：20.3.2.1_930。影響ありとして記載：19.2.4。影響ありとして記載：20.5.0.1.1。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：19.2.4.0.1。影響ありとして記載：20.3.2_937。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.3.3.0.4。影響ありとして記載：20.3.3.1.2。影響ありとして記載：20.3.3.1.1。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.3.0.2。影響ありとして記載：20.4.1.1.5。影響ありとして記載：20.4.1.0.01。影響ありとして記載：20.4.1.0.02。影響ありとして記載：20.3.3.1.7。影響ありとして記載：20.3.3.1.5。影響ありとして記載：20.5.1.0.1。影響ありとして記載：20.3.3.1.10。影響ありとして記載：20.3.3.0.8。影響ありとして記載：20.4.2。影響ありとして記載：20.4.2.0.1。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3.0.14。影響ありとして記載：19.2.4.0.8。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.3.4.0.1。影響ありとして記載：20.3.2.0.5。影響ありとして記載：20.6.1。影響ありとして記載：20.5.1.0.2。影響ありとして記載：20.3.3.0.17。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.0.18.3。影響ありとして記載：20.3.2.0.6。影響ありとして記載：20.6.0.18.4。影響ありとして記載：20.4.2.0.2。影響ありとして記載：20.3.3.0.16。影響ありとして記載：20.3.4.0.5。影響ありとして記載：20.6.1.0.1。影響ありとして記載：20.3.4.0.6。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1EFT2。影響ありとして記載：20.3.4.0.9。影響ありとして記載：20.3.4.0.11。影響ありとして記載：20.4.2.0.4。影響ありとして記載：20.3.3.0.18。影響ありとして記載：20.7.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.4.2.1.1。影響ありとして記載：20.3.4.1.1。影響ありとして記載：20.3.813。影響ありとして記載：20.3.4.0.19。影響ありとして記載：20.4.2.2.1。影響ありとして記載：20.5.1.2。影響ありとして記載：20.3.4.2。影響ありとして記載：20.3.814。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.3.4.2.1。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.4.1.2。影響ありとして記載：20.6.2.2.2。影響ありとして記載：20.3.4.0.20。影響ありとして記載：20.6.2.2.3。影響ありとして記載：20.4.2.2.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.2.0.4。影響ありとして記載：20.4.2.2.3。影響ありとして記載：20.3.4.0.24。影響ありとして記載：20.6.2.2.7。影響ありとして記載：20.6.3。影響ありとして記載：20.3.4.2.2。影響ありとして記載：20.4.2.2.4。影響ありとして記載：20.7.1.0.2。影響ありとして記載：20.3.5.0.8。影響ありとして記載：20.3.5.0.9。影響ありとして記載：20.3.5.0.7。影響ありとして記載：20.3.6。影響ありとして記載：20.3.7。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.3.3.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.4.0.25。影響ありとして記載：20.6.2.2.4。影響ありとして記載：20.6.1.2。影響ありとして記載：20.3.4.0.26。影響ありとして記載：20.3.7.2。影響ありとして記載：20.3.8。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Cisco / Cisco SD-WAN vContainer。影響ありとして記載：18.4.5。影響ありとして記載：20.1.12。影響ありとして記載：18.3.6。影響ありとして記載：19.2.1。影響ありとして記載：19.3.0。影響ありとして記載：20.1.1。影響ありとして記載：19.2.2。影響ありとして記載：18.3.8。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：18.4.302。影響ありとして記載：19.1.0。影響ありとして記載：18.4.303。影響ありとして記載：19.2.0。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.7。影響ありとして記載：18.3.1。影響ありとして記載：19.2.099。影響ありとして記載：19.2.097。影響ありとして記載：18.3.4。影響ありとして記載：18.2.0。影響ありとして記載：18.3.5。影響ありとして記載：18.4.1。影響ありとして記載：17.2.5。影響ありとして記載：17.2.7。影響ありとして記載：17.2.8。影響ありとして記載：17.2.9。影響ありとして記載：18.4.0。影響ありとして記載：17.2.6。影響ありとして記載：18.3.0。影響ありとして記載：17.2.4。影響ありとして記載：18.3.3。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Cisco / Cisco SD-WAN vEdge Cloud。影響ありとして記載：19.2.1。影響ありとして記載：20.1.12。影響ありとして記載：18.4.4。影響ありとして記載：19.3.0。影響ありとして記載：18.3.8。影響ありとして記載：19.2.2。影響ありとして記載：20.1.1。影響ありとして記載：18.3.6。影響ありとして記載：18.4.3。影響ありとして記載：18.4.302。影響ありとして記載：18.4.5。影響ありとして記載：18.4.303。影響ありとして記載：19.2.098。影響ありとして記載：19.1.0。影響ありとして記載：17.2.10。影響ありとして記載：19.0.1a。影響ありとして記載：19.2.099。影響ありとして記載：18.3.7。影響ありとして記載：19.2.097。影響ありとして記載：18.3.1。影響ありとして記載：19.2.0。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：18.2.0。影響ありとして記載：18.4.1。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0。影響ありとして記載：18.3.5。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.6。影響ありとして記載：17.2.8。影響ありとして記載：18.3.0。影響ありとして記載：17.2.4。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.4.2.3。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.3.5.1。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.1.2。影響ありとして記載：20.1.3.1。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Cisco / Cisco SD-WAN vEdge Router。影響ありとして記載：18.4.303。影響ありとして記載：18.3.7。影響ありとして記載：19.3.0。影響ありとして記載：18.2.0。影響ありとして記載：20.1.12。影響ありとして記載：19.2.099。影響ありとして記載：17.2.10。影響ありとして記載：18.3.3。影響ありとして記載：18.3.6。影響ありとして記載：19.0.0。影響ありとして記載：17.2.6。影響ありとして記載：18.4.0。影響ありとして記載：19.1.01。影響ありとして記載：19.2.098。影響ありとして記載：18.3.1。影響ありとして記載：18.4.302。影響ありとして記載：19.2.2。影響ありとして記載：18.3.5。影響ありとして記載：17.2.9。影響ありとして記載：19.1.0。影響ありとして記載：20.1.11。影響ありとして記載：19.2.097。影響ありとして記載：18.4.5。影響ありとして記載：17.2.5。影響ありとして記載：17.2.8。影響ありとして記載：18.3.8。影響ありとして記載：18.3.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：19.2.1。影響ありとして記載：17.2.4。影響ありとして記載：18.3.4。影響ありとして記載：19.0.1a。影響ありとして記載：20.1.1。影響ありとして記載：17.2.7。影響ありとして記載：18.4.1。影響ありとして記載：19.2.0。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.7.1.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.6.5.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.5.1。影響ありとして記載：20.6.1.2。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Catalyst SD-WAN / Cisco Catalyst SD-WAN Manager / Cisco SD-WAN vContainer / Cisco SD-WAN vEdge Cloud / Cisco SD-WAN vEdge Router」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-20775", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-20775" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2022-20775", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-20775" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2022-20775", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-20775" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-20775", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "label": "cisco-sa-sd-wan-priv-E6e8tEdF" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20775", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges.\r\n\r\nThis vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco SD-WAN Software Privilege Escalation Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN\",\"versions\":[{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"20.1.11\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.1.0a\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM1\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM2\",\"status\":\"affected\"},{\"version\":\"17.2.1LA\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"17.3.1ESM3\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM2\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.809\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.811\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"17.4.2.2527\",\"status\":\"affected\"},{\"version\":\"17.4.2ES1\",\"status\":\"affected\"},{\"version\":\"17.3.2ESM3\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"20.3.2_925\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_927\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.1.2_937\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_928\",\"status\":\"affected\"},{\"version\":\"20.3.2_929\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_930\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.5.0.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_937\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.4.1.1.5\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.01\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.02\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.7\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.5\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.10\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.14\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.8\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.3\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.11\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.813\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.814\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.20\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.7\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.7.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.7\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.26\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vContainer\",\"versions\":[{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vEdge Cloud\",\"versions\":[{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/20xxx/CVE-2022-20775.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco SD-WAN vEdge Router\",\"versions\":[{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"19.1.01\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"20.1.11\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-20775", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2022-20775\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2022-20775（Cisco Catalyst SD-WAN / Cisco Catalyst SD-WAN Manager / Cisco SD-WAN vContainer / Cisco SD-WAN vEdge Cloud / Cisco SD-WAN vEdge Router）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・認証済みのローカルユーザーが Cisco SD-WAN ソフトウェアのコマンドラインインタフェース (CLI) にアクセスできる場合に発生します。\n・CLI 内のコマンドに対するアクセス制御が不適切であることが原因です。\n・Cisco Catalyst SD-WAN が影響を受けます。\n・Cisco Catalyst SD-WAN Manager が影響を受けます。\n・Cisco SD-WAN vContainer が影響を受けます。\n・Cisco SD-WAN vEdge Cloud が影響を受けます。\n・Cisco SD-WAN vEdge Router が影響を受けます。\n・公式の対象表：Cisco / Cisco Catalyst SD-WAN。影響ありとして記載：18.3.1。影響ありとして記載：19.2.1。影響ありとして記載：17.2.4。影響ありとして記載：19.3.0。影響ありとして記載：18.3.0。影響ありとして記載：18.3.4。影響ありとして記載：18.4.303。影響ありとして記載：18.4.0.1。影響ありとして記載：17.2.9。影響ありとして記載：18.3.7。影響ありとして記載：18.2.0。影響ありとして記載：17.2.10。影響ありとして記載：18.4.5。影響ありとして記載：18.4.0。影響ありとして記載：17.2.5。影響ありとして記載：18.3.8。影響ありとして記載：18.4.4。影響ありとして記載：18.4.302。影響ありとして記載：17.2.7。影響ありとして記載：19.2.098。影響ありとして記載：20.1.1。影響ありとして記載：19.2.099。影響ありとして記載：18.3.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.5。影響ありとして記載：19.0.0。影響ありとして記載：18.4.3。影響ありとして記載：19.1.0。影響ありとして記載：17.2.6。影響ありとして記載：18.3.3.1。影響ありとして記載：19.2.097。影響ありとして記載：20.1.1.1。影響ありとして記載：18.3.6。影響ありとして記載：19.2.0。影響ありとして記載：19.2.2。影響ありとして記載：20.1.11。影響ありとして記載：20.1.12。影響ありとして記載：19.1.0a。影響ありとして記載：19.2.3。影響ありとして記載：17.3.1ESM1。影響ありとして記載：20.3.1。影響ありとして記載：17.3.1ESM2。影響ありとして記載：17.2.1LA。影響ありとして記載：20.1.2。影響ありとして記載：17.3.1ESM3。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：17.3.2ESM1。影響ありとして記載：20.3.2.1。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：17.3.2ESM2。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.3.809。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.3.811。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：17.4.2.2527。影響ありとして記載：17.4.2ES1。影響ありとして記載：17.3.2ESM3。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.2。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.5.1.2。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.3.1。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.6.5.1。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.4.2.3。影響ありとして記載：20.6.1.2。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.3.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.5.1。影響ありとして記載：20.1.3.1。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.6.4.2。影響ありとして記載：20.6.5.5。影響ありとして記載：20.6.3.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.3.0。影響ありとして記載：19.2.2。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：18.3.8。影響ありとして記載：19.0.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.302。影響ありとして記載：18.4.303。影響ありとして記載：19.2.097。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.6.1。影響ありとして記載：19.0.1a。影響ありとして記載：18.2.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：17.2.5。影響ありとして記載：18.3.1.1。影響ありとして記載：18.3.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.4。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：20.3.2_925。影響ありとして記載：20.3.2.1。影響ありとして記載：20.3.2.1_927。影響ありとして記載：18.4.6。影響ありとして記載：20.1.2_937。影響ありとして記載：20.4.1。影響ありとして記載：20.3.2_928。影響ありとして記載：20.3.2_929。影響ありとして記載：20.4.1.0.1。影響ありとして記載：20.3.2.1_930。影響ありとして記載：19.2.4。影響ありとして記載：20.5.0.1.1。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：19.2.4.0.1。影響ありとして記載：20.3.2_937。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.3.3.0.4。影響ありとして記載：20.3.3.1.2。影響ありとして記載：20.3.3.1.1。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.3.0.2。影響ありとして記載：20.4.1.1.5。影響ありとして記載：20.4.1.0.01。影響ありとして記載：20.4.1.0.02。影響ありとして記載：20.3.3.1.7。影響ありとして記載：20.3.3.1.5。影響ありとして記載：20.5.1.0.1。影響ありとして記載：20.3.3.1.10。影響ありとして記載：20.3.3.0.8。影響ありとして記載：20.4.2。影響ありとして記載：20.4.2.0.1。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3.0.14。影響ありとして記載：19.2.4.0.8。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.3.4.0.1。影響ありとして記載：20.3.2.0.5。影響ありとして記載：20.6.1。影響ありとして記載：20.5.1.0.2。影響ありとして記載：20.3.3.0.17。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.0.18.3。影響ありとして記載：20.3.2.0.6。影響ありとして記載：20.6.0.18.4。影響ありとして記載：20.4.2.0.2。影響ありとして記載：20.3.3.0.16。影響ありとして記載：20.3.4.0.5。影響ありとして記載：20.6.1.0.1。影響ありとして記載：20.3.4.0.6。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1EFT2。影響ありとして記載：20.3.4.0.9。影響ありとして記載：20.3.4.0.11。影響ありとして記載：20.4.2.0.4。影響ありとして記載：20.3.3.0.18。影響ありとして記載：20.7.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.4.2.1.1。影響ありとして記載：20.3.4.1.1。影響ありとして記載：20.3.813。影響ありとして記載：20.3.4.0.19。影響ありとして記載：20.4.2.2.1。影響ありとして記載：20.5.1.2。影響ありとして記載：20.3.4.2。影響ありとして記載：20.3.814。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.3.4.2.1。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.4.1.2。影響ありとして記載：20.6.2.2.2。影響ありとして記載：20.3.4.0.20。影響ありとして記載：20.6.2.2.3。影響ありとして記載：20.4.2.2.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.2.0.4。影響ありとして記載：20.4.2.2.3。影響ありとして記載：20.3.4.0.24。影響ありとして記載：20.6.2.2.7。影響ありとして記載：20.6.3。影響ありとして記載：20.3.4.2.2。影響ありとして記載：20.4.2.2.4。影響ありとして記載：20.7.1.0.2。影響ありとして記載：20.3.5.0.8。影響ありとして記載：20.3.5.0.9。影響ありとして記載：20.3.5.0.7。影響ありとして記載：20.3.6。影響ありとして記載：20.3.7。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.3.3.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.4.0.25。影響ありとして記載：20.6.2.2.4。影響ありとして記載：20.6.1.2。影響ありとして記載：20.3.4.0.26。影響ありとして記載：20.3.7.2。影響ありとして記載：20.3.8。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco SD-WAN vContainer。影響ありとして記載：18.4.5。影響ありとして記載：20.1.12。影響ありとして記載：18.3.6。影響ありとして記載：19.2.1。影響ありとして記載：19.3.0。影響ありとして記載：20.1.1。影響ありとして記載：19.2.2。影響ありとして記載：18.3.8。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：18.4.302。影響ありとして記載：19.1.0。影響ありとして記載：18.4.303。影響ありとして記載：19.2.0。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.7。影響ありとして記載：18.3.1。影響ありとして記載：19.2.099。影響ありとして記載：19.2.097。影響ありとして記載：18.3.4。影響ありとして記載：18.2.0。影響ありとして記載：18.3.5。影響ありとして記載：18.4.1。影響ありとして記載：17.2.5。影響ありとして記載：17.2.7。影響ありとして記載：17.2.8。影響ありとして記載：17.2.9。影響ありとして記載：18.4.0。影響ありとして記載：17.2.6。影響ありとして記載：18.3.0。影響ありとして記載：17.2.4。影響ありとして記載：18.3.3。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco SD-WAN vEdge Cloud。影響ありとして記載：19.2.1。影響ありとして記載：20.1.12。影響ありとして記載：18.4.4。影響ありとして記載：19.3.0。影響ありとして記載：18.3.8。影響ありとして記載：19.2.2。影響ありとして記載：20.1.1。影響ありとして記載：18.3.6。影響ありとして記載：18.4.3。影響ありとして記載：18.4.302。影響ありとして記載：18.4.5。影響ありとして記載：18.4.303。影響ありとして記載：19.2.098。影響ありとして記載：19.1.0。影響ありとして記載：17.2.10。影響ありとして記載：19.0.1a。影響ありとして記載：19.2.099。影響ありとして記載：18.3.7。影響ありとして記載：19.2.097。影響ありとして記載：18.3.1。影響ありとして記載：19.2.0。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：18.2.0。影響ありとして記載：18.4.1。影響ありとして記載：17.2.5。影響ありとして記載：18.4.0。影響ありとして記載：18.3.5。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.6。影響ありとして記載：17.2.8。影響ありとして記載：18.3.0。影響ありとして記載：17.2.4。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.4.2.3。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.3.5.1。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.1.2。影響ありとして記載：20.1.3.1。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。\n・公式の対象表：Cisco / Cisco SD-WAN vEdge Router。影響ありとして記載：18.4.303。影響ありとして記載：18.3.7。影響ありとして記載：19.3.0。影響ありとして記載：18.2.0。影響ありとして記載：20.1.12。影響ありとして記載：19.2.099。影響ありとして記載：17.2.10。影響ありとして記載：18.3.3。影響ありとして記載：18.3.6。影響ありとして記載：19.0.0。影響ありとして記載：17.2.6。影響ありとして記載：18.4.0。影響ありとして記載：19.1.01。影響ありとして記載：19.2.098。影響ありとして記載：18.3.1。影響ありとして記載：18.4.302。影響ありとして記載：19.2.2。影響ありとして記載：18.3.5。影響ありとして記載：17.2.9。影響ありとして記載：19.1.0。影響ありとして記載：20.1.11。影響ありとして記載：19.2.097。影響ありとして記載：18.4.5。影響ありとして記載：17.2.5。影響ありとして記載：17.2.8。影響ありとして記載：18.3.8。影響ありとして記載：18.3.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.4。影響ありとして記載：19.2.1。影響ありとして記載：17.2.4。影響ありとして記載：18.3.4。影響ありとして記載：19.0.1a。影響ありとして記載：20.1.1。影響ありとして記載：17.2.7。影響ありとして記載：18.4.1。影響ありとして記載：19.2.0。影響ありとして記載：19.2.3。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：18.4.6。影響ありとして記載：20.4.1。影響ありとして記載：19.2.4。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.4.1.2。影響ありとして記載：20.4.2。影響ありとして記載：20.3.4。影響ありとして記載：20.6.1。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1。影響ありとして記載：20.7.1.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.3。影響ありとして記載：20.7.2。影響ありとして記載：20.6.4。影響ありとして記載：20.3.6。影響ありとして記載：20.6.5。影響ありとして記載：20.3.7。影響ありとして記載：20.6.5.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.2。影響ありとして記載：20.3.4.3。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.3.5.1。影響ありとして記載：20.6.1.2。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.6.7。影響ありとして記載：20.6.8。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2022-20775", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:44.941Z", "lastSuccess": "2026-10-23T03:24:44.941Z", "sourceCheckedAt": "2026-10-23T02:43:20.800Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20127", "aliases": [], "title": "Cisco Catalyst SD-WAN Manager：認証の回避", "summary": "Cisco Catalyst SD‑WAN Controller（旧 SD‑WAN vSmart）、Cisco Catalyst SD‑WAN Manager（旧 SD‑WAN vManage）、Cisco Catalyst SD‑WAN Validator（旧 SD‑WAN vBond）のピアリング認証機構に不具合があり、認証をバイパスして管理者権限を取得できる脆弱性が存在します。攻撃者は細工したリクエストを送信することで、認証されていない状態で内部の高権限ユーザーとしてログインし、NETCONF を介して SD‑WAN ファブリックのネットワーク設定を操作できる可能性があります。", "risk": "認証バイパスに成功すると、攻撃者は管理者権限でシステムにログインし、SD‑WAN のネットワーク設定を改ざんできる可能性があります。", "product": "Cisco Catalyst SD-WAN Manager", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "cisco", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.12" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.3.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.099" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.0.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.1.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.302" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.303" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.097" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.098" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.6.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.0.1a" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.2.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "17.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.3.0" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.501_ES" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.929" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.31" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.32" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_925" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1_927" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "18.4.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.2_937" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_928" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_929" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.1_930" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.0.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2_937" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.1.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.01" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.1.0.02" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.1.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.14" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "19.2.4.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.17" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.0.18.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.2.0.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.0.18.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.16" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1EFT2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.11" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.0.18" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.813" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.19" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.5.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.814" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.20" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.24" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.1.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.8.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.2.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.0.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.7.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.1EFT2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.11" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.14" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.19" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.18" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.23" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.25" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.27" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.29" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.31" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.32" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.10.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.33" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2.0.01" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.10.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.11.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.11.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3_LI_ Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.4.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.38" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.39" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.10.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.25" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.2.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.11.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.4.0.26" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.40" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.1.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.41" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4.0.19" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.7.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.12" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.11.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.10.1.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.9" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.16" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.45" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.10" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.17" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.2.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.4.0.21" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.18" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.46" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.47" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.2.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.21" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.20" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.11" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.13" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.23" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.2.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.25" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.24" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.5.1.14" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.3.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.26" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.3.0.51" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.3.0.29" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.6.0.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.13.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.13.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.1.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.3_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.1.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.4.1.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.14.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.14.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.1.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.13" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.6_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.14" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.6.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4.0.03" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.16.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.16.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.16" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4.0.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.401" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.3_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.5.2.21" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.6.0.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4.0.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.4_Monthly_ES5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.7_LI _Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.7" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.3" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.3_ LI _Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.501" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5.2_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.3.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.4_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.4" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.7.1_LI _Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.7.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.18.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.18.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.6_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.6" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.12.5.1.01" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.8" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.9.8_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.18.2" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.4.1_LI_Images" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.15.4.1" }, { "product": "Cisco Catalyst SD-WAN Manager", "range": "20.18.2_LI_Images" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20127", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20127", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-25T16:14:20.137Z", "modifiedAt": "2026-06-16T17:57:59.054Z", "fetchedAt": "2026-10-23T02:43:47.244Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. ", "sourceTitle": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "versions": [ { "version": "20.1.12", "status": "affected" }, { "version": "19.2.1", "status": "affected" }, { "version": "18.4.4", "status": "affected" }, { "version": "18.4.5", "status": "affected" }, { "version": "20.1.1.1", "status": "affected" }, { "version": "20.1.1", "status": "affected" }, { "version": "19.3.0", "status": "affected" }, { "version": "19.2.2", "status": "affected" }, { "version": "19.2.099", "status": "affected" }, { "version": "18.3.6", "status": "affected" }, { "version": "18.3.7", "status": "affected" }, { "version": "19.2.0", "status": "affected" }, { "version": "18.3.8", "status": "affected" }, { "version": "19.0.0", "status": "affected" }, { "version": "19.1.0", "status": "affected" }, { "version": "18.4.302", "status": "affected" }, { "version": "18.4.303", "status": "affected" }, { "version": "19.2.097", "status": "affected" }, { "version": "19.2.098", "status": "affected" }, { "version": "17.2.10", "status": "affected" }, { "version": "18.3.6.1", "status": "affected" }, { "version": "19.0.1a", "status": "affected" }, { "version": "18.2.0", "status": "affected" }, { "version": "18.4.3", "status": "affected" }, { "version": "18.4.1", "status": "affected" }, { "version": "17.2.8", "status": "affected" }, { "version": "18.3.3.1", "status": "affected" }, { "version": "18.4.0", "status": "affected" }, { "version": "18.3.1", "status": "affected" }, { "version": "17.2.6", "status": "affected" }, { "version": "17.2.9", "status": "affected" }, { "version": "18.3.4", "status": "affected" }, { "version": "17.2.5", "status": "affected" }, { "version": "18.3.1.1", "status": "affected" }, { "version": "18.3.5", "status": "affected" }, { "version": "18.4.0.1", "status": "affected" }, { "version": "18.3.3", "status": "affected" }, { "version": "17.2.7", "status": "affected" }, { "version": "17.2.4", "status": "affected" }, { "version": "18.3.0", "status": "affected" }, { "version": "19.2.3", "status": "affected" }, { "version": "18.4.501_ES", "status": "affected" }, { "version": "20.3.1", "status": "affected" }, { "version": "20.1.2", "status": "affected" }, { "version": "19.2.929", "status": "affected" }, { "version": "19.2.31", "status": "affected" }, { "version": "20.3.2", "status": "affected" }, { "version": "19.2.32", "status": "affected" }, { "version": "20.3.2_925", "status": "affected" }, { "version": "20.3.2.1", "status": "affected" }, { "version": "20.3.2.1_927", "status": "affected" }, { "version": "18.4.6", "status": "affected" }, { "version": "20.1.2_937", "status": "affected" }, { "version": "20.4.1", "status": "affected" }, { "version": "20.3.2_928", "status": "affected" }, { "version": "20.3.2_929", "status": "affected" }, { "version": "20.4.1.0.1", "status": "affected" }, { "version": "20.3.2.1_930", "status": "affected" }, { "version": "19.2.4", "status": "affected" }, { "version": "20.5.0.1.1", "status": "affected" }, { "version": "20.4.1.1", "status": "affected" }, { "version": "20.3.3", "status": "affected" }, { "version": "19.2.4.0.1", "status": "affected" }, { "version": "20.3.2_937", "status": "affected" }, { "version": "20.3.3.1", "status": "affected" }, { "version": "20.5.1", "status": "affected" }, { "version": "20.1.3", "status": "affected" }, { "version": "20.3.3.0.4", "status": "affected" }, { "version": "20.3.3.1.2", "status": "affected" }, { "version": "20.3.3.1.1", "status": "affected" }, { "version": "20.4.1.2", "status": "affected" }, { "version": "20.3.3.0.2", "status": "affected" }, { "version": "20.4.1.1.5", "status": "affected" }, { "version": "20.4.1.0.01", "status": "affected" }, { "version": "20.4.1.0.02", "status": "affected" }, { "version": "20.3.3.1.7", "status": "affected" }, { "version": "20.3.3.1.5", "status": "affected" }, { "version": "20.5.1.0.1", "status": "affected" }, { "version": "20.3.3.1.10", "status": "affected" }, { "version": "20.3.3.0.8", "status": "affected" }, { "version": "20.4.2", "status": "affected" }, { "version": "20.4.2.0.1", "status": "affected" }, { "version": "20.3.4", "status": "affected" }, { "version": "20.3.3.0.14", "status": "affected" }, { "version": "19.2.4.0.8", "status": "affected" }, { "version": "19.2.4.0.9", "status": "affected" }, { "version": "20.3.4.0.1", "status": "affected" }, { "version": "20.3.2.0.5", "status": "affected" }, { "version": "20.6.1", "status": "affected" }, { "version": "20.5.1.0.2", "status": "affected" }, { "version": "20.3.3.0.17", "status": "affected" }, { "version": "20.6.1.1", "status": "affected" }, { "version": "20.6.0.18.3", "status": "affected" }, { "version": "20.3.2.0.6", "status": "affected" }, { "version": "20.6.0.18.4", "status": "affected" }, { "version": "20.4.2.0.2", "status": "affected" }, { "version": "20.3.3.0.16", "status": "affected" }, { "version": "20.3.4.0.5", "status": "affected" }, { "version": "20.6.1.0.1", "status": "affected" }, { "version": "20.3.4.0.6", "status": "affected" }, { "version": "20.6.2", "status": "affected" }, { "version": "20.7.1EFT2", "status": "affected" }, { "version": "20.3.4.0.9", "status": "affected" }, { "version": "20.3.4.0.11", "status": "affected" }, { "version": "20.4.2.0.4", "status": "affected" }, { "version": "20.3.3.0.18", "status": "affected" }, { "version": "20.7.1", "status": "affected" }, { "version": "20.6.2.1", "status": "affected" }, { "version": "20.3.4.1", "status": "affected" }, { "version": "20.5.1.1", "status": "affected" }, { "version": "20.4.2.1", "status": "affected" }, { "version": "20.4.2.1.1", "status": "affected" }, { "version": "20.3.4.1.1", "status": "affected" }, { "version": "20.3.813", "status": "affected" }, { "version": "20.3.4.0.19", "status": "affected" }, { "version": "20.4.2.2.1", "status": "affected" }, { "version": "20.5.1.2", "status": "affected" }, { "version": "20.3.4.2", "status": "affected" }, { "version": "20.3.814", "status": "affected" }, { "version": "20.4.2.2", "status": "affected" }, { "version": "20.6.2.2", "status": "affected" }, { "version": "20.3.4.2.1", "status": "affected" }, { "version": "20.7.1.1", "status": "affected" }, { "version": "20.3.4.1.2", "status": "affected" }, { "version": "20.6.2.2.2", "status": "affected" }, { "version": "20.3.4.0.20", "status": "affected" }, { "version": "20.6.2.2.3", "status": "affected" }, { "version": "20.4.2.2.2", "status": "affected" }, { "version": "20.3.5", "status": "affected" }, { "version": "20.6.2.0.4", "status": "affected" }, { "version": "20.4.2.2.3", "status": "affected" }, { "version": "20.3.4.0.24", "status": "affected" }, { "version": "20.6.2.2.7", "status": "affected" }, { "version": "20.6.3", "status": "affected" }, { "version": "20.3.4.2.2", "status": "affected" }, { "version": "20.4.2.2.4", "status": "affected" }, { "version": "20.7.1.0.2", "status": "affected" }, { "version": "20.8.1", "status": "affected" }, { "version": "20.3.5.0.8", "status": "affected" }, { "version": "20.3.5.0.9", "status": "affected" }, { "version": "20.4.2.2.8", "status": "affected" }, { "version": "20.3.5.0.7", "status": "affected" }, { "version": "20.6.3.0.7", "status": "affected" }, { "version": "20.6.3.0.5", "status": "affected" }, { "version": "20.6.3.0.10", "status": "affected" }, { "version": "20.6.3.0.2", "status": "affected" }, { "version": "20.7.2", "status": "affected" }, { "version": "20.9.1EFT2", "status": "affected" }, { "version": "20.6.3.0.11", "status": "affected" }, { "version": "20.6.3.1", "status": "affected" }, { "version": "20.6.3.0.14", "status": "affected" }, { "version": "20.6.4", "status": "affected" }, { "version": "20.9.1", "status": "affected" }, { "version": "20.6.3.0.19", "status": "affected" }, { "version": "20.6.3.0.18", "status": "affected" }, { "version": "20.3.6", "status": "affected" }, { "version": "20.9.1.1", "status": "affected" }, { "version": "20.6.3.0.23", "status": "affected" }, { "version": "20.6.4.0.4", "status": "affected" }, { "version": "20.6.3.0.25", "status": "affected" }, { "version": "20.6.5", "status": "affected" }, { "version": "20.6.3.0.27", "status": "affected" }, { "version": "20.9.2", "status": "affected" }, { "version": "20.9.2.1", "status": "affected" }, { "version": "20.6.3.0.29", "status": "affected" }, { "version": "20.6.3.0.31", "status": "affected" }, { "version": "20.6.3.0.32", "status": "affected" }, { "version": "20.10.1", "status": "affected" }, { "version": "20.6.3.0.33", "status": "affected" }, { "version": "20.9.2.0.01", "status": "affected" }, { "version": "20.9.1_LI_Images", "status": "affected" }, { "version": "20.10.1_LI_Images", "status": "affected" }, { "version": "20.9.2_LI_Images", "status": "affected" }, { "version": "20.3.7", "status": "affected" }, { "version": "20.9.3", "status": "affected" }, { "version": "20.6.5.1", "status": "affected" }, { "version": "20.11.1", "status": "affected" }, { "version": "20.11.1_LI_Images", "status": "affected" }, { "version": "20.9.3_LI_ Images", "status": "affected" }, { "version": "20.6.3.1.1", "status": "affected" }, { "version": "20.9.3.0.2", "status": "affected" }, { "version": "20.6.5.1.2", "status": "affected" }, { "version": "20.9.3.0.3", "status": "affected" }, { "version": "20.4.2.3", "status": "affected" }, { "version": "20.6.3.2", "status": "affected" }, { "version": "20.6.4.1", "status": "affected" }, { "version": "20.6.3.0.38", "status": "affected" }, { "version": "20.6.3.0.39", "status": "affected" }, { "version": "20.3.5.1", "status": "affected" }, { "version": "20.3.4.3", "status": "affected" }, { "version": "20.9.3.1", "status": "affected" }, { "version": "20.3.3.2", "status": "affected" }, { "version": "20.6.5.2", "status": "affected" }, { "version": "20.3.7.1", "status": "affected" }, { "version": "20.10.1.1", "status": "affected" }, { "version": "20.6.5.2.1", "status": "affected" }, { "version": "20.3.4.0.25", "status": "affected" }, { "version": "20.6.2.2.4", "status": "affected" }, { "version": "20.6.1.2", "status": "affected" }, { "version": "20.11.1.1", "status": "affected" }, { "version": "20.9.3.0.5", "status": "affected" }, { "version": "20.3.4.0.26", "status": "affected" }, { "version": "20.6.5.1.3", "status": "affected" }, { "version": "20.6.3.0.40", "status": "affected" }, { "version": "20.1.3.1", "status": "affected" }, { "version": "20.9.2.2", "status": "affected" }, { "version": "20.6.5.2.3", "status": "affected" }, { "version": "20.6.5.1.4", "status": "affected" }, { "version": "20.6.5.3", "status": "affected" }, { "version": "20.6.3.0.41", "status": "affected" }, { "version": "20.9.3.0.7", "status": "affected" }, { "version": "20.6.5.1.5", "status": "affected" }, { "version": "20.9.3.0.4", "status": "affected" }, { "version": "20.6.4.0.19", "status": "affected" }, { "version": "20.6.5.1.6", "status": "affected" }, { "version": "20.9.3.0.8", "status": "affected" }, { "version": "20.6.3.3", "status": "affected" }, { "version": "20.3.7.2", "status": "affected" }, { "version": "20.6.5.4", "status": "affected" }, { "version": "20.6.5.1.7", "status": "affected" }, { "version": "20.9.3.0.12", "status": "affected" }, { "version": "20.6.4.2", "status": "affected" }, { "version": "20.6.5.5", "status": "affected" }, { "version": "20.9.3.2", "status": "affected" }, { "version": "20.11.1.2", "status": "affected" }, { "version": "20.6.3.4", "status": "affected" }, { "version": "20.10.1.2", "status": "affected" }, { "version": "20.6.5.1.9", "status": "affected" }, { "version": "20.9.3.0.16", "status": "affected" }, { "version": "20.6.3.0.45", "status": "affected" }, { "version": "20.6.5.1.10", "status": "affected" }, { "version": "20.9.3.0.17", "status": "affected" }, { "version": "20.6.5.2.4", "status": "affected" }, { "version": "20.6.4.0.21", "status": "affected" }, { "version": "20.9.3.0.18", "status": "affected" }, { "version": "20.6.3.0.46", "status": "affected" }, { "version": "20.6.3.0.47", "status": "affected" }, { "version": "20.9.2.3", "status": "affected" }, { "version": "20.9.3.2_LI_Images", "status": "affected" }, { "version": "20.9.3.0.21", "status": "affected" }, { "version": "20.9.3.0.20", "status": "affected" }, { "version": "20.9.4_LI_Images", "status": "affected" }, { "version": "20.9.4", "status": "affected" }, { "version": "20.6.5.1.11", "status": "affected" }, { "version": "20.12.1", "status": "affected" }, { "version": "20.12.1_LI_Images", "status": "affected" }, { "version": "20.6.5.1.13", "status": "affected" }, { "version": "20.9.3.0.23", "status": "affected" }, { "version": "20.6.5.2.8", "status": "affected" }, { "version": "20.9.4.1", "status": "affected" }, { "version": "20.9.4.1_LI_Images", "status": "affected" }, { "version": "20.9.3.0.25", "status": "affected" }, { "version": "20.9.3.0.24", "status": "affected" }, { "version": "20.6.5.1.14", "status": "affected" }, { "version": "20.3.8", "status": "affected" }, { "version": "20.6.6", "status": "affected" }, { "version": "20.9.3.0.26", "status": "affected" }, { "version": "20.6.3.0.51", "status": "affected" }, { "version": "20.9.3.0.29", "status": "affected" }, { "version": "20.12.2", "status": "affected" }, { "version": "20.12.2_LI_Images", "status": "affected" }, { "version": "20.6.6.0.1", "status": "affected" }, { "version": "20.13.1_LI_Images", "status": "affected" }, { "version": "20.9.4.0.4", "status": "affected" }, { "version": "20.13.1", "status": "affected" }, { "version": "20.9.4.1.1", "status": "affected" }, { "version": "20.9.5", "status": "affected" }, { "version": "20.9.5_LI_Images", "status": "affected" }, { "version": "20.12.3_LI_Images", "status": "affected" }, { "version": "20.12.3", "status": "affected" }, { "version": "20.9.4.1.3", "status": "affected" }, { "version": "20.6.7", "status": "affected" }, { "version": "20.9.5.1", "status": "affected" }, { "version": "20.9.5.1_LI_Images", "status": "affected" }, { "version": "20.9.4.1.6", "status": "affected" }, { "version": "20.14.1", "status": "affected" }, { "version": "20.14.1_LI_Images", "status": "affected" }, { "version": "20.9.5.2", "status": "affected" }, { "version": "20.9.5.2.1", "status": "affected" }, { "version": "20.9.5.2_LI_Images", "status": "affected" }, { "version": "20.12.3.1", "status": "affected" }, { "version": "20.12.4", "status": "affected" }, { "version": "20.15.1_LI_Images", "status": "affected" }, { "version": "20.15.1", "status": "affected" }, { "version": "20.9.5.1.4", "status": "affected" }, { "version": "20.9.5.2.7", "status": "affected" }, { "version": "20.9.5.2.13", "status": "affected" }, { "version": "20.9.6", "status": "affected" }, { "version": "20.9.6_LI_Images", "status": "affected" }, { "version": "20.9.5.2.14", "status": "affected" }, { "version": "20.6.8", "status": "affected" }, { "version": "20.12.4.0.03", "status": "affected" }, { "version": "20.16.1", "status": "affected" }, { "version": "20.16.1_LI_Images", "status": "affected" }, { "version": "20.12.4_LI_Images", "status": "affected" }, { "version": "20.9.5.2.16", "status": "affected" }, { "version": "20.12.4.0.4", "status": "affected" }, { "version": "20.12.401", "status": "affected" }, { "version": "20.9.5.3", "status": "affected" }, { "version": "20.9.5.3_LI_Images", "status": "affected" }, { "version": "20.12.4.1_LI_Images", "status": "affected" }, { "version": "20.12.4.1", "status": "affected" }, { "version": "20.9.5.2.21", "status": "affected" }, { "version": "20.9.6.0.3", "status": "affected" }, { "version": "20.12.4.0.6", "status": "affected" }, { "version": "20.15.2_LI_Images", "status": "affected" }, { "version": "20.15.2", "status": "affected" }, { "version": "20.12.4_Monthly_ES5", "status": "affected" }, { "version": "20.12.5", "status": "affected" }, { "version": "20.12.5_LI_Images", "status": "affected" }, { "version": "20.9.7_LI _Images", "status": "affected" }, { "version": "20.9.7", "status": "affected" }, { "version": "20.15.3", "status": "affected" }, { "version": "20.15.3_ LI _Images", "status": "affected" }, { "version": "20.12.501", "status": "affected" }, { "version": "20.12.5.1_LI_Images", "status": "affected" }, { "version": "20.12.5.1", "status": "affected" }, { "version": "20.12.5.2_LI_Images", "status": "affected" }, { "version": "20.12.5.2", "status": "affected" }, { "version": "20.15.3.1", "status": "affected" }, { "version": "20.15.4_LI_Images", "status": "affected" }, { "version": "20.15.4", "status": "affected" }, { "version": "20.9.7.1_LI _Images", "status": "affected" }, { "version": "20.9.7.1", "status": "affected" }, { "version": "20.18.1", "status": "affected" }, { "version": "20.18.1_LI_Images", "status": "affected" }, { "version": "20.12.6_LI_Images", "status": "affected" }, { "version": "20.12.6", "status": "affected" }, { "version": "20.12.5.1.01", "status": "affected" }, { "version": "20.9.8", "status": "affected" }, { "version": "20.9.8_LI_Images", "status": "affected" }, { "version": "20.18.2", "status": "affected" }, { "version": "20.15.4.1_LI_Images", "status": "affected" }, { "version": "20.15.4.1", "status": "affected" }, { "version": "20.18.2_LI_Images", "status": "affected" } ], "defaultStatus": "unknown" } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20127", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "fetchedAt": "2026-10-23T02:43:47.244Z", "publishedAt": "2026-02-25T16:14:20.137Z", "modifiedAt": "2026-06-16T17:57:59.054Z", "state": "published", "provider": "cisco", "title": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "descriptions": [ { "lang": "en", "value": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. ", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Cisco", "product": "Cisco Catalyst SD-WAN Manager", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unknown", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "20.1.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "19.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": "18.4.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/3", "version": "18.4.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/4", "version": "20.1.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/5", "version": "20.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/6", "version": "19.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/7", "version": "19.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/8", "version": "19.2.099", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/9", "version": "18.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/10", "version": "18.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/11", "version": "19.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/12", "version": "18.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/13", "version": "19.0.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/14", "version": "19.1.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/15", "version": "18.4.302", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/16", "version": "18.4.303", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/17", "version": "19.2.097", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/18", "version": "19.2.098", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/19", "version": "17.2.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/20", "version": "18.3.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/21", "version": "19.0.1a", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/22", "version": "18.2.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/23", "version": "18.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/24", "version": "18.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/25", "version": "17.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/26", "version": "18.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/27", "version": "18.4.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/28", "version": "18.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/29", "version": "17.2.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/30", "version": "17.2.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/31", "version": "18.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/32", "version": "17.2.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/33", "version": "18.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/34", "version": "18.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/35", "version": "18.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/36", "version": "18.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/37", "version": "17.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/38", "version": "17.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/39", "version": "18.3.0", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/40", "version": "19.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/41", "version": "18.4.501_ES", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/42", "version": "20.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/43", "version": "20.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/44", "version": "19.2.929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/45", "version": "19.2.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/46", "version": "20.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/47", "version": "19.2.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/48", "version": "20.3.2_925", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/49", "version": "20.3.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/50", "version": "20.3.2.1_927", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/51", "version": "18.4.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/52", "version": "20.1.2_937", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/53", "version": "20.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/54", "version": "20.3.2_928", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/55", "version": "20.3.2_929", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/56", "version": "20.4.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/57", "version": "20.3.2.1_930", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/58", "version": "19.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/59", "version": "20.5.0.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/60", "version": "20.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/61", "version": "20.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/62", "version": "19.2.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/63", "version": "20.3.2_937", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/64", "version": "20.3.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/65", "version": "20.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/66", "version": "20.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/67", "version": "20.3.3.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/68", "version": "20.3.3.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/69", "version": "20.3.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/70", "version": "20.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/71", "version": "20.3.3.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/72", "version": "20.4.1.1.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/73", "version": "20.4.1.0.01", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/74", "version": "20.4.1.0.02", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/75", "version": "20.3.3.1.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/76", "version": "20.3.3.1.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/77", "version": "20.5.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/78", "version": "20.3.3.1.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/79", "version": "20.3.3.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/80", "version": "20.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/81", "version": "20.4.2.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/82", "version": "20.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/83", "version": "20.3.3.0.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/84", "version": "19.2.4.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/85", "version": "19.2.4.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/86", "version": "20.3.4.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/87", "version": "20.3.2.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/88", "version": "20.6.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/89", "version": "20.5.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/90", "version": "20.3.3.0.17", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/91", "version": "20.6.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/92", "version": "20.6.0.18.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/93", "version": "20.3.2.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/94", "version": "20.6.0.18.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/95", "version": "20.4.2.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/96", "version": "20.3.3.0.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/97", "version": "20.3.4.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/98", "version": "20.6.1.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/99", "version": "20.3.4.0.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/100", "version": "20.6.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/101", "version": "20.7.1EFT2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/102", "version": "20.3.4.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/103", "version": "20.3.4.0.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/104", "version": "20.4.2.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/105", "version": "20.3.3.0.18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/106", "version": "20.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/107", "version": "20.6.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/108", "version": "20.3.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/109", "version": "20.5.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/110", "version": "20.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/111", "version": "20.4.2.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/112", "version": "20.3.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/113", "version": "20.3.813", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/114", "version": "20.3.4.0.19", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/115", "version": "20.4.2.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/116", "version": "20.5.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/117", "version": "20.3.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/118", "version": "20.3.814", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/119", "version": "20.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/120", "version": "20.6.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/121", "version": "20.3.4.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/122", "version": "20.7.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/123", "version": "20.3.4.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/124", "version": "20.6.2.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/125", "version": "20.3.4.0.20", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/126", "version": "20.6.2.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/127", "version": "20.4.2.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/128", "version": "20.3.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/129", "version": "20.6.2.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/130", "version": "20.4.2.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/131", "version": "20.3.4.0.24", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/132", "version": "20.6.2.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/133", "version": "20.6.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/134", "version": "20.3.4.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/135", "version": "20.4.2.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/136", "version": "20.7.1.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/137", "version": "20.8.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/138", "version": "20.3.5.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/139", "version": "20.3.5.0.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/140", "version": "20.4.2.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/141", "version": "20.3.5.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/142", "version": "20.6.3.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/143", "version": "20.6.3.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/144", "version": "20.6.3.0.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/145", "version": "20.6.3.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/146", "version": "20.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/147", "version": "20.9.1EFT2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/148", "version": "20.6.3.0.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/149", "version": "20.6.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/150", "version": "20.6.3.0.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/151", "version": "20.6.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/152", "version": "20.9.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/153", "version": "20.6.3.0.19", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/154", "version": "20.6.3.0.18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/155", "version": "20.3.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/156", "version": "20.9.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/157", "version": "20.6.3.0.23", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/158", "version": "20.6.4.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/159", "version": "20.6.3.0.25", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/160", "version": "20.6.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/161", "version": "20.6.3.0.27", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/162", "version": "20.9.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/163", "version": "20.9.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/164", "version": "20.6.3.0.29", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/165", "version": "20.6.3.0.31", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/166", "version": "20.6.3.0.32", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/167", "version": "20.10.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/168", "version": "20.6.3.0.33", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/169", "version": "20.9.2.0.01", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/170", "version": "20.9.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/171", "version": "20.10.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/172", "version": "20.9.2_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/173", "version": "20.3.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/174", "version": "20.9.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/175", "version": "20.6.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/176", "version": "20.11.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/177", "version": "20.11.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/178", "version": "20.9.3_LI_ Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/179", "version": "20.6.3.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/180", "version": "20.9.3.0.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/181", "version": "20.6.5.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/182", "version": "20.9.3.0.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/183", "version": "20.4.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/184", "version": "20.6.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/185", "version": "20.6.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/186", "version": "20.6.3.0.38", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/187", "version": "20.6.3.0.39", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/188", "version": "20.3.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/189", "version": "20.3.4.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/190", "version": "20.9.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/191", "version": "20.3.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/192", "version": "20.6.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/193", "version": "20.3.7.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/194", "version": "20.10.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/195", "version": "20.6.5.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/196", "version": "20.3.4.0.25", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/197", "version": "20.6.2.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/198", "version": "20.6.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/199", "version": "20.11.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/200", "version": "20.9.3.0.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/201", "version": "20.3.4.0.26", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/202", "version": "20.6.5.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/203", "version": "20.6.3.0.40", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/204", "version": "20.1.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/205", "version": "20.9.2.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/206", "version": "20.6.5.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/207", "version": "20.6.5.1.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/208", "version": "20.6.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/209", "version": "20.6.3.0.41", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/210", "version": "20.9.3.0.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/211", "version": "20.6.5.1.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/212", "version": "20.9.3.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/213", "version": "20.6.4.0.19", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/214", "version": "20.6.5.1.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/215", "version": "20.9.3.0.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/216", "version": "20.6.3.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/217", "version": "20.3.7.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/218", "version": "20.6.5.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/219", "version": "20.6.5.1.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/220", "version": "20.9.3.0.12", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/221", "version": "20.6.4.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/222", "version": "20.6.5.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/223", "version": "20.9.3.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/224", "version": "20.11.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/225", "version": "20.6.3.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/226", "version": "20.10.1.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/227", "version": "20.6.5.1.9", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/228", "version": "20.9.3.0.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/229", "version": "20.6.3.0.45", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/230", "version": "20.6.5.1.10", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/231", "version": "20.9.3.0.17", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/232", "version": "20.6.5.2.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/233", "version": "20.6.4.0.21", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/234", "version": "20.9.3.0.18", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/235", "version": "20.6.3.0.46", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/236", "version": "20.6.3.0.47", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/237", "version": "20.9.2.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/238", "version": "20.9.3.2_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/239", "version": "20.9.3.0.21", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/240", "version": "20.9.3.0.20", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/241", "version": "20.9.4_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/242", "version": "20.9.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/243", "version": "20.6.5.1.11", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/244", "version": "20.12.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/245", "version": "20.12.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/246", "version": "20.6.5.1.13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/247", "version": "20.9.3.0.23", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/248", "version": "20.6.5.2.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/249", "version": "20.9.4.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/250", "version": "20.9.4.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/251", "version": "20.9.3.0.25", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/252", "version": "20.9.3.0.24", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/253", "version": "20.6.5.1.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/254", "version": "20.3.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/255", "version": "20.6.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/256", "version": "20.9.3.0.26", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/257", "version": "20.6.3.0.51", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/258", "version": "20.9.3.0.29", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/259", "version": "20.12.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/260", "version": "20.12.2_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/261", "version": "20.6.6.0.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/262", "version": "20.13.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/263", "version": "20.9.4.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/264", "version": "20.13.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/265", "version": "20.9.4.1.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/266", "version": "20.9.5", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/267", "version": "20.9.5_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/268", "version": "20.12.3_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/269", "version": "20.12.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/270", "version": "20.9.4.1.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/271", "version": "20.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/272", "version": "20.9.5.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/273", "version": "20.9.5.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/274", "version": "20.9.4.1.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/275", "version": "20.14.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/276", "version": "20.14.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/277", "version": "20.9.5.2", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/278", "version": "20.9.5.2.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/279", "version": "20.9.5.2_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/280", "version": "20.12.3.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/281", "version": "20.12.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/282", "version": "20.15.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/283", "version": "20.15.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/284", "version": "20.9.5.1.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/285", "version": "20.9.5.2.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/286", "version": "20.9.5.2.13", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/287", "version": "20.9.6", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/288", "version": "20.9.6_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/289", "version": "20.9.5.2.14", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/290", "version": "20.6.8", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/291", "version": "20.12.4.0.03", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/292", "version": "20.16.1", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/293", "version": "20.16.1_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/294", "version": "20.12.4_LI_Images", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/295", "version": "20.9.5.2.16", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/296", "version": "20.12.4.0.4", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/297", "version": "20.12.401", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/298", "version": "20.9.5.3", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/299", "version": "20.9.5.3_LI_Images", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is aware of limited exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "sourcePath": "/containers/cna/exploits/0/value" } ], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "cisco", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "cisco-sa-sdwan-rpa-EHchtZk", "tags": [], "provider": "cisco", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20127", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"20.3.2_925\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_927\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.1.2_937\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_928\",\"status\":\"affected\"},{\"version\":\"20.3.2_929\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_930\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.5.0.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_937\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.4.1.1.5\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.01\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.02\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.7\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.5\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.10\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.14\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.8\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.3\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.11\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.813\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.814\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.20\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.7\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.7.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.8.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.9\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.10\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.9.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.11\",\"status\":\"affected\"},{\"version\":\"20.6.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.14\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.9.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.19\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.9.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.23\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.27\",\"status\":\"affected\"},{\"version\":\"20.9.2\",\"status\":\"affected\"},{\"version\":\"20.9.2.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.29\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.31\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.32\",\"status\":\"affected\"},{\"version\":\"20.10.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.33\",\"status\":\"affected\"},{\"version\":\"20.9.2.0.01\",\"status\":\"affected\"},{\"version\":\"20.9.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.10.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.9.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.11.1\",\"status\":\"affected\"},{\"version\":\"20.11.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3_LI_ Images\",\"status\":\"affected\"},{\"version\":\"20.6.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.38\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.39\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.10.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.11.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.5\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.26\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.40\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.9.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.41\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.5\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.6\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.7\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.12\",\"status\":\"affected\"},{\"version\":\"20.6.4.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.5\",\"status\":\"affected\"},{\"version\":\"20.9.3.2\",\"status\":\"affected\"},{\"version\":\"20.11.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.3.4\",\"status\":\"affected\"},{\"version\":\"20.10.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.9\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.45\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.10\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.21\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.46\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.47\",\"status\":\"affected\"},{\"version\":\"20.9.2.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.21\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.20\",\"status\":\"affected\"},{\"version\":\"20.9.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.11\",\"status\":\"affected\"},{\"version\":\"20.12.1\",\"status\":\"affected\"},{\"version\":\"20.12.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.13\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.23\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.8\",\"status\":\"affected\"},{\"version\":\"20.9.4.1\",\"status\":\"affected\"},{\"version\":\"20.9.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.25\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.14\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.26\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.51\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.29\",\"status\":\"affected\"},{\"version\":\"20.12.2\",\"status\":\"affected\"},{\"version\":\"20.12.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.6.6.0.1\",\"status\":\"affected\"},{\"version\":\"20.13.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.13.1\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.5\",\"status\":\"affected\"},{\"version\":\"20.9.5_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.3\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.6\",\"status\":\"affected\"},{\"version\":\"20.14.1\",\"status\":\"affected\"},{\"version\":\"20.14.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3.1\",\"status\":\"affected\"},{\"version\":\"20.12.4\",\"status\":\"affected\"},{\"version\":\"20.15.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.1.4\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.13\",\"status\":\"affected\"},{\"version\":\"20.9.6\",\"status\":\"affected\"},{\"version\":\"20.9.6_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.14\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.03\",\"status\":\"affected\"},{\"version\":\"20.16.1\",\"status\":\"affected\"},{\"version\":\"20.16.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.16\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.12.401\",\"status\":\"affected\"},{\"version\":\"20.9.5.3\",\"status\":\"affected\"},{\"version\":\"20.9.5.3_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.21\",\"status\":\"affected\"},{\"version\":\"20.9.6.0.3\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.15.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.2\",\"status\":\"affected\"},{\"version\":\"20.12.4_Monthly_ES5\",\"status\":\"affected\"},{\"version\":\"20.12.5\",\"status\":\"affected\"},{\"version\":\"20.12.5_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.7_LI _Images\",\"status\":\"affected\"},{\"version\":\"20.9.7\",\"status\":\"affected\"},{\"version\":\"20.15.3\",\"status\":\"affected\"},{\"version\":\"20.15.3_ LI _Images\",\"status\":\"affected\"},{\"version\":\"20.12.501\",\"status\":\"affected\"},{\"version\":\"20.12.5.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.5.1\",\"status\":\"affected\"},{\"version\":\"20.12.5.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.5.2\",\"status\":\"affected\"},{\"version\":\"20.15.3.1\",\"status\":\"affected\"},{\"version\":\"20.15.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.4\",\"status\":\"affected\"},{\"version\":\"20.9.7.1_LI _Images\",\"status\":\"affected\"},{\"version\":\"20.9.7.1\",\"status\":\"affected\"},{\"version\":\"20.18.1\",\"status\":\"affected\"},{\"version\":\"20.18.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.6_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.6\",\"status\":\"affected\"},{\"version\":\"20.12.5.1.01\",\"status\":\"affected\"},{\"version\":\"20.9.8\",\"status\":\"affected\"},{\"version\":\"20.9.8_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.18.2\",\"status\":\"affected\"},{\"version\":\"20.15.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.4.1\",\"status\":\"affected\"},{\"version\":\"20.18.2_LI_Images\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. ", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/exploits/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourcePath": "/containers/cna/exploits/0/value", "text": "The Cisco PSIRT is aware of limited exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Improper Authentication\",\"type\":\"cwe\",\"cweId\":\"CWE-287\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "bounded", "truncatedFields": [ "/containers/cna/affected/0/versions" ], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-06-16T17:57:59.054Z", "fetchedAt": "2026-10-23T02:43:47.244Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-25T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt & Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.", "sourceSummary": "Cisco Catalyst SD-WAN Managerに認証の回避に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "ログインなどの認証を回避され、不正な操作につながる可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:45.093Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b5250395da27d5c87f0de087d18fa6947a0c8e5caef35fc3d4ecab3d7308859b", "sourceModifiedAt": "2026-06-16T17:57:59.054Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Cisco Catalyst SD‑WAN Controller（旧 SD‑WAN vSmart）、Cisco Catalyst SD‑WAN Manager（旧 SD‑WAN vManage）、Cisco Catalyst SD‑WAN Validator（旧 SD‑WAN vBond）のピアリング認証機構に不具合があり、認証をバイパスして管理者権限を取得できる脆弱性が存在します。攻撃者は細工したリクエストを送信することで、認証されていない状態で内部の高権限ユーザーとしてログインし、NETCONF を介して SD‑WAN ファブリックのネットワーク設定を操作できる可能性があります。", "risk": "認証バイパスに成功すると、攻撃者は管理者権限でシステムにログインし、SD‑WAN のネットワーク設定を改ざんできる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Cisco Catalyst SD‑WAN Manager の以下のバージョンが影響を受けます（一覧はソース S4 に記載）。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Cisco Catalyst SD‑WAN Controller のバージョン情報はソース S2 では明記されていないため、影響対象のバージョンは不明です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "Cisco Catalyst SD‑WAN Validator のバージョン情報はソース S2 では明記されていないため、影響対象のバージョンは不明です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.3.0。影響ありとして記載：19.2.2。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：18.3.8。影響ありとして記載：19.0.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.302。影響ありとして記載：18.4.303。影響ありとして記載：19.2.097。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.6.1。影響ありとして記載：19.0.1a。影響ありとして記載：18.2.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：17.2.5。影響ありとして記載：18.3.1.1。影響ありとして記載：18.3.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.4。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：20.3.2_925。影響ありとして記載：20.3.2.1。影響ありとして記載：20.3.2.1_927。影響ありとして記載：18.4.6。影響ありとして記載：20.1.2_937。影響ありとして記載：20.4.1。影響ありとして記載：20.3.2_928。影響ありとして記載：20.3.2_929。影響ありとして記載：20.4.1.0.1。影響ありとして記載：20.3.2.1_930。影響ありとして記載：19.2.4。影響ありとして記載：20.5.0.1.1。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：19.2.4.0.1。影響ありとして記載：20.3.2_937。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.3.3.0.4。影響ありとして記載：20.3.3.1.2。影響ありとして記載：20.3.3.1.1。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.3.0.2。影響ありとして記載：20.4.1.1.5。影響ありとして記載：20.4.1.0.01。影響ありとして記載：20.4.1.0.02。影響ありとして記載：20.3.3.1.7。影響ありとして記載：20.3.3.1.5。影響ありとして記載：20.5.1.0.1。影響ありとして記載：20.3.3.1.10。影響ありとして記載：20.3.3.0.8。影響ありとして記載：20.4.2。影響ありとして記載：20.4.2.0.1。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3.0.14。影響ありとして記載：19.2.4.0.8。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.3.4.0.1。影響ありとして記載：20.3.2.0.5。影響ありとして記載：20.6.1。影響ありとして記載：20.5.1.0.2。影響ありとして記載：20.3.3.0.17。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.0.18.3。影響ありとして記載：20.3.2.0.6。影響ありとして記載：20.6.0.18.4。影響ありとして記載：20.4.2.0.2。影響ありとして記載：20.3.3.0.16。影響ありとして記載：20.3.4.0.5。影響ありとして記載：20.6.1.0.1。影響ありとして記載：20.3.4.0.6。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1EFT2。影響ありとして記載：20.3.4.0.9。影響ありとして記載：20.3.4.0.11。影響ありとして記載：20.4.2.0.4。影響ありとして記載：20.3.3.0.18。影響ありとして記載：20.7.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.4.2.1.1。影響ありとして記載：20.3.4.1.1。影響ありとして記載：20.3.813。影響ありとして記載：20.3.4.0.19。影響ありとして記載：20.4.2.2.1。影響ありとして記載：20.5.1.2。影響ありとして記載：20.3.4.2。影響ありとして記載：20.3.814。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.3.4.2.1。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.4.1.2。影響ありとして記載：20.6.2.2.2。影響ありとして記載：20.3.4.0.20。影響ありとして記載：20.6.2.2.3。影響ありとして記載：20.4.2.2.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.2.0.4。影響ありとして記載：20.4.2.2.3。影響ありとして記載：20.3.4.0.24。影響ありとして記載：20.6.2.2.7。影響ありとして記載：20.6.3。影響ありとして記載：20.3.4.2.2。影響ありとして記載：20.4.2.2.4。影響ありとして記載：20.7.1.0.2。影響ありとして記載：20.8.1。影響ありとして記載：20.3.5.0.8。影響ありとして記載：20.3.5.0.9。影響ありとして記載：20.4.2.2.8。影響ありとして記載：20.3.5.0.7。影響ありとして記載：20.6.3.0.7。影響ありとして記載：20.6.3.0.5。影響ありとして記載：20.6.3.0.10。影響ありとして記載：20.6.3.0.2。影響ありとして記載：20.7.2。影響ありとして記載：20.9.1EFT2。影響ありとして記載：20.6.3.0.11。影響ありとして記載：20.6.3.1。影響ありとして記載：20.6.3.0.14。影響ありとして記載：20.6.4。影響ありとして記載：20.9.1。影響ありとして記載：20.6.3.0.19。影響ありとして記載：20.6.3.0.18。影響ありとして記載：20.3.6。影響ありとして記載：20.9.1.1。影響ありとして記載：20.6.3.0.23。影響ありとして記載：20.6.4.0.4。影響ありとして記載：20.6.3.0.25。影響ありとして記載：20.6.5。影響ありとして記載：20.6.3.0.27。影響ありとして記載：20.9.2。影響ありとして記載：20.9.2.1。影響ありとして記載：20.6.3.0.29。影響ありとして記載：20.6.3.0.31。影響ありとして記載：20.6.3.0.32。影響ありとして記載：20.10.1。影響ありとして記載：20.6.3.0.33。影響ありとして記載：20.9.2.0.01。影響ありとして記載：20.9.1_LI_Images。影響ありとして記載：20.10.1_LI_Images。影響ありとして記載：20.9.2_LI_Images。影響ありとして記載：20.3.7。影響ありとして記載：20.9.3。影響ありとして記載：20.6.5.1。影響ありとして記載：20.11.1。影響ありとして記載：20.11.1_LI_Images。影響ありとして記載：20.9.3_LI_ Images。影響ありとして記載：20.6.3.1.1。影響ありとして記載：20.9.3.0.2。影響ありとして記載：20.6.5.1.2。影響ありとして記載：20.9.3.0.3。影響ありとして記載：20.4.2.3。影響ありとして記載：20.6.3.2。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.0.38。影響ありとして記載：20.6.3.0.39。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.9.3.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.10.1.1。影響ありとして記載：20.6.5.2.1。影響ありとして記載：20.3.4.0.25。影響ありとして記載：20.6.2.2.4。影響ありとして記載：20.6.1.2。影響ありとして記載：20.11.1.1。影響ありとして記載：20.9.3.0.5。影響ありとして記載：20.3.4.0.26。影響ありとして記載：20.6.5.1.3。影響ありとして記載：20.6.3.0.40。影響ありとして記載：20.1.3.1。影響ありとして記載：20.9.2.2。影響ありとして記載：20.6.5.2.3。影響ありとして記載：20.6.5.1.4。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.0.41。影響ありとして記載：20.9.3.0.7。影響ありとして記載：20.6.5.1.5。影響ありとして記載：20.9.3.0.4。影響ありとして記載：20.6.4.0.19。影響ありとして記載：20.6.5.1.6。影響ありとして記載：20.9.3.0.8。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.6.5.1.7。影響ありとして記載：20.9.3.0.12。影響ありとして記載：20.6.4.2。影響ありとして記載：20.6.5.5。影響ありとして記載：20.9.3.2。影響ありとして記載：20.11.1.2。影響ありとして記載：20.6.3.4。影響ありとして記載：20.10.1.2。影響ありとして記載：20.6.5.1.9。影響ありとして記載：20.9.3.0.16。影響ありとして記載：20.6.3.0.45。影響ありとして記載：20.6.5.1.10。影響ありとして記載：20.9.3.0.17。影響ありとして記載：20.6.5.2.4。影響ありとして記載：20.6.4.0.21。影響ありとして記載：20.9.3.0.18。影響ありとして記載：20.6.3.0.46。影響ありとして記載：20.6.3.0.47。影響ありとして記載：20.9.2.3。影響ありとして記載：20.9.3.2_LI_Images。影響ありとして記載：20.9.3.0.21。影響ありとして記載：20.9.3.0.20。影響ありとして記載：20.9.4_LI_Images。影響ありとして記載：20.9.4。影響ありとして記載：20.6.5.1.11。影響ありとして記載：20.12.1。影響ありとして記載：20.12.1_LI_Images。影響ありとして記載：20.6.5.1.13。影響ありとして記載：20.9.3.0.23。影響ありとして記載：20.6.5.2.8。影響ありとして記載：20.9.4.1。影響ありとして記載：20.9.4.1_LI_Images。影響ありとして記載：20.9.3.0.25。影響ありとして記載：20.9.3.0.24。影響ありとして記載：20.6.5.1.14。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.9.3.0.26。影響ありとして記載：20.6.3.0.51。影響ありとして記載：20.9.3.0.29。影響ありとして記載：20.12.2。影響ありとして記載：20.12.2_LI_Images。影響ありとして記載：20.6.6.0.1。影響ありとして記載：20.13.1_LI_Images。影響ありとして記載：20.9.4.0.4。影響ありとして記載：20.13.1。影響ありとして記載：20.9.4.1.1。影響ありとして記載：20.9.5。影響ありとして記載：20.9.5_LI_Images。影響ありとして記載：20.12.3_LI_Images。影響ありとして記載：20.12.3。影響ありとして記載：20.9.4.1.3。影響ありとして記載：20.6.7。影響ありとして記載：20.9.5.1。影響ありとして記載：20.9.5.1_LI_Images。影響ありとして記載：20.9.4.1.6。影響ありとして記載：20.14.1。影響ありとして記載：20.14.1_LI_Images。影響ありとして記載：20.9.5.2。影響ありとして記載：20.9.5.2.1。影響ありとして記載：20.9.5.2_LI_Images。影響ありとして記載：20.12.3.1。影響ありとして記載：20.12.4。影響ありとして記載：20.15.1_LI_Images。影響ありとして記載：20.15.1。影響ありとして記載：20.9.5.1.4。影響ありとして記載：20.9.5.2.7。影響ありとして記載：20.9.5.2.13。影響ありとして記載：20.9.6。影響ありとして記載：20.9.6_LI_Images。影響ありとして記載：20.9.5.2.14。影響ありとして記載：20.6.8。影響ありとして記載：20.12.4.0.03。影響ありとして記載：20.16.1。影響ありとして記載：20.16.1_LI_Images。影響ありとして記載：20.12.4_LI_Images。影響ありとして記載：20.9.5.2.16。影響ありとして記載：20.12.4.0.4。影響ありとして記載：20.12.401。影響ありとして記載：20.9.5.3。影響ありとして記載：20.9.5.3_LI_Images。個別に記されていない版の影響は、原資料でも未確定です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Cisco Catalyst SD-WAN Manager」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20127", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20127" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20127", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20127" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20127", "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "https://nvd.nist.gov/vuln/detail/CVE-2026-20127" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。", "長い公式資料の一部を使って解説しています。対象製品・版・構成の全一覧は、併記した構造化データも管理担当者と照合してください。", "公式資料が長いため、取得できた一部の内容に基づく説明です。対象の版・例外・構成条件が省略されている可能性があるため、取得範囲だけで対象外とは判断しないでください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "label": "CVE：cisco" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20127", "label": "CVE公式レコード" }, { "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20127", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.\r\n\r\nThis vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An attacker could exploit this vulnerability by sending crafted requests to an affected system. A successful exploit could allow the attacker to log in to an affected Cisco Catalyst SD-WAN Controller as an internal, high-privileged, non-root user account. Using this account, the attacker could access NETCONF, which would then allow the attacker to manipulate network configuration for the SD-WAN fabric. ", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourceField": "/containers/cna/title", "excerpt": "Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20127.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Cisco\",\"product\":\"Cisco Catalyst SD-WAN Manager\",\"versions\":[{\"version\":\"20.1.12\",\"status\":\"affected\"},{\"version\":\"19.2.1\",\"status\":\"affected\"},{\"version\":\"18.4.4\",\"status\":\"affected\"},{\"version\":\"18.4.5\",\"status\":\"affected\"},{\"version\":\"20.1.1.1\",\"status\":\"affected\"},{\"version\":\"20.1.1\",\"status\":\"affected\"},{\"version\":\"19.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.2\",\"status\":\"affected\"},{\"version\":\"19.2.099\",\"status\":\"affected\"},{\"version\":\"18.3.6\",\"status\":\"affected\"},{\"version\":\"18.3.7\",\"status\":\"affected\"},{\"version\":\"19.2.0\",\"status\":\"affected\"},{\"version\":\"18.3.8\",\"status\":\"affected\"},{\"version\":\"19.0.0\",\"status\":\"affected\"},{\"version\":\"19.1.0\",\"status\":\"affected\"},{\"version\":\"18.4.302\",\"status\":\"affected\"},{\"version\":\"18.4.303\",\"status\":\"affected\"},{\"version\":\"19.2.097\",\"status\":\"affected\"},{\"version\":\"19.2.098\",\"status\":\"affected\"},{\"version\":\"17.2.10\",\"status\":\"affected\"},{\"version\":\"18.3.6.1\",\"status\":\"affected\"},{\"version\":\"19.0.1a\",\"status\":\"affected\"},{\"version\":\"18.2.0\",\"status\":\"affected\"},{\"version\":\"18.4.3\",\"status\":\"affected\"},{\"version\":\"18.4.1\",\"status\":\"affected\"},{\"version\":\"17.2.8\",\"status\":\"affected\"},{\"version\":\"18.3.3.1\",\"status\":\"affected\"},{\"version\":\"18.4.0\",\"status\":\"affected\"},{\"version\":\"18.3.1\",\"status\":\"affected\"},{\"version\":\"17.2.6\",\"status\":\"affected\"},{\"version\":\"17.2.9\",\"status\":\"affected\"},{\"version\":\"18.3.4\",\"status\":\"affected\"},{\"version\":\"17.2.5\",\"status\":\"affected\"},{\"version\":\"18.3.1.1\",\"status\":\"affected\"},{\"version\":\"18.3.5\",\"status\":\"affected\"},{\"version\":\"18.4.0.1\",\"status\":\"affected\"},{\"version\":\"18.3.3\",\"status\":\"affected\"},{\"version\":\"17.2.7\",\"status\":\"affected\"},{\"version\":\"17.2.4\",\"status\":\"affected\"},{\"version\":\"18.3.0\",\"status\":\"affected\"},{\"version\":\"19.2.3\",\"status\":\"affected\"},{\"version\":\"18.4.501_ES\",\"status\":\"affected\"},{\"version\":\"20.3.1\",\"status\":\"affected\"},{\"version\":\"20.1.2\",\"status\":\"affected\"},{\"version\":\"19.2.929\",\"status\":\"affected\"},{\"version\":\"19.2.31\",\"status\":\"affected\"},{\"version\":\"20.3.2\",\"status\":\"affected\"},{\"version\":\"19.2.32\",\"status\":\"affected\"},{\"version\":\"20.3.2_925\",\"status\":\"affected\"},{\"version\":\"20.3.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_927\",\"status\":\"affected\"},{\"version\":\"18.4.6\",\"status\":\"affected\"},{\"version\":\"20.1.2_937\",\"status\":\"affected\"},{\"version\":\"20.4.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_928\",\"status\":\"affected\"},{\"version\":\"20.3.2_929\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.1_930\",\"status\":\"affected\"},{\"version\":\"19.2.4\",\"status\":\"affected\"},{\"version\":\"20.5.0.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.3\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2_937\",\"status\":\"affected\"},{\"version\":\"20.3.3.1\",\"status\":\"affected\"},{\"version\":\"20.5.1\",\"status\":\"affected\"},{\"version\":\"20.1.3\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.4.1.1.5\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.01\",\"status\":\"affected\"},{\"version\":\"20.4.1.0.02\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.7\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.5\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.1.10\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.4.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.14\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.8\",\"status\":\"affected\"},{\"version\":\"19.2.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.3\",\"status\":\"affected\"},{\"version\":\"20.3.2.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.0.18.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.2\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.1.0.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.6.2\",\"status\":\"affected\"},{\"version\":\"20.7.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.9\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.11\",\"status\":\"affected\"},{\"version\":\"20.4.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.3.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.7.1\",\"status\":\"affected\"},{\"version\":\"20.6.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.4.2.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.813\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.1\",\"status\":\"affected\"},{\"version\":\"20.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2\",\"status\":\"affected\"},{\"version\":\"20.3.814\",\"status\":\"affected\"},{\"version\":\"20.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.1\",\"status\":\"affected\"},{\"version\":\"20.7.1.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.20\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.2\",\"status\":\"affected\"},{\"version\":\"20.3.5\",\"status\":\"affected\"},{\"version\":\"20.6.2.0.4\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.7\",\"status\":\"affected\"},{\"version\":\"20.6.3\",\"status\":\"affected\"},{\"version\":\"20.3.4.2.2\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.7.1.0.2\",\"status\":\"affected\"},{\"version\":\"20.8.1\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.9\",\"status\":\"affected\"},{\"version\":\"20.4.2.2.8\",\"status\":\"affected\"},{\"version\":\"20.3.5.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.10\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.7.2\",\"status\":\"affected\"},{\"version\":\"20.9.1EFT2\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.11\",\"status\":\"affected\"},{\"version\":\"20.6.3.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.14\",\"status\":\"affected\"},{\"version\":\"20.6.4\",\"status\":\"affected\"},{\"version\":\"20.9.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.19\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.3.6\",\"status\":\"affected\"},{\"version\":\"20.9.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.23\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.5\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.27\",\"status\":\"affected\"},{\"version\":\"20.9.2\",\"status\":\"affected\"},{\"version\":\"20.9.2.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.29\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.31\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.32\",\"status\":\"affected\"},{\"version\":\"20.10.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.33\",\"status\":\"affected\"},{\"version\":\"20.9.2.0.01\",\"status\":\"affected\"},{\"version\":\"20.9.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.10.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.3.7\",\"status\":\"affected\"},{\"version\":\"20.9.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.1\",\"status\":\"affected\"},{\"version\":\"20.11.1\",\"status\":\"affected\"},{\"version\":\"20.11.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3_LI_ Images\",\"status\":\"affected\"},{\"version\":\"20.6.3.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.2\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.3\",\"status\":\"affected\"},{\"version\":\"20.4.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.4.1\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.38\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.39\",\"status\":\"affected\"},{\"version\":\"20.3.5.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.1\",\"status\":\"affected\"},{\"version\":\"20.3.3.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2\",\"status\":\"affected\"},{\"version\":\"20.3.7.1\",\"status\":\"affected\"},{\"version\":\"20.10.1.1\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.1\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.25\",\"status\":\"affected\"},{\"version\":\"20.6.2.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.1.2\",\"status\":\"affected\"},{\"version\":\"20.11.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.5\",\"status\":\"affected\"},{\"version\":\"20.3.4.0.26\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.40\",\"status\":\"affected\"},{\"version\":\"20.1.3.1\",\"status\":\"affected\"},{\"version\":\"20.9.2.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.3\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.3\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.41\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.7\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.5\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.19\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.6\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.8\",\"status\":\"affected\"},{\"version\":\"20.6.3.3\",\"status\":\"affected\"},{\"version\":\"20.3.7.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.7\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.12\",\"status\":\"affected\"},{\"version\":\"20.6.4.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.5\",\"status\":\"affected\"},{\"version\":\"20.9.3.2\",\"status\":\"affected\"},{\"version\":\"20.11.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.3.4\",\"status\":\"affected\"},{\"version\":\"20.10.1.2\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.9\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.16\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.45\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.10\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.17\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.4\",\"status\":\"affected\"},{\"version\":\"20.6.4.0.21\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.18\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.46\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.47\",\"status\":\"affected\"},{\"version\":\"20.9.2.3\",\"status\":\"affected\"},{\"version\":\"20.9.3.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.21\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.20\",\"status\":\"affected\"},{\"version\":\"20.9.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.11\",\"status\":\"affected\"},{\"version\":\"20.12.1\",\"status\":\"affected\"},{\"version\":\"20.12.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.13\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.23\",\"status\":\"affected\"},{\"version\":\"20.6.5.2.8\",\"status\":\"affected\"},{\"version\":\"20.9.4.1\",\"status\":\"affected\"},{\"version\":\"20.9.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.25\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.24\",\"status\":\"affected\"},{\"version\":\"20.6.5.1.14\",\"status\":\"affected\"},{\"version\":\"20.3.8\",\"status\":\"affected\"},{\"version\":\"20.6.6\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.26\",\"status\":\"affected\"},{\"version\":\"20.6.3.0.51\",\"status\":\"affected\"},{\"version\":\"20.9.3.0.29\",\"status\":\"affected\"},{\"version\":\"20.12.2\",\"status\":\"affected\"},{\"version\":\"20.12.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.6.6.0.1\",\"status\":\"affected\"},{\"version\":\"20.13.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.13.1\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.1\",\"status\":\"affected\"},{\"version\":\"20.9.5\",\"status\":\"affected\"},{\"version\":\"20.9.5_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.3\",\"status\":\"affected\"},{\"version\":\"20.6.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.4.1.6\",\"status\":\"affected\"},{\"version\":\"20.14.1\",\"status\":\"affected\"},{\"version\":\"20.14.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.3.1\",\"status\":\"affected\"},{\"version\":\"20.12.4\",\"status\":\"affected\"},{\"version\":\"20.15.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.1.4\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.7\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.13\",\"status\":\"affected\"},{\"version\":\"20.9.6\",\"status\":\"affected\"},{\"version\":\"20.9.6_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.14\",\"status\":\"affected\"},{\"version\":\"20.6.8\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.03\",\"status\":\"affected\"},{\"version\":\"20.16.1\",\"status\":\"affected\"},{\"version\":\"20.16.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.16\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.4\",\"status\":\"affected\"},{\"version\":\"20.12.401\",\"status\":\"affected\"},{\"version\":\"20.9.5.3\",\"status\":\"affected\"},{\"version\":\"20.9.5.3_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.4.1\",\"status\":\"affected\"},{\"version\":\"20.9.5.2.21\",\"status\":\"affected\"},{\"version\":\"20.9.6.0.3\",\"status\":\"affected\"},{\"version\":\"20.12.4.0.6\",\"status\":\"affected\"},{\"version\":\"20.15.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.2\",\"status\":\"affected\"},{\"version\":\"20.12.4_Monthly_ES5\",\"status\":\"affected\"},{\"version\":\"20.12.5\",\"status\":\"affected\"},{\"version\":\"20.12.5_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.9.7_LI _Images\",\"status\":\"affected\"},{\"version\":\"20.9.7\",\"status\":\"affected\"},{\"version\":\"20.15.3\",\"status\":\"affected\"},{\"version\":\"20.15.3_ LI _Images\",\"status\":\"affected\"},{\"version\":\"20.12.501\",\"status\":\"affected\"},{\"version\":\"20.12.5.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.5.1\",\"status\":\"affected\"},{\"version\":\"20.12.5.2_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.5.2\",\"status\":\"affected\"},{\"version\":\"20.15.3.1\",\"status\":\"affected\"},{\"version\":\"20.15.4_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.4\",\"status\":\"affected\"},{\"version\":\"20.9.7.1_LI _Images\",\"status\":\"affected\"},{\"version\":\"20.9.7.1\",\"status\":\"affected\"},{\"version\":\"20.18.1\",\"status\":\"affected\"},{\"version\":\"20.18.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.6_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.12.6\",\"status\":\"affected\"},{\"version\":\"20.12.5.1.01\",\"status\":\"affected\"},{\"version\":\"20.9.8\",\"status\":\"affected\"},{\"version\":\"20.9.8_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.18.2\",\"status\":\"affected\"},{\"version\":\"20.15.4.1_LI_Images\",\"status\":\"affected\"},{\"version\":\"20.15.4.1\",\"status\":\"affected\"},{\"version\":\"20.18.2_LI_Images\",\"status\":\"affected\"}],\"defaultStatus\":\"unknown\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20127", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20127\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20127（Cisco Catalyst SD-WAN Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Cisco Catalyst SD‑WAN Manager の以下のバージョンが影響を受けます（一覧はソース S4 に記載）。\n・Cisco Catalyst SD‑WAN Controller のバージョン情報はソース S2 では明記されていないため、影響対象のバージョンは不明です。\n・Cisco Catalyst SD‑WAN Validator のバージョン情報はソース S2 では明記されていないため、影響対象のバージョンは不明です。\n・公式の対象表：Cisco / Cisco Catalyst SD-WAN Manager。影響ありとして記載：20.1.12。影響ありとして記載：19.2.1。影響ありとして記載：18.4.4。影響ありとして記載：18.4.5。影響ありとして記載：20.1.1.1。影響ありとして記載：20.1.1。影響ありとして記載：19.3.0。影響ありとして記載：19.2.2。影響ありとして記載：19.2.099。影響ありとして記載：18.3.6。影響ありとして記載：18.3.7。影響ありとして記載：19.2.0。影響ありとして記載：18.3.8。影響ありとして記載：19.0.0。影響ありとして記載：19.1.0。影響ありとして記載：18.4.302。影響ありとして記載：18.4.303。影響ありとして記載：19.2.097。影響ありとして記載：19.2.098。影響ありとして記載：17.2.10。影響ありとして記載：18.3.6.1。影響ありとして記載：19.0.1a。影響ありとして記載：18.2.0。影響ありとして記載：18.4.3。影響ありとして記載：18.4.1。影響ありとして記載：17.2.8。影響ありとして記載：18.3.3.1。影響ありとして記載：18.4.0。影響ありとして記載：18.3.1。影響ありとして記載：17.2.6。影響ありとして記載：17.2.9。影響ありとして記載：18.3.4。影響ありとして記載：17.2.5。影響ありとして記載：18.3.1.1。影響ありとして記載：18.3.5。影響ありとして記載：18.4.0.1。影響ありとして記載：18.3.3。影響ありとして記載：17.2.7。影響ありとして記載：17.2.4。影響ありとして記載：18.3.0。影響ありとして記載：19.2.3。影響ありとして記載：18.4.501_ES。影響ありとして記載：20.3.1。影響ありとして記載：20.1.2。影響ありとして記載：19.2.929。影響ありとして記載：19.2.31。影響ありとして記載：20.3.2。影響ありとして記載：19.2.32。影響ありとして記載：20.3.2_925。影響ありとして記載：20.3.2.1。影響ありとして記載：20.3.2.1_927。影響ありとして記載：18.4.6。影響ありとして記載：20.1.2_937。影響ありとして記載：20.4.1。影響ありとして記載：20.3.2_928。影響ありとして記載：20.3.2_929。影響ありとして記載：20.4.1.0.1。影響ありとして記載：20.3.2.1_930。影響ありとして記載：19.2.4。影響ありとして記載：20.5.0.1.1。影響ありとして記載：20.4.1.1。影響ありとして記載：20.3.3。影響ありとして記載：19.2.4.0.1。影響ありとして記載：20.3.2_937。影響ありとして記載：20.3.3.1。影響ありとして記載：20.5.1。影響ありとして記載：20.1.3。影響ありとして記載：20.3.3.0.4。影響ありとして記載：20.3.3.1.2。影響ありとして記載：20.3.3.1.1。影響ありとして記載：20.4.1.2。影響ありとして記載：20.3.3.0.2。影響ありとして記載：20.4.1.1.5。影響ありとして記載：20.4.1.0.01。影響ありとして記載：20.4.1.0.02。影響ありとして記載：20.3.3.1.7。影響ありとして記載：20.3.3.1.5。影響ありとして記載：20.5.1.0.1。影響ありとして記載：20.3.3.1.10。影響ありとして記載：20.3.3.0.8。影響ありとして記載：20.4.2。影響ありとして記載：20.4.2.0.1。影響ありとして記載：20.3.4。影響ありとして記載：20.3.3.0.14。影響ありとして記載：19.2.4.0.8。影響ありとして記載：19.2.4.0.9。影響ありとして記載：20.3.4.0.1。影響ありとして記載：20.3.2.0.5。影響ありとして記載：20.6.1。影響ありとして記載：20.5.1.0.2。影響ありとして記載：20.3.3.0.17。影響ありとして記載：20.6.1.1。影響ありとして記載：20.6.0.18.3。影響ありとして記載：20.3.2.0.6。影響ありとして記載：20.6.0.18.4。影響ありとして記載：20.4.2.0.2。影響ありとして記載：20.3.3.0.16。影響ありとして記載：20.3.4.0.5。影響ありとして記載：20.6.1.0.1。影響ありとして記載：20.3.4.0.6。影響ありとして記載：20.6.2。影響ありとして記載：20.7.1EFT2。影響ありとして記載：20.3.4.0.9。影響ありとして記載：20.3.4.0.11。影響ありとして記載：20.4.2.0.4。影響ありとして記載：20.3.3.0.18。影響ありとして記載：20.7.1。影響ありとして記載：20.6.2.1。影響ありとして記載：20.3.4.1。影響ありとして記載：20.5.1.1。影響ありとして記載：20.4.2.1。影響ありとして記載：20.4.2.1.1。影響ありとして記載：20.3.4.1.1。影響ありとして記載：20.3.813。影響ありとして記載：20.3.4.0.19。影響ありとして記載：20.4.2.2.1。影響ありとして記載：20.5.1.2。影響ありとして記載：20.3.4.2。影響ありとして記載：20.3.814。影響ありとして記載：20.4.2.2。影響ありとして記載：20.6.2.2。影響ありとして記載：20.3.4.2.1。影響ありとして記載：20.7.1.1。影響ありとして記載：20.3.4.1.2。影響ありとして記載：20.6.2.2.2。影響ありとして記載：20.3.4.0.20。影響ありとして記載：20.6.2.2.3。影響ありとして記載：20.4.2.2.2。影響ありとして記載：20.3.5。影響ありとして記載：20.6.2.0.4。影響ありとして記載：20.4.2.2.3。影響ありとして記載：20.3.4.0.24。影響ありとして記載：20.6.2.2.7。影響ありとして記載：20.6.3。影響ありとして記載：20.3.4.2.2。影響ありとして記載：20.4.2.2.4。影響ありとして記載：20.7.1.0.2。影響ありとして記載：20.8.1。影響ありとして記載：20.3.5.0.8。影響ありとして記載：20.3.5.0.9。影響ありとして記載：20.4.2.2.8。影響ありとして記載：20.3.5.0.7。影響ありとして記載：20.6.3.0.7。影響ありとして記載：20.6.3.0.5。影響ありとして記載：20.6.3.0.10。影響ありとして記載：20.6.3.0.2。影響ありとして記載：20.7.2。影響ありとして記載：20.9.1EFT2。影響ありとして記載：20.6.3.0.11。影響ありとして記載：20.6.3.1。影響ありとして記載：20.6.3.0.14。影響ありとして記載：20.6.4。影響ありとして記載：20.9.1。影響ありとして記載：20.6.3.0.19。影響ありとして記載：20.6.3.0.18。影響ありとして記載：20.3.6。影響ありとして記載：20.9.1.1。影響ありとして記載：20.6.3.0.23。影響ありとして記載：20.6.4.0.4。影響ありとして記載：20.6.3.0.25。影響ありとして記載：20.6.5。影響ありとして記載：20.6.3.0.27。影響ありとして記載：20.9.2。影響ありとして記載：20.9.2.1。影響ありとして記載：20.6.3.0.29。影響ありとして記載：20.6.3.0.31。影響ありとして記載：20.6.3.0.32。影響ありとして記載：20.10.1。影響ありとして記載：20.6.3.0.33。影響ありとして記載：20.9.2.0.01。影響ありとして記載：20.9.1_LI_Images。影響ありとして記載：20.10.1_LI_Images。影響ありとして記載：20.9.2_LI_Images。影響ありとして記載：20.3.7。影響ありとして記載：20.9.3。影響ありとして記載：20.6.5.1。影響ありとして記載：20.11.1。影響ありとして記載：20.11.1_LI_Images。影響ありとして記載：20.9.3_LI_ Images。影響ありとして記載：20.6.3.1.1。影響ありとして記載：20.9.3.0.2。影響ありとして記載：20.6.5.1.2。影響ありとして記載：20.9.3.0.3。影響ありとして記載：20.4.2.3。影響ありとして記載：20.6.3.2。影響ありとして記載：20.6.4.1。影響ありとして記載：20.6.3.0.38。影響ありとして記載：20.6.3.0.39。影響ありとして記載：20.3.5.1。影響ありとして記載：20.3.4.3。影響ありとして記載：20.9.3.1。影響ありとして記載：20.3.3.2。影響ありとして記載：20.6.5.2。影響ありとして記載：20.3.7.1。影響ありとして記載：20.10.1.1。影響ありとして記載：20.6.5.2.1。影響ありとして記載：20.3.4.0.25。影響ありとして記載：20.6.2.2.4。影響ありとして記載：20.6.1.2。影響ありとして記載：20.11.1.1。影響ありとして記載：20.9.3.0.5。影響ありとして記載：20.3.4.0.26。影響ありとして記載：20.6.5.1.3。影響ありとして記載：20.6.3.0.40。影響ありとして記載：20.1.3.1。影響ありとして記載：20.9.2.2。影響ありとして記載：20.6.5.2.3。影響ありとして記載：20.6.5.1.4。影響ありとして記載：20.6.5.3。影響ありとして記載：20.6.3.0.41。影響ありとして記載：20.9.3.0.7。影響ありとして記載：20.6.5.1.5。影響ありとして記載：20.9.3.0.4。影響ありとして記載：20.6.4.0.19。影響ありとして記載：20.6.5.1.6。影響ありとして記載：20.9.3.0.8。影響ありとして記載：20.6.3.3。影響ありとして記載：20.3.7.2。影響ありとして記載：20.6.5.4。影響ありとして記載：20.6.5.1.7。影響ありとして記載：20.9.3.0.12。影響ありとして記載：20.6.4.2。影響ありとして記載：20.6.5.5。影響ありとして記載：20.9.3.2。影響ありとして記載：20.11.1.2。影響ありとして記載：20.6.3.4。影響ありとして記載：20.10.1.2。影響ありとして記載：20.6.5.1.9。影響ありとして記載：20.9.3.0.16。影響ありとして記載：20.6.3.0.45。影響ありとして記載：20.6.5.1.10。影響ありとして記載：20.9.3.0.17。影響ありとして記載：20.6.5.2.4。影響ありとして記載：20.6.4.0.21。影響ありとして記載：20.9.3.0.18。影響ありとして記載：20.6.3.0.46。影響ありとして記載：20.6.3.0.47。影響ありとして記載：20.9.2.3。影響ありとして記載：20.9.3.2_LI_Images。影響ありとして記載：20.9.3.0.21。影響ありとして記載：20.9.3.0.20。影響ありとして記載：20.9.4_LI_Images。影響ありとして記載：20.9.4。影響ありとして記載：20.6.5.1.11。影響ありとして記載：20.12.1。影響ありとして記載：20.12.1_LI_Images。影響ありとして記載：20.6.5.1.13。影響ありとして記載：20.9.3.0.23。影響ありとして記載：20.6.5.2.8。影響ありとして記載：20.9.4.1。影響ありとして記載：20.9.4.1_LI_Images。影響ありとして記載：20.9.3.0.25。影響ありとして記載：20.9.3.0.24。影響ありとして記載：20.6.5.1.14。影響ありとして記載：20.3.8。影響ありとして記載：20.6.6。影響ありとして記載：20.9.3.0.26。影響ありとして記載：20.6.3.0.51。影響ありとして記載：20.9.3.0.29。影響ありとして記載：20.12.2。影響ありとして記載：20.12.2_LI_Images。影響ありとして記載：20.6.6.0.1。影響ありとして記載：20.13.1_LI_Images。影響ありとして記載：20.9.4.0.4。影響ありとして記載：20.13.1。影響ありとして記載：20.9.4.1.1。影響ありとして記載：20.9.5。影響ありとして記載：20.9.5_LI_Images。影響ありとして記載：20.12.3_LI_Images。影響ありとして記載：20.12.3。影響ありとして記載：20.9.4.1.3。影響ありとして記載：20.6.7。影響ありとして記載：20.9.5.1。影響ありとして記載：20.9.5.1_LI_Images。影響ありとして記載：20.9.4.1.6。影響ありとして記載：20.14.1。影響ありとして記載：20.14.1_LI_Images。影響ありとして記載：20.9.5.2。影響ありとして記載：20.9.5.2.1。影響ありとして記載：20.9.5.2_LI_Images。影響ありとして記載：20.12.3.1。影響ありとして記載：20.12.4。影響ありとして記載：20.15.1_LI_Images。影響ありとして記載：20.15.1。影響ありとして記載：20.9.5.1.4。影響ありとして記載：20.9.5.2.7。影響ありとして記載：20.9.5.2.13。影響ありとして記載：20.9.6。影響ありとして記載：20.9.6_LI_Images。影響ありとして記載：20.9.5.2.14。影響ありとして記載：20.6.8。影響ありとして記載：20.12.4.0.03。影響ありとして記載：20.16.1。影響ありとして記載：20.16.1_LI_Images。影響ありとして記載：20.12.4_LI_Images。影響ありとして記載：20.9.5.2.16。影響ありとして記載：20.12.4.0.4。影響ありとして記載：20.12.401。影響ありとして記載：20.9.5.3。影響ありとして記載：20.9.5.3_LI_Images。個別に記されていない版の影響は、原資料でも未確定です。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20127", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:45.093Z", "lastSuccess": "2026-10-23T03:24:45.093Z", "sourceCheckedAt": "2026-10-23T02:43:47.244Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-25108", "aliases": [], "title": "FileZen：コード実行", "summary": "FileZen のウイルスチェックオプションが有効な場合、ログインしているユーザーが細工した HTTP リクエストを送信すると、任意の OS コマンドを実行させられる可能性があります。", "risk": "細工した HTTP リクエストを受け取った場合、任意の OS コマンドが実行される可能性があります。", "product": "FileZen", "category": "other", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.0", "cvssSource": "jpcert", "cvssVector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "FileZen", "range": "V5.0.0 to V5.0.10" }, { "product": "FileZen", "range": "V4.2.1 to V4.2.8" } ], "fixed": [], "steps": [ "開発者が提供する情報に従い、FileZen を最新版のファームウェア（FileZen V5.0.11）にアップデートしてください。", "「CVE-2026-25108」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://jvn.jp/jp/JVN84622767/", "label": "CVE：jpcert" }, { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "label": "CVE：jpcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25108", "label": "CVE公式レコード" }, { "url": "https://www.soliton.co.jp/support/2026/006657.html", "label": "CVE掲載の参考情報" }, { "url": "https://jvn.jp/en/jp/JVN84622767/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25108", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-13T03:39:03.795Z", "modifiedAt": "2026-02-26T14:44:20.718Z", "fetchedAt": "2026-10-23T02:43:48.134Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Soliton Systems K.K.", "product": "FileZen", "versions": [ { "version": "V5.0.0 to V5.0.10", "status": "affected" } ] }, { "vendor": "Soliton Systems K.K.", "product": "FileZen", "versions": [ { "version": "V4.2.1 to V4.2.8", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-25108", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "fetchedAt": "2026-10-23T02:43:48.134Z", "publishedAt": "2026-02-13T03:39:03.795Z", "modifiedAt": "2026-02-26T14:44:20.718Z", "state": "published", "provider": "jpcert", "title": "", "descriptions": [ { "lang": "en", "value": "FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Soliton Systems K.K.", "product": "FileZen", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "V5.0.0 to V5.0.10", "status": "affected" } ] }, { "vendor": "Soliton Systems K.K.", "product": "FileZen", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "V4.2.1 to V4.2.8", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en-US", "description": "Improper neutralization of special elements used in an OS command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "jpcert", "sourcePath": "/containers/cna/metrics/0/cvssV3_0" }, { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.7, "baseSeverity": "HIGH", "provider": "jpcert", "sourcePath": "/containers/cna/metrics/1/cvssV4_0" } ], "references": [ { "url": "https://www.soliton.co.jp/support/2026/006657.html", "label": "jpcert", "tags": [], "provider": "jpcert", "sourcePath": "/containers/cna/references/0" }, { "url": "https://jvn.jp/en/jp/JVN84622767/", "label": "jpcert", "tags": [], "provider": "jpcert", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-25108", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Soliton Systems K.K.\",\"product\":\"FileZen\",\"versions\":[{\"version\":\"V5.0.0 to V5.0.10\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Soliton Systems K.K.\",\"product\":\"FileZen\",\"versions\":[{\"version\":\"V4.2.1 to V4.2.8\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Improper neutralization of special elements used in an OS command ('OS Command Injection')\",\"lang\":\"en-US\",\"cweId\":\"CWE-78\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_0", "text": "{\"version\":\"3.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/1/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourcePath": "/containers/cna/metrics/1/cvssV4_0", "text": "{\"version\":\"4.0\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.7,\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "linked:JVN84622767:section:概要", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:概要", "text": "株式会社ソリトンシステムズが提供するFileZenには、OSコマンドインジェクションの脆弱性が存在します。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" }, { "evidenceId": "linked:JVN84622767:section:影響を受けるシステム", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:影響を受けるシステム", "text": "FileZen V5.0.0からV5.0.10までのバージョン\n\nFileZen V4.2.1からV4.2.8までのバージョン\n\nなお、FileZen Sは本脆弱性の影響を受けません。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" }, { "evidenceId": "linked:JVN84622767:section:詳細情報", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:詳細情報", "text": "株式会社ソリトンシステムズが提供するFileZenには、次の脆弱性が存在します。\n\nOSコマンドインジェクション（ CWE-78 ）\n\nCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 基本値 8.7\n\nCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 基本値 8.8\n\nCVE-2026-25108\n\nFileZenウイルスチェックオプションが有効な場合、本脆弱性の影響を受けます\n\n開発者によると、本脆弱性を悪用した攻撃が既に確認されています。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" }, { "evidenceId": "linked:JVN84622767:section:想定される影響", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:想定される影響", "text": "当該製品にログインしているユーザによって細工したHTTPリクエストを送信された場合、任意のOSコマンドを実行される可能性があります。", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" }, { "evidenceId": "linked:JVN84622767:section:対策方法", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:対策方法", "text": "アップデートする\n\n開発者が提供する情報をもとに、ファームウェアを最新版にアップデートしてください。\n\n開発者は、本脆弱性を修正した次のファームウェアをリリースしています。\n\nFileZen V5.0.11", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" }, { "evidenceId": "linked:JVN84622767:section:ベンダ情報", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourcePath": "section:ベンダ情報", "text": "ベンダ\nステータス\nステータス\n最終更新日\nベンダの告知ページ\n\n株式会社ソリトンシステムズ\n\n該当製品あり\n\n2026/02/13\n\n株式会社ソリトンシステムズ の告知ページ", "truncated": false, "representation": "source_excerpt", "relatedCve": "CVE-2026-25108", "relatedJvn": "JVN84622767" } ], "limits": { "completeness": "official_record_with_linked_advisories", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。 CVEが直接参照しているJVN記事の日本語本文を、記事中のCVE番号を照合して追加しています。", "excludedJvnSources": [] }, "supplementarySources": [ { "sourceType": "JVN", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "id": "JVN84622767", "modifiedAt": "2026-02-12T15:00:00.000Z" } ], "relatedDocuments": [ { "type": "jvn", "id": "JVN84622767", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "modifiedAt": "2026-02-12T15:00:00.000Z", "affectedStatements": [ { "lang": "ja", "value": "FileZen V5.0.0からV5.0.10までのバージョン\n\nFileZen V4.2.1からV4.2.8までのバージョン\n\nなお、FileZen Sは本脆弱性の影響を受けません。", "sourcePath": "section:影響を受けるシステム" } ], "solutions": [ { "lang": "ja", "value": "アップデートする\n\n開発者が提供する情報をもとに、ファームウェアを最新版にアップデートしてください。\n\n開発者は、本脆弱性を修正した次のファームウェアをリリースしています。\n\nFileZen V5.0.11", "sourcePath": "section:対策方法" } ] } ] }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T14:44:20.718Z", "fetchedAt": "2026-10-23T02:43:48.134Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-24T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "FileZenにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:45.381Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b4d2e344b303bb2384ae9a8b7bfb74d109b4fabf54765e4b0e66b9adbc8b9aa7", "sourceModifiedAt": "2026-02-26T14:44:20.718Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "FileZen のウイルスチェックオプションが有効な場合、ログインしているユーザーが細工した HTTP リクエストを送信すると、任意の OS コマンドを実行させられる可能性があります。", "risk": "細工した HTTP リクエストを受け取った場合、任意の OS コマンドが実行される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "FileZen V5.0.0 から V5.0.10 は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "https://jvn.jp/jp/JVN84622767/" ], "evidenceIds": [ "E3", "E4" ] }, { "text": "FileZen V4.2.1 から V4.2.8 は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "https://jvn.jp/jp/JVN84622767/" ], "evidenceIds": [ "E5", "E4" ] }, { "text": "FileZen S はこの脆弱性の影響を受けません。", "kind": "fact", "sourceUrls": [ "https://jvn.jp/jp/JVN84622767/" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Soliton Systems K.K. / FileZen。影響ありとして記載：V5.0.0 to V5.0.10。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Soliton Systems K.K. / FileZen。影響ありとして記載：V4.2.1 to V4.2.8。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json" ], "evidenceIds": [ "E5" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108" ], "evidenceIds": [ "E7" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json" ], "evidenceIds": [ "E3" ] }, { "text": "「FileZen」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-25108", "https://www.soliton.co.jp/support/2026/006657.html", "https://jvn.jp/en/jp/JVN84622767/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "https://nvd.nist.gov/vuln/detail/CVE-2026-25108" ] } ], "actions": [ { "text": "開発者が提供する情報に従い、FileZen を最新版のファームウェア（FileZen V5.0.11）にアップデートしてください。", "kind": "fix", "sourceUrls": [ "https://jvn.jp/jp/JVN84622767/" ], "evidenceIds": [ "E6" ] }, { "text": "「CVE-2026-25108」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-25108", "https://www.soliton.co.jp/support/2026/006657.html", "https://jvn.jp/en/jp/JVN84622767/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "https://nvd.nist.gov/vuln/detail/CVE-2026-25108" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-25108", "https://www.soliton.co.jp/support/2026/006657.html", "https://jvn.jp/en/jp/JVN84622767/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "https://nvd.nist.gov/vuln/detail/CVE-2026-25108" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-25108", "https://www.soliton.co.jp/support/2026/006657.html", "https://jvn.jp/en/jp/JVN84622767/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "https://nvd.nist.gov/vuln/detail/CVE-2026-25108" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-25108", "https://www.soliton.co.jp/support/2026/006657.html", "https://jvn.jp/en/jp/JVN84622767/", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "https://nvd.nist.gov/vuln/detail/CVE-2026-25108" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://jvn.jp/jp/JVN84622767/", "label": "CVE：jpcert" }, { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "label": "CVE：jpcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25108", "label": "CVE公式レコード" }, { "url": "https://www.soliton.co.jp/support/2026/006657.html", "label": "CVE掲載の参考情報" }, { "url": "https://jvn.jp/en/jp/JVN84622767/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25108", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourceField": "section:想定される影響", "excerpt": "当該製品にログインしているユーザによって細工したHTTPリクエストを送信された場合、任意のOSコマンドを実行される可能性があります。", "language": null, "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Soliton Systems K.K.\",\"product\":\"FileZen\",\"versions\":[{\"version\":\"V5.0.0 to V5.0.10\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourceField": "section:影響を受けるシステム", "excerpt": "FileZen V5.0.0からV5.0.10までのバージョン\n\nFileZen V4.2.1からV4.2.8までのバージョン\n\nなお、FileZen Sは本脆弱性の影響を受けません。", "language": null, "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/25xxx/CVE-2026-25108.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Soliton Systems K.K.\",\"product\":\"FileZen\",\"versions\":[{\"version\":\"V4.2.1 to V4.2.8\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://jvn.jp/jp/JVN84622767/", "sourceField": "section:対策方法", "excerpt": "アップデートする\n\n開発者が提供する情報をもとに、ファームウェアを最新版にアップデートしてください。\n\n開発者は、本脆弱性を修正した次のファームウェアをリリースしています。\n\nFileZen V5.0.11", "language": null, "representation": "source_excerpt" }, { "id": "E7", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-25108", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-25108\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-25108（FileZen）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・FileZen V5.0.0 から V5.0.10 は影響を受けます。\n・FileZen V4.2.1 から V4.2.8 は影響を受けます。\n・FileZen S はこの脆弱性の影響を受けません。\n・公式の対象表：Soliton Systems K.K. / FileZen。影響ありとして記載：V5.0.0 to V5.0.10。\n・公式の対象表：Soliton Systems K.K. / FileZen。影響ありとして記載：V4.2.1 to V4.2.8。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-25108", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:45.381Z", "lastSuccess": "2026-10-23T03:24:45.381Z", "sourceCheckedAt": "2026-10-23T02:43:48.134Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2025-49113", "aliases": [], "title": "Webmail：コード実行", "summary": "Roundcube Webmail のバージョンが 1.5.10 未満および 1.6.x 系で 1.6.11 未満の場合、認証済みユーザーが URL の _from パラメータを検証せずに program/actions/settings/upload.php に送信できるため、PHP オブジェクトの逆シリアライズが発生し、リモートコード実行が可能になる。", "risk": "認証済みユーザーがこの脆弱性を悪用すると、サーバー上で攻撃者のコードが実行される可能性がある。", "product": "Webmail", "category": "other", "component": "package", "severity": "critical", "cvss": 9.9, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "Webmail", "range": "< 1.5.10" }, { "product": "Webmail", "range": ">= 1.6.0 / < 1.6.11" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-49113", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/pull/9865", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "label": "CVE掲載の参考情報" }, { "url": "https://fearsoff.org/research/roundcube", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49113", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-06-02T00:00:00.000Z", "modifiedAt": "2026-02-21T04:56:23.141Z", "fetchedAt": "2026-10-23T02:43:38.966Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Webmail", "vendor": "Roundcube", "versions": [ { "lessThan": "1.5.10", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "1.6.11", "status": "affected", "version": "1.6.0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-49113", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "fetchedAt": "2026-10-23T02:43:38.966Z", "publishedAt": "2025-06-02T00:00:00.000Z", "modifiedAt": "2026-02-21T04:56:23.141Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Roundcube", "product": "Webmail", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "1.5.10", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "1.6.0", "lessThan": "1.6.11", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/pull/9865", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/3" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/4" }, { "url": "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/5" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/6" }, { "url": "https://fearsoff.org/research/roundcube", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/7" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/8" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/9" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-49113", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.openwall.com/lists/oss-security/2025/06/02/3", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00008.html", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Webmail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.5.10\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.6.11\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-502\",\"description\":\"CWE-502 Deserialization of Untrusted Data\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-21T04:56:23.141Z", "fetchedAt": "2026-10-23T02:43:38.966Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Webmailにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:45.494Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "a2db22c9e83a79aad8454762befcffb333b17e81f4e139dc2de4092d59e3b40b", "sourceModifiedAt": "2026-02-21T04:56:23.141Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Roundcube Webmail のバージョンが 1.5.10 未満および 1.6.x 系で 1.6.11 未満の場合、認証済みユーザーが URL の _from パラメータを検証せずに program/actions/settings/upload.php に送信できるため、PHP オブジェクトの逆シリアライズが発生し、リモートコード実行が可能になる。", "risk": "認証済みユーザーがこの脆弱性を悪用すると、サーバー上で攻撃者のコードが実行される可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Roundcube Webmail のバージョンが 1.5.10 未満の場合に影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] }, { "text": "Roundcube Webmail の 1.6.0 以上 1.6.11 未満のバージョン（1.6.x 系）に影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Roundcube / Webmail。影響ありとして記載：1.5.10未満の版。影響ありとして記載：1.6.0以上、1.6.11未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Webmail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-49113", "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "https://github.com/roundcube/roundcubemail/pull/9865", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "https://fearsoff.org/research/roundcube", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "https://nvd.nist.gov/vuln/detail/CVE-2025-49113" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-49113", "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "https://github.com/roundcube/roundcubemail/pull/9865", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "https://fearsoff.org/research/roundcube", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "https://nvd.nist.gov/vuln/detail/CVE-2025-49113" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-49113", "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "https://github.com/roundcube/roundcubemail/pull/9865", "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "https://fearsoff.org/research/roundcube", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "https://nvd.nist.gov/vuln/detail/CVE-2025-49113" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-49113", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/pull/9865", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.11", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/0376f69e958a8fef7f6f09e352c541b4e7729c4d", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.5.10", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/7408f31379666124a39f9cb1018f62bc5e2dc695", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/c50a07d88ca38f018a0f4a0b008e9a1deb32637e", "label": "CVE掲載の参考情報" }, { "url": "https://fearsoff.org/research/roundcube", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-vulnerability-detection", "label": "CVE掲載の参考情報" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2025-49113-roundcube-mitigation-script", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49113", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/49xxx/CVE-2025-49113.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Webmail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.5.10\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.6.11\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-49113", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-49113\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-49113（Webmail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Roundcube Webmail のバージョンが 1.5.10 未満の場合に影響を受ける。\n・Roundcube Webmail の 1.6.0 以上 1.6.11 未満のバージョン（1.6.x 系）に影響を受ける。\n・公式の対象表：Roundcube / Webmail。影響ありとして記載：1.5.10未満の版。影響ありとして記載：1.6.0以上、1.6.11未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-49113", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:45.494Z", "lastSuccess": "2026-10-23T03:24:45.494Z", "sourceCheckedAt": "2026-10-23T02:43:38.966Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-68461", "aliases": [], "title": "Webmail：ブラウザー上での不正な処理", "summary": "Roundcube Webmail の 1.5.12 未満および 1.6 系の 1.6.12 未満のバージョンは、SVG 文書内の animate タグを介したクロスサイトスクリプティング (XSS) の脆弱性があります。", "risk": "攻撃者が SVG 文書の animate タグを利用して、ページを閲覧したユーザーのブラウザーで不正なスクリプトが実行される可能性があります。", "product": "Webmail", "category": "other", "component": "package", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "mitre", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "affected": [ { "product": "Webmail", "range": "< 1.5.12" }, { "product": "Webmail", "range": ">= 1.6.0 / < 1.6.12" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68461", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2025-12-18T05:00:54.423Z", "modifiedAt": "2026-10-01T18:12:05.532Z", "fetchedAt": "2026-10-23T02:43:40.210Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Webmail", "vendor": "Roundcube", "versions": [ { "lessThan": "1.5.12", "status": "affected", "version": "0", "versionType": "semver" }, { "lessThan": "1.6.12", "status": "affected", "version": "1.6.0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-68461", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "fetchedAt": "2026-10-23T02:43:40.210Z", "publishedAt": "2025-12-18T05:00:54.423Z", "modifiedAt": "2026-10-01T18:12:05.532Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Roundcube", "product": "Webmail", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "1.5.12", "versionType": "semver", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "1.6.0", "lessThan": "1.6.12", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "mitre", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/0" }, { "url": "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "label": "mitre", "tags": [], "provider": "mitre", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-68461", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Webmail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.5.12\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.6.12\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-79\",\"description\":\"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T18:12:05.532Z", "fetchedAt": "2026-10-23T02:43:40.210Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-20T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Webmailにブラウザー上での不正な処理に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "利用者のブラウザー上で不正なスクリプトが動く可能性があります。成立条件は原文を確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:46.244Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "6b6de49ec23214e33aff04c52e6d711ad1d6a776b3039e899224785f3d8088e3", "sourceModifiedAt": "2026-10-01T18:12:05.532Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Roundcube Webmail の 1.5.12 未満および 1.6 系の 1.6.12 未満のバージョンは、SVG 文書内の animate タグを介したクロスサイトスクリプティング (XSS) の脆弱性があります。", "risk": "攻撃者が SVG 文書の animate タグを利用して、ページを閲覧したユーザーのブラウザーで不正なスクリプトが実行される可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Roundcube Webmail のバージョンが 1.5.12 未満の場合に脆弱性の影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] }, { "text": "Roundcube Webmail の 1.6 系バージョンで 1.6.12 未満（1.6.0 以上）の場合に脆弱性の影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] }, { "text": "公式の対象表：Roundcube / Webmail。影響ありとして記載：1.5.12未満の版。影響ありとして記載：1.6.0以上、1.6.12未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Webmail」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68461", "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "https://nvd.nist.gov/vuln/detail/CVE-2025-68461" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-68461", "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "https://nvd.nist.gov/vuln/detail/CVE-2025-68461" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-68461", "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "https://nvd.nist.gov/vuln/detail/CVE-2025-68461" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68461", "label": "CVE公式レコード" }, { "url": "https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12", "label": "CISAが示す関連情報" }, { "url": "https://github.com/roundcube/roundcubemail/commit/bfa032631c36b900e7444dfa278340b33cbf7cdb", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68461", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/68xxx/CVE-2025-68461.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Webmail\",\"vendor\":\"Roundcube\",\"versions\":[{\"lessThan\":\"1.5.12\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"},{\"lessThan\":\"1.6.12\",\"status\":\"affected\",\"version\":\"1.6.0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-68461", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-68461\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-68461（Webmail）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Roundcube Webmail のバージョンが 1.5.12 未満の場合に脆弱性の影響を受けます。\n・Roundcube Webmail の 1.6 系バージョンで 1.6.12 未満（1.6.0 以上）の場合に脆弱性の影響を受けます。\n・公式の対象表：Roundcube / Webmail。影響ありとして記載：1.5.12未満の版。影響ありとして記載：1.6.0以上、1.6.12未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-68461", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:46.244Z", "lastSuccess": "2026-10-23T03:24:46.244Z", "sourceCheckedAt": "2026-10-23T02:43:40.210Z", "errorCode": null }, "glossary": [ { "term": "XSS", "meaning": "ページに紛れ込ませた不正な処理が、ページを表示した人のブラウザーで動く問題です。誰が仕込めるか、どの画面を表示すると動くかが判断のポイントです。", "sourceUrl": "https://cwe.mitre.org/data/definitions/79.html", "kind": "general_definition" } ] } }, { "id": "CVE-2021-22175", "aliases": [], "title": "GitLab：脆弱性情報", "summary": "内部ネットワークへのウェブフックリクエストが有効になっている場合、GitLab（バージョン10.5以降）にサーバーサイドリクエストフォージェリ（SSRF）の脆弱性が存在し、登録が無効化されているインスタンスでも認証されていない攻撃者が悪用できる可能性があります。", "risk": "攻撃者が内部ネットワークに対して任意のリクエストを送信できる可能性がある。", "product": "GitLab", "category": "other", "component": "package", "severity": "medium", "cvss": 6.8, "cvssVersion": "3.1", "cvssSource": "GitLab", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "affected": [ { "product": "GitLab", "range": ">=10.5, <13.6.7" }, { "product": "GitLab", "range": ">=13.7, <13.7.7" }, { "product": "GitLab", "range": ">=13.8, <13.8.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "label": "CVE：GitLab" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22175", "label": "CVE公式レコード" }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/1059596", "label": "CVE掲載の参考情報" }, { "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22175", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2021-06-11T15:30:12.000Z", "modifiedAt": "2026-10-01T18:12:57.574Z", "fetchedAt": "2026-10-23T02:43:14.925Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "GitLab", "vendor": "GitLab", "versions": [ { "status": "affected", "version": ">=10.5, <13.6.7" }, { "status": "affected", "version": ">=13.7, <13.7.7" }, { "status": "affected", "version": ">=13.8, <13.8.4" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2021-22175", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "fetchedAt": "2026-10-23T02:43:14.925Z", "publishedAt": "2021-06-11T15:30:12.000Z", "modifiedAt": "2026-10-01T18:12:57.574Z", "state": "published", "provider": "GitLab", "title": "", "descriptions": [ { "lang": "en", "value": "When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "GitLab", "product": "GitLab", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": ">=10.5, <13.6.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": ">=13.7, <13.7.7", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/2", "version": ">=13.8, <13.8.4", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "Server-side request forgery (ssrf) in GitLab", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "provider": "GitLab", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://hackerone.com/reports/1059596", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22175", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"GitLab\",\"vendor\":\"GitLab\",\"versions\":[{\"status\":\"affected\",\"version\":\">=10.5, <13.6.7\"},{\"status\":\"affected\",\"version\":\">=13.7, <13.7.7\"},{\"status\":\"affected\",\"version\":\">=13.8, <13.8.4\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"Server-side request forgery (ssrf) in GitLab\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-10-01T18:12:57.574Z", "fetchedAt": "2026-10-23T02:43:14.925Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-18T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "GitLabに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:46.294Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d4c2e8096985f526c4505b1610046f10fc91d8605093ca19e5c77ce9c3002e5e", "sourceModifiedAt": "2026-10-01T18:12:57.574Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "内部ネットワークへのウェブフックリクエストが有効になっている場合、GitLab（バージョン10.5以降）にサーバーサイドリクエストフォージェリ（SSRF）の脆弱性が存在し、登録が無効化されているインスタンスでも認証されていない攻撃者が悪用できる可能性があります。", "risk": "攻撃者が内部ネットワークに対して任意のリクエストを送信できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "ウェブフック用の内部ネットワークへのリクエストが有効になっていること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E1" ] }, { "text": "GitLab インスタンスでユーザー登録が無効化されていても、脆弱性は利用可能であること。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：GitLab / GitLab。影響ありとして記載：>=10.5, <13.6.7。影響ありとして記載：>=13.7, <13.7.7。影響ありとして記載：>=13.8, <13.8.4。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E2" ] }, { "text": "「GitLab」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22175", "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "https://hackerone.com/reports/1059596", "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "https://nvd.nist.gov/vuln/detail/CVE-2021-22175" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2021-22175", "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "https://hackerone.com/reports/1059596", "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "https://nvd.nist.gov/vuln/detail/CVE-2021-22175" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2021-22175", "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "https://hackerone.com/reports/1059596", "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "https://nvd.nist.gov/vuln/detail/CVE-2021-22175" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "label": "CVE：GitLab" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-22175", "label": "CVE公式レコード" }, { "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/294178", "label": "CVE掲載の参考情報" }, { "url": "https://hackerone.com/reports/1059596", "label": "CVE掲載の参考情報" }, { "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22175.json", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22175", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22175.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"GitLab\",\"vendor\":\"GitLab\",\"versions\":[{\"status\":\"affected\",\"version\":\">=10.5, <13.6.7\"},{\"status\":\"affected\",\"version\":\">=13.7, <13.7.7\"},{\"status\":\"affected\",\"version\":\">=13.8, <13.8.4\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22175", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2021-22175\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2021-22175（GitLab）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・ウェブフック用の内部ネットワークへのリクエストが有効になっていること。\n・GitLab インスタンスでユーザー登録が無効化されていても、脆弱性は利用可能であること。\n・公式の対象表：GitLab / GitLab。影響ありとして記載：>=10.5, <13.6.7。影響ありとして記載：>=13.7, <13.7.7。影響ありとして記載：>=13.8, <13.8.4。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2021-22175", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:46.294Z", "lastSuccess": "2026-10-23T03:24:46.294Z", "sourceCheckedAt": "2026-10-23T02:43:14.925Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2026-22769", "aliases": [], "title": "Dell RecoverPoint for Virtual Machines：埋め込まれた認証情報による不正アクセス", "summary": "仮想マシンの保護に使うDell RecoverPoint for Virtual Machinesが対象です。CVE本文は6.0.3.1 HF1より前の版を説明し、構造化表には5.3 SP4 P1と複数の6.0系列の版を記載しています。利用中の完全な版を確認し、DellのDSA-2026-079に沿った更新または緩和策を早急に依頼してください。", "risk": "製品に埋め込まれた固定の認証情報を知っている遠隔の攻撃者が、通常のログイン権限を持たなくても、基盤となるOSへ不正に入れる可能性があります。成功するとrootという強い権限で侵入状態を維持されるおそれがあります。root権限を最初から持つことが攻撃条件という意味ではありません。", "product": "Dell RecoverPoint for Virtual Machines", "category": "other", "component": "package", "severity": "critical", "cvss": 10, "cvssVersion": "3.1", "cvssSource": "dell", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "affected": [ { "product": "RecoverPoint for Virtual Machines", "range": "本文では6.0.3.1 HF1より前。構造化表には5.3 SP4 P1と、6.0 / 6.0 SP1 / 6.0 SP1 P1 / 6.0 SP1 P2 / 6.0 SP2 / 6.0 SP2 P1 / 6.0 SP3 / 6.0 SP3 P1を記載。複数の版を単一の大小比較には変換できません。" } ], "fixed": [], "steps": [ "Dellは、更新またはいずれかの緩和策をできるだけ早く適用するよう推奨しています。担当者にDSA-2026-079を指定し、利用中の製品版に対応する更新・Hot Fix・緩和手順を確認して実施するよう依頼してください。", "バックアップ・復旧に関係する製品なので、更新中の保護対象、停止時間、復旧手順を担当者と決めます。侵入の疑いがある場合は、更新の適用だけで侵入状態の解消を断定せず、基盤OSへの不審なアクセスも調査するよう伝えてください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "label": "CVEの公表者が記載した公式レコード" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22769", "label": "CVE公式レコード" }, { "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "label": "公式レコードが案内する提供元の告知" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22769", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa", "label": "CISAが示す関連情報" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22769", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-17T19:19:34.178Z", "modifiedAt": "2026-02-26T14:44:19.536Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.", "sourceTitle": "", "summaryMethod": "公式資料を照合した個別の日本語解説。一般的な操作手順は別に区別しています。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "RecoverPoint for Virtual Machines", "vendor": "Dell", "versions": [ { "lessThan": "6.0.3.1 HF1", "status": "affected", "version": "5.3 SP4 P1", "versionType": "semver" } ] }, { "defaultStatus": "unaffected", "product": "RecoverPoint for Virtual Machines", "vendor": "Dell", "versions": [ { "lessThan": "6.0.3.1 HF1", "status": "affected", "version": "6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-22769", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "fetchedAt": "2026-10-23T02:43:47.937Z", "publishedAt": "2026-02-17T19:19:34.178Z", "modifiedAt": "2026-02-26T14:44:19.536Z", "state": "published", "provider": "dell", "title": "", "descriptions": [ { "lang": "en", "value": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Dell", "product": "RecoverPoint for Virtual Machines", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "5.3 SP4 P1", "lessThan": "6.0.3.1 HF1", "versionType": "semver", "status": "affected" } ] }, { "vendor": "Dell", "product": "RecoverPoint for Virtual Machines", "sourcePath": "/containers/cna/affected/1", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1", "lessThan": "6.0.3.1 HF1", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-798", "lang": "en", "description": "CWE-798: Use of Hard-coded Credentials", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10, "baseSeverity": "CRITICAL", "provider": "dell", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "label": "dell", "tags": [ "vendor-advisory" ], "provider": "dell", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"RecoverPoint for Virtual Machines\",\"vendor\":\"Dell\",\"versions\":[{\"lessThan\":\"6.0.3.1 HF1\",\"status\":\"affected\",\"version\":\"5.3 SP4 P1\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"RecoverPoint for Virtual Machines\",\"vendor\":\"Dell\",\"versions\":[{\"lessThan\":\"6.0.3.1 HF1\",\"status\":\"affected\",\"version\":\"6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-798\",\"description\":\"CWE-798: Use of Hard-coded Credentials\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":10,\"baseSeverity\":\"CRITICAL\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"CHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T14:44:19.536Z", "fetchedAt": "2026-10-23T02:43:47.937Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-18T00:00:00.000Z", "fetchedAt": "2026-10-23T03:17:49.705Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "RecoverPoint for Virtual Machinesに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "reviewed", "reviewedAt": "2026-10-23T04:07:11.000Z", "reviewState": "current", "summary": "仮想マシンの保護に使うDell RecoverPoint for Virtual Machinesが対象です。CVE本文は6.0.3.1 HF1より前の版を説明し、構造化表には5.3 SP4 P1と複数の6.0系列の版を記載しています。利用中の完全な版を確認し、DellのDSA-2026-079に沿った更新または緩和策を早急に依頼してください。", "risk": "製品に埋め込まれた固定の認証情報を知っている遠隔の攻撃者が、通常のログイン権限を持たなくても、基盤となるOSへ不正に入れる可能性があります。成功するとrootという強い権限で侵入状態を維持されるおそれがあります。root権限を最初から持つことが攻撃条件という意味ではありません。", "applicability": [ { "text": "対象はDell RecoverPoint for Virtual Machinesです。通常のアカウントを持たない遠隔の攻撃者でも、製品に固定された認証情報を知っていることが成立条件として記載されています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] }, { "text": "対象表の1行目は5.3 SP4 P1、2行目は6.0、6.0 SP1、6.0 SP1 P1、6.0 SP1 P2、6.0 SP2、6.0 SP2 P1、6.0 SP3、6.0 SP3 P1と列挙されています。各行にはlessThan=6.0.3.1 HF1も入っていますが、複数の版名を含むため「5.3 SP4 P1以上ならすべて対象」と単純に広げず、利用中の系列をDellの表で照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "最初に「Dell RecoverPoint for Virtual Machines」を使っているか、開発元・製品名・バージョンを確認します。同じカテゴリの製品を使っているだけでは、この問題の対象とは限りません。", "kind": "check", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "https://nvd.nist.gov/vuln/detail/CVE-2026-22769" ] } ], "versionChecks": [ { "text": "管理担当者へ、利用中の製品名・完全な版番号・OSや機器の型番・適用済みの更新履歴を確認してもらいます。下の対象条件と一致するか、対象外と判断した理由も含めて回答を依頼してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] } ], "actions": [ { "text": "Dellは、更新またはいずれかの緩和策をできるだけ早く適用するよう推奨しています。担当者にDSA-2026-079を指定し、利用中の製品版に対応する更新・Hot Fix・緩和手順を確認して実施するよう依頼してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] }, { "text": "バックアップ・復旧に関係する製品なので、更新中の保護対象、停止時間、復旧手順を担当者と決めます。侵入の疑いがある場合は、更新の適用だけで侵入状態の解消を断定せず、基盤OSへの不審なアクセスも調査するよう伝えてください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "https://nvd.nist.gov/vuln/detail/CVE-2026-22769" ] } ], "temporaryMitigations": [ { "text": "修正を適用するまでに、管理用接続を信頼できる接続元へ限定できるかを管理者と検討します。これは一般的な接続制限であり、Dellが指定する緩和手順を完了したことにはなりません。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] } ], "verification": [ { "text": "更新や設定変更の反映後、稼働中の版・設定が計画どおりであることと、通常業務が正常に行えることを担当者と確認します。対象のCVEへの対応を含むことが確認できてから完了とします。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22769", "https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa", "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "https://nvd.nist.gov/vuln/detail/CVE-2026-22769" ] } ], "unknowns": [ "6.0.3.1 HF1は本文と対象表の境界として記載されていますが、取得したCVEのsolutions欄には修正版の説明がありません。境界だけから修正の適用手順や提供状況を補っていません。複雑な版表記の解釈は提供元の告知で照合してください。" ], "supportRequest": "件名：CVE-2026-22769（Dell RecoverPoint for Virtual Machines）の影響と対応状況の確認\n\n利用中のサイト・機器・サービス：[記入してください]\n製品名・開発元：[記入してください]\n現在のバージョン・ビルド番号：[不明なら「不明」と記入]\n\nCVE-2026-22769について、次を教えてください。\n1. この環境は対象ですか。対象外の場合は、版・設定・機能などの判断理由を教えてください。\n2. 対象の場合、修正を含む版・パッケージ番号と、更新方法を教えてください。古い版に修正を取り込んでいる場合は、このCVEへの対応状況を教えてください。\n3. いつ対応できますか。再起動・停止時間・事前のバックアップや確認作業は必要ですか。\n4. すぐ更新できない場合、正式な回避策とその限界・副作用を教えてください。利用を続けてよい条件も知りたいです。\n5. 対応完了後、修正を確認できる版・設定・対応日時を連絡してください。\n\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-22769", "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "label": "CVEの公表者が記載した公式レコード" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22769", "label": "CVE公式レコード" }, { "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079", "label": "公式レコードが案内する提供元の告知" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-22769", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa", "label": "CISAが示す関連情報" }, { "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22769", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "reviewedSourceFingerprint": "reviewed-source-v1:448daf00b475ef8c1016ae87eb79de3ae67e25c2b3b38fac53a0bbe647ffbc0f", "reviewedSourceScope": "official_evidence", "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"RecoverPoint for Virtual Machines\",\"vendor\":\"Dell\",\"versions\":[{\"lessThan\":\"6.0.3.1 HF1\",\"status\":\"affected\",\"version\":\"5.3 SP4 P1\",\"versionType\":\"semver\"}]}", "language": "en" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"RecoverPoint for Virtual Machines\",\"vendor\":\"Dell\",\"versions\":[{\"lessThan\":\"6.0.3.1 HF1\",\"status\":\"affected\",\"version\":\"6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1\",\"versionType\":\"semver\"}]}", "language": "en" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.", "language": "en" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22769.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"cweId\":\"CWE-798\",\"description\":\"CWE-798: Use of Hard-coded Credentials\",\"lang\":\"en\",\"type\":\"CWE\"}", "language": "en" } ], "summaryEvidenceIds": [ "E1", "E2", "E3" ], "riskEvidenceIds": [ "E3" ], "glossary": [] } }, { "id": "CVE-2008-0015", "aliases": [], "title": "n/a：コード実行", "summary": "Active Template Library (ATL) の CComVariant::ReadFromStream 関数にスタックベースのバッファオーバーフローがあり、DirectShow の msvidctl.dll に含まれる MPEG2TuneRequest ActiveX コントロールで使用されています。この脆弱性は Microsoft Windows 2000 SP4、XP SP2 および SP3、Server 2003 SP2、Vista Gold、SP1、SP2、Server 2008 Gold、SP2 に存在し、細工したウェブページを介してリモートの攻撃者が任意のコードを実行できるようになります。2009 年 7 月に実際に悪用されたことが報告されています。", "risk": "リモートの攻撃者が対象システム上で任意のコードを実行できる可能性があります。", "product": "Microsoft Windows", "category": "windows", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-0015", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2008-0015", "label": "CVE公式レコード" }, { "url": "http://www.securityfocus.com/bid/35558", "label": "35558" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html", "label": "TA09-223A" }, { "url": "http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://osvdb.org/55651", "label": "55651" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333", "label": "oval:org.mitre.oval:def:6333" }, { "url": "http://www.securityfocus.com/bid/35585", "label": "35585" }, { "url": "http://secunia.com/advisories/36187", "label": "36187" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032", "label": "MS09-032" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436", "label": "oval:org.mitre.oval:def:7436" }, { "url": "http://www.vupen.com/english/advisories/2009/2232", "label": "ADV-2009-2232" }, { "url": "https://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0015", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2009-07-07T23:00:00.000Z", "modifiedAt": "2026-02-18T04:56:26.652Z", "fetchedAt": "2026-10-23T02:42:53.451Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka \"Microsoft Video ActiveX Control Vulnerability.\"", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2008-0015", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "fetchedAt": "2026-10-23T02:42:53.451Z", "publishedAt": "2009-07-07T23:00:00.000Z", "modifiedAt": "2026-02-18T04:56:26.652Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka \"Microsoft Video ActiveX Control Vulnerability.\"", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "http://www.securityfocus.com/bid/35558", "label": "35558", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html", "label": "TA09-223A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/1" }, { "url": "http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/2" }, { "url": "http://osvdb.org/55651", "label": "55651", "tags": [ "vdb-entry", "x_refsource_OSVDB", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/3" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333", "label": "oval:org.mitre.oval:def:6333", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/4" }, { "url": "http://www.securityfocus.com/bid/35585", "label": "35585", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/5" }, { "url": "http://secunia.com/advisories/36187", "label": "36187", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/6" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032", "label": "MS09-032", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/7" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436", "label": "oval:org.mitre.oval:def:7436", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/8" }, { "url": "http://www.vupen.com/english/advisories/2009/2232", "label": "ADV-2009-2232", "tags": [ "vdb-entry", "x_refsource_VUPEN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/9" }, { "url": "http://www.securitytracker.com/id?1022514", "label": "1022514", "tags": [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/10" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037", "label": "MS09-037", "tags": [ "vendor-advisory", "x_refsource_MS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/11" }, { "url": "http://www.csis.dk/dk/nyheder/nyheder.asp?tekstID=799", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/12" }, { "url": "http://isc.sans.org/diary.html?storyid=6733", "label": "CVE", "tags": [ "x_refsource_MISC", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/13" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-187A.html", "label": "TA09-187A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/14" }, { "url": "http://www.microsoft.com/technet/security/advisory/972890.mspx", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/15" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html", "label": "TA09-195A", "tags": [ "third-party-advisory", "x_refsource_CERT", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/16" }, { "url": "http://www.iss.net/threats/329.html", "label": "20090706 Multiple Microsoft Video Control ActiveX Remote Code Execution Vulnerabilities", "tags": [ "third-party-advisory", "x_refsource_ISS", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/17" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6363", "label": "oval:org.mitre.oval:def:6363", "tags": [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/18" }, { "url": "http://www.kb.cert.org/vuls/id/180513", "label": "VU#180513", "tags": [ "third-party-advisory", "x_refsource_CERT-VN", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/19" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2008-0015", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka \"Microsoft Video ActiveX Control Vulnerability.\"", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-18T04:56:26.652Z", "fetchedAt": "2026-10-23T02:42:53.451Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:48.994Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "9ea9081b78ffc6276758aeb6d0ac73e04e4ff414533484fb0a352c95356d1ac4", "sourceModifiedAt": "2026-02-18T04:56:26.652Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Active Template Library (ATL) の CComVariant::ReadFromStream 関数にスタックベースのバッファオーバーフローがあり、DirectShow の msvidctl.dll に含まれる MPEG2TuneRequest ActiveX コントロールで使用されています。この脆弱性は Microsoft Windows 2000 SP4、XP SP2 および SP3、Server 2003 SP2、Vista Gold、SP1、SP2、Server 2008 Gold、SP2 に存在し、細工したウェブページを介してリモートの攻撃者が任意のコードを実行できるようになります。2009 年 7 月に実際に悪用されたことが報告されています。", "risk": "リモートの攻撃者が対象システム上で任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft Windows 2000 SP4、Windows XP SP2、SP3、Windows Server 2003 SP2、Windows Vista Gold、SP1、SP2、Windows Server 2008 Gold、SP2 が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-0015" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json" ], "evidenceIds": [ "E2" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2008-0015", "http://www.securityfocus.com/bid/35558", "http://www.us-cert.gov/cas/techalerts/TA09-223A.html", "http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx", "http://osvdb.org/55651", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333", "http://www.securityfocus.com/bid/35585", "http://secunia.com/advisories/36187", "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032", "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436", "http://www.vupen.com/english/advisories/2009/2232", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-0015", "https://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx", "https://nvd.nist.gov/vuln/detail/CVE-2008-0015" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json" ], "evidenceIds": [ "E2" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-0015", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2008-0015", "label": "CVE公式レコード" }, { "url": "http://www.securityfocus.com/bid/35558", "label": "35558" }, { "url": "http://www.us-cert.gov/cas/techalerts/TA09-223A.html", "label": "TA09-223A" }, { "url": "http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx", "label": "CVE掲載の参考情報" }, { "url": "http://osvdb.org/55651", "label": "55651" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6333", "label": "oval:org.mitre.oval:def:6333" }, { "url": "http://www.securityfocus.com/bid/35585", "label": "35585" }, { "url": "http://secunia.com/advisories/36187", "label": "36187" }, { "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032", "label": "MS09-032" }, { "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7436", "label": "oval:org.mitre.oval:def:7436" }, { "url": "http://www.vupen.com/english/advisories/2009/2232", "label": "ADV-2009-2232" }, { "url": "https://web.archive.org/web/20110305211119/https://www.microsoft.com/technet/security/bulletin/ms09-032.mspx", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0015", "label": "CISAが示す関連情報" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka \"Microsoft Video ActiveX Control Vulnerability.\"", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2008/0xxx/CVE-2008-0015.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2008-0015", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2008-0015\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2008-0015（Microsoft Windows）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft Windows 2000 SP4、Windows XP SP2、SP3、Windows Server 2003 SP2、Windows Vista Gold、SP1、SP2、Windows Server 2008 Gold、SP2 が影響を受けます。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2008-0015", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:48.994Z", "lastSuccess": "2026-10-23T03:24:48.994Z", "sourceCheckedAt": "2026-10-23T02:42:53.451Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2020-7796", "aliases": [], "title": "n/a：脆弱性情報", "summary": "Zimbra Collaboration Suite (ZCS) の 8.8.15 Patch 7 より前のバージョンでは、WebEx zimlet がインストールされ、かつ zimlet の JSP が有効になっている場合に、サーバーサイドリクエストフォージェリ（SSRF）が可能になります。", "risk": "攻撃者がサーバーに任意のリクエストを送らせられる可能性があります。", "product": "Synacor Zimbra Collaboration Suite", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "mitre", "cvssVector": null, "affected": [ { "product": "n/a", "range": "n/a" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-7796", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7796", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2020-02-18T21:14:22.000Z", "modifiedAt": "2026-02-18T04:56:25.831Z", "fetchedAt": "2026-10-23T02:43:13.136Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2020-7796", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "fetchedAt": "2026-10-23T02:43:13.136Z", "publishedAt": "2020-02-18T21:14:22.000Z", "modifiedAt": "2026-02-18T04:56:25.831Z", "state": "published", "provider": "mitre", "title": "", "descriptions": [ { "lang": "en", "value": "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "n/a", "product": "n/a", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "n/a", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "n/a", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "label": "CVE", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "provider": "CVE", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-7796", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/1/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"n/a\",\"lang\":\"en\",\"type\":\"text\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/1/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourcePath": "/containers/adp/1/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":9.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"CRITICAL\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-18T04:56:25.831Z", "fetchedAt": "2026-10-23T02:43:13.136Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "n/aに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:22.919Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "4e19143501792b8f952edb79ae0628d99878af76309fb281056e80663078f02f", "sourceModifiedAt": "2026-02-18T04:56:25.831Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Zimbra Collaboration Suite (ZCS) の 8.8.15 Patch 7 より前のバージョンでは、WebEx zimlet がインストールされ、かつ zimlet の JSP が有効になっている場合に、サーバーサイドリクエストフォージェリ（SSRF）が可能になります。", "risk": "攻撃者がサーバーに任意のリクエストを送らせられる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Zimbra Collaboration Suite (ZCS) の 8.8.15 Patch 7 より前のバージョンで、WebEx zimlet がインストールされ、zimlet の JSP が有効になっている環境。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json" ], "evidenceIds": [ "E1" ] }, { "text": "公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796" ], "evidenceIds": [ "E3" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Synacor Zimbra Collaboration Suite」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-7796", "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "https://nvd.nist.gov/vuln/detail/CVE-2020-7796" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2020-7796", "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "https://nvd.nist.gov/vuln/detail/CVE-2020-7796" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2020-7796", "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "https://nvd.nist.gov/vuln/detail/CVE-2020-7796" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "label": "CVE：mitre" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2020-7796", "label": "CVE公式レコード" }, { "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7796", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2020/7xxx/CVE-2020-7796.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"product\":\"n/a\",\"vendor\":\"n/a\",\"versions\":[{\"status\":\"affected\",\"version\":\"n/a\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-7796", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2020-7796\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2020-7796（Synacor Zimbra Collaboration Suite）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Zimbra Collaboration Suite (ZCS) の 8.8.15 Patch 7 より前のバージョンで、WebEx zimlet がインストールされ、zimlet の JSP が有効になっている環境。\n・公式の対象表：対象製品（この表に製品名の明記なし）。影響ありとして記載：具体的な版番号の記載なし。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2020-7796", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:22.919Z", "lastSuccess": "2026-10-23T03:38:22.919Z", "sourceCheckedAt": "2026-10-23T02:43:13.136Z", "errorCode": null }, "glossary": [ { "term": "SSRF", "meaning": "攻撃者が、サーバーに意図しない宛先へ通信を送らせる問題です。実際に送れる通信や影響の範囲は、それぞれの脆弱性の説明で確認します。", "sourceUrl": "https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/SSRF", "kind": "general_definition" } ] } }, { "id": "CVE-2024-7694", "aliases": [], "title": "ThreatSonar Anti-Ransomware：脆弱性情報", "summary": "TeamT5 の ThreatSonar Anti-Ransomware は、アップロードされたファイルの内容を適切に検証しません。製品プラットフォーム上で管理者権限を持つリモート攻撃者は、悪意のあるファイルをアップロードでき、サーバー上で任意のシステムコマンドを実行させることができます。", "risk": "サーバー上で任意のシステムコマンドが実行される可能性があります。", "product": "ThreatSonar Anti-Ransomware", "category": "other", "component": "package", "severity": "high", "cvss": 7.2, "cvssVersion": "3.1", "cvssSource": "twcert", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "ThreatSonar Anti-Ransomware", "range": "<= 3.4.5" } ], "fixed": [], "steps": [ "バージョン 3.5.0 以降に更新するか、パッチ Hotfix-20240715 をインストールしてください。", "「CVE-2024-7694」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "label": "CVE：twcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7694", "label": "CVE公式レコード" }, { "url": "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "label": "CISAが示す関連情報" }, { "url": "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7694", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-08-12T03:00:55.680Z", "modifiedAt": "2026-02-18T04:56:25.049Z", "fetchedAt": "2026-10-23T02:43:34.296Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.", "sourceTitle": "TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "ThreatSonar Anti-Ransomware", "vendor": "TeamT5", "versions": [ { "lessThanOrEqual": "3.4.5", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-7694", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "fetchedAt": "2026-10-23T02:43:34.296Z", "publishedAt": "2024-08-12T03:00:55.680Z", "modifiedAt": "2026-02-18T04:56:25.049Z", "state": "published", "provider": "twcert", "title": "TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload", "descriptions": [ { "lang": "en", "value": "ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "TeamT5", "product": "ThreatSonar Anti-Ransomware", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "3.4.5", "versionType": "custom", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "Update to version 3.5.0 or later, or install the patch Hotfix-20240715.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "provider": "twcert", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "label": "twcert", "tags": [ "third-party-advisory" ], "provider": "twcert", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "label": "twcert", "tags": [ "third-party-advisory" ], "provider": "twcert", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7694", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"ThreatSonar Anti-Ransomware\",\"vendor\":\"TeamT5\",\"versions\":[{\"lessThanOrEqual\":\"3.4.5\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "Update to version 3.5.0 or later, or install the patch Hotfix-20240715.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-434\",\"description\":\"CWE-434 Unrestricted Upload of File with Dangerous Type\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"LOW\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-18T04:56:25.049Z", "fetchedAt": "2026-10-23T02:43:34.296Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "ThreatSonar Anti-Ransomwareに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:51.180Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "369d9ab8ff4302f23706f0dbd7cc30af4494e28c5587a1d58f99da40498a941f", "sourceModifiedAt": "2026-02-18T04:56:25.049Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "TeamT5 の ThreatSonar Anti-Ransomware は、アップロードされたファイルの内容を適切に検証しません。製品プラットフォーム上で管理者権限を持つリモート攻撃者は、悪意のあるファイルをアップロードでき、サーバー上で任意のシステムコマンドを実行させることができます。", "risk": "サーバー上で任意のシステムコマンドが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "製品プラットフォーム上で管理者権限を持つリモート攻撃者が対象となります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "バージョン 3.4.5 以下（バージョン 0 を含むカスタムバージョン指定）では影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：TeamT5 / ThreatSonar Anti-Ransomware。影響ありとして記載：3.4.5以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E3" ] }, { "text": "「ThreatSonar Anti-Ransomware」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7694", "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "https://nvd.nist.gov/vuln/detail/CVE-2024-7694" ] } ], "actions": [ { "text": "バージョン 3.5.0 以降に更新するか、パッチ Hotfix-20240715 をインストールしてください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2024-7694」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-7694", "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "https://nvd.nist.gov/vuln/detail/CVE-2024-7694" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7694", "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "https://nvd.nist.gov/vuln/detail/CVE-2024-7694" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-7694", "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "https://nvd.nist.gov/vuln/detail/CVE-2024-7694" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-7694", "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "https://nvd.nist.gov/vuln/detail/CVE-2024-7694" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "label": "CVE：twcert" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7694", "label": "CVE公式レコード" }, { "url": "https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html", "label": "CVE掲載の参考情報" }, { "url": "https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html", "label": "CISAが示す関連情報" }, { "url": "https://teamt5.org/en/posts/vulnerability-notice-threat-sonar-anti-ransomware-20240715/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7694", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourceField": "/containers/cna/title", "excerpt": "TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"ThreatSonar Anti-Ransomware\",\"vendor\":\"TeamT5\",\"versions\":[{\"lessThanOrEqual\":\"3.4.5\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/7xxx/CVE-2024-7694.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "Update to version 3.5.0 or later, or install the patch Hotfix-20240715.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-7694", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-7694\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-7694（ThreatSonar Anti-Ransomware）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・製品プラットフォーム上で管理者権限を持つリモート攻撃者が対象となります。\n・バージョン 3.4.5 以下（バージョン 0 を含むカスタムバージョン指定）では影響を受けます。\n・公式の対象表：TeamT5 / ThreatSonar Anti-Ransomware。影響ありとして記載：3.4.5以下の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-7694", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:51.180Z", "lastSuccess": "2026-10-23T03:24:51.180Z", "sourceCheckedAt": "2026-10-23T02:43:34.296Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-2441", "aliases": [], "title": "Chrome：コード実行", "summary": "Google Chrome のバージョン 145.0.7632.75 未満において、CSS の use‑after‑free バグが存在し、攻撃者が細工した HTML ページを用いることで、サンドボックス内で任意のコードを実行させることができる（Chromium のセキュリティ深刻度は High）。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できる可能性がある。", "product": "Chrome", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "Chrome", "cvssVector": null, "affected": [ { "product": "Chrome", "range": ">= 145.0.7632.75 / < 145.0.7632.75" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2441", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/483569511", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2441", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-13T18:27:48.355Z", "modifiedAt": "2026-09-21T12:58:04.180Z", "fetchedAt": "2026-10-23T02:43:48.036Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Google", "product": "Chrome", "versions": [ { "version": "145.0.7632.75", "status": "affected", "lessThan": "145.0.7632.75", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-2441", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "fetchedAt": "2026-10-23T02:43:48.036Z", "publishedAt": "2026-02-13T18:27:48.355Z", "modifiedAt": "2026-09-21T12:58:04.180Z", "state": "published", "provider": "Chrome", "title": "", "descriptions": [ { "lang": "en", "value": "Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Google", "product": "Chrome", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "145.0.7632.75", "lessThan": "145.0.7632.75", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-416", "lang": "en", "description": "Use after free", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/0" }, { "url": "https://issues.chromium.org/issues/483569511", "label": "Chrome", "tags": [], "provider": "Chrome", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-2441", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://github.com/huseyinstif/CVE-2026-2441-PoC/blob/main/poc.html", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"145.0.7632.75\",\"status\":\"affected\",\"lessThan\":\"145.0.7632.75\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"Use after free\",\"cweId\":\"CWE-416\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":8.8,\"attackVector\":\"NETWORK\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-09-21T12:58:04.180Z", "fetchedAt": "2026-10-23T02:43:48.036Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-17T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Chromeにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:38:24.127Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "b4348ff38a5bc2de787c6efac25c456539d7adabd6e20f200bd8a2978d897b67", "sourceModifiedAt": "2026-09-21T12:58:04.180Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Google Chrome のバージョン 145.0.7632.75 未満において、CSS の use‑after‑free バグが存在し、攻撃者が細工した HTML ページを用いることで、サンドボックス内で任意のコードを実行させることができる（Chromium のセキュリティ深刻度は High）。", "risk": "攻撃者がサンドボックス内で任意のコードを実行できる可能性がある。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Google Chrome のバージョン 145.0.7632.75 未満が影響を受ける。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E2" ] }, { "text": "攻撃には、攻撃者が細工した HTML ページをユーザーに表示させる必要がある。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E1" ] }, { "text": "対象となるバグは CSS の use‑after‑free（CWE‑416）である。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも145.0.7632.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E2" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E2" ] }, { "text": "「Chrome」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-2441", "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "https://issues.chromium.org/issues/483569511", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "https://nvd.nist.gov/vuln/detail/CVE-2026-2441" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E2" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-2441", "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "https://issues.chromium.org/issues/483569511", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "https://nvd.nist.gov/vuln/detail/CVE-2026-2441" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json" ], "evidenceIds": [ "E2" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-2441", "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "https://issues.chromium.org/issues/483569511", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "https://nvd.nist.gov/vuln/detail/CVE-2026-2441" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "label": "CVE：Chrome" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2441", "label": "CVE公式レコード" }, { "url": "https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html", "label": "CISAが示す関連情報" }, { "url": "https://issues.chromium.org/issues/483569511", "label": "CVE掲載の参考情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2441", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Google\",\"product\":\"Chrome\",\"versions\":[{\"version\":\"145.0.7632.75\",\"status\":\"affected\",\"lessThan\":\"145.0.7632.75\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/2xxx/CVE-2026-2441.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"Use after free\",\"cweId\":\"CWE-416\"}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-2441", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-2441\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-2441（Chrome）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Google Chrome のバージョン 145.0.7632.75 未満が影響を受ける。\n・攻撃には、攻撃者が細工した HTML ページをユーザーに表示させる必要がある。\n・対象となるバグは CSS の use‑after‑free（CWE‑416）である。\n・公式の対象表：Google / Chrome。影響ありとして記載：対象表の開始値と上限がどちらも145.0.7632.75で、上限条件は「未満」です。この表だけでは範囲を確定できないため、説明文の対象範囲も照合してください。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-2441", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:38:24.127Z", "lastSuccess": "2026-10-23T03:38:24.127Z", "sourceCheckedAt": "2026-10-23T02:43:48.036Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-1731", "aliases": [], "title": "Remote Support(RS) & Privileged Remote Access(PRA)：コード実行", "summary": "BeyondTrust Remote Support (RS) と古いバージョンの Privileged Remote Access (PRA) に、認証されていないリモート攻撃者が特別に細工したリクエストを送ることで、サイトユーザーの権限で OS コマンドを実行できる深刻な脆弱性があります。", "risk": "攻撃者がサイトユーザーの権限で OS コマンドを実行できる可能性がある。", "product": "Remote Support(RS) & Privileged Remote Access(PRA)", "category": "other", "component": "package", "severity": "critical", "cvss": 9.9, "cvssVersion": "4.0", "cvssSource": "BT", "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L", "affected": [ { "product": "Remote Support(RS) & Privileged Remote Access(PRA)", "range": "<= RS 25.3.1" }, { "product": "Remote Support(RS) & Privileged Remote Access(PRA)", "range": "<= PRA 24.3.4" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1731", "label": "CVE公式レコード" }, { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "label": "CVE掲載の参考情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1731", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-06T21:49:20.844Z", "modifiedAt": "2026-02-26T15:04:15.451Z", "fetchedAt": "2026-10-23T02:43:46.811Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.", "sourceTitle": "Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "Remote Support(RS) & Privileged Remote Access(PRA)", "vendor": "BeyondTrust", "versions": [ { "lessThanOrEqual": "RS 25.3.1", "status": "affected", "version": "0", "versionType": "custom" }, { "lessThanOrEqual": "PRA 24.3.4", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-1731", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "fetchedAt": "2026-10-23T02:43:46.811Z", "publishedAt": "2026-02-06T21:49:20.844Z", "modifiedAt": "2026-02-26T15:04:15.451Z", "state": "published", "provider": "BT", "title": "Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "descriptions": [ { "lang": "en", "value": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "BeyondTrust", "product": "Remote Support(RS) & Privileged Remote Access(PRA)", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThanOrEqual": "RS 25.3.1", "versionType": "custom", "status": "affected" }, { "sourcePath": "/containers/cna/affected/0/versions/1", "version": "0", "lessThanOrEqual": "PRA 24.3.4", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L", "baseScore": 9.9, "baseSeverity": "CRITICAL", "provider": "BT", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "label": "BT", "tags": [], "provider": "BT", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/win3zz/CVE-2026-1731", "label": "CISA-ADP", "tags": [ "exploit" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-1731", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" }, { "url": "https://www.greynoise.io/blog/reconnaissance-beyondtrust-rce-cve-2026-1731", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/2" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"Remote Support(RS) & Privileged Remote Access(PRA)\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"RS 25.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"lessThanOrEqual\":\"PRA 24.3.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-78\",\"description\":\"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T15:04:15.451Z", "fetchedAt": "2026-10-23T02:43:46.811Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-13T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Remote Support(RS) & Privileged Remote Access(PRA)にコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:53.727Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "07c7aa4694e1a61f820c8cab6b5e0f8ed7845590514cf08c434b7e79bd8ef149", "sourceModifiedAt": "2026-02-26T15:04:15.451Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "BeyondTrust Remote Support (RS) と古いバージョンの Privileged Remote Access (PRA) に、認証されていないリモート攻撃者が特別に細工したリクエストを送ることで、サイトユーザーの権限で OS コマンドを実行できる深刻な脆弱性があります。", "risk": "攻撃者がサイトユーザーの権限で OS コマンドを実行できる可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Remote Support (RS) のバージョン 25.3.1 以下は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Privileged Remote Access (PRA) のバージョン 24.3.4 以下は影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：BeyondTrust / Remote Support(RS) & Privileged Remote Access(PRA)。影響ありとして記載：RS 25.3.1以下の版。影響ありとして記載：PRA 24.3.4以下の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Remote Support(RS) & Privileged Remote Access(PRA)」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-1731", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "https://nvd.nist.gov/vuln/detail/CVE-2026-1731" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-1731", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "https://nvd.nist.gov/vuln/detail/CVE-2026-1731" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-1731", "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "https://nvd.nist.gov/vuln/detail/CVE-2026-1731" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "label": "CVE：BT" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1731", "label": "CVE公式レコード" }, { "url": "https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0023293", "label": "CVE掲載の参考情報" }, { "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt26-02", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1731", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourceField": "/containers/cna/title", "excerpt": "Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/1xxx/CVE-2026-1731.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"Remote Support(RS) & Privileged Remote Access(PRA)\",\"vendor\":\"BeyondTrust\",\"versions\":[{\"lessThanOrEqual\":\"RS 25.3.1\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"},{\"lessThanOrEqual\":\"PRA 24.3.4\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-1731", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-1731\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-1731（Remote Support(RS) & Privileged Remote Access(PRA)）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Remote Support (RS) のバージョン 25.3.1 以下は影響を受けます。\n・Privileged Remote Access (PRA) のバージョン 24.3.4 以下は影響を受けます。\n・公式の対象表：BeyondTrust / Remote Support(RS) & Privileged Remote Access(PRA)。影響ありとして記載：RS 25.3.1以下の版。影響ありとして記載：PRA 24.3.4以下の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-1731", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:53.727Z", "lastSuccess": "2026-10-23T03:24:53.727Z", "sourceCheckedAt": "2026-10-23T02:43:46.811Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2024-43468", "aliases": [], "title": "Microsoft Configuration Manager：コード実行", "summary": "Microsoft Configuration Manager にリモートコード実行の脆弱性があります。", "risk": "攻撃者がリモートでコードを実行できる可能性があります。", "product": "Microsoft Configuration Manager", "category": "other", "component": "package", "severity": "critical", "cvss": 9.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Microsoft Configuration Manager", "range": ">= 1.0.0 / < 5.00.9106" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-43468", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43468", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2024-10-08T17:35:48.428Z", "modifiedAt": "2026-08-19T16:26:47.605Z", "fetchedAt": "2026-10-23T02:43:32.864Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft Configuration Manager", "versions": [ { "version": "1.0.0", "lessThan": "5.00.9106", "versionType": "custom", "status": "affected" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2024-43468", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "fetchedAt": "2026-10-23T02:43:32.864Z", "publishedAt": "2024-10-08T17:35:48.428Z", "modifiedAt": "2026-08-19T16:26:47.605Z", "state": "published", "provider": "microsoft", "title": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft Configuration Manager", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "1.0.0", "lessThan": "5.00.9106", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-89", "lang": "en-US", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "label": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43468", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Configuration Manager\",\"versions\":[{\"version\":\"1.0.0\",\"lessThan\":\"5.00.9106\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-89\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"CRITICAL\",\"baseScore\":9.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-19T16:26:47.605Z", "fetchedAt": "2026-10-23T02:43:32.864Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-12T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft Configuration Managerにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:53.893Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "bbc459e3378294a4553f56d267c60c0461a0d026559c2fc73db949a31d1cb152", "sourceModifiedAt": "2026-08-19T16:26:47.605Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Configuration Manager にリモートコード実行の脆弱性があります。", "risk": "攻撃者がリモートでコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Microsoft Configuration Manager のバージョン 1.0.0 から 5.00.9106 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：Microsoft / Microsoft Configuration Manager。影響ありとして記載：1.0.0以上、5.00.9106未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft Configuration Manager」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-43468", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "https://nvd.nist.gov/vuln/detail/CVE-2024-43468" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2024-43468", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "https://nvd.nist.gov/vuln/detail/CVE-2024-43468" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2024-43468", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "https://nvd.nist.gov/vuln/detail/CVE-2024-43468" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-43468", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43468", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft Configuration Manager Remote Code Execution Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/43xxx/CVE-2024-43468.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Configuration Manager\",\"versions\":[{\"version\":\"1.0.0\",\"lessThan\":\"5.00.9106\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-43468", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2024-43468\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2024-43468（Microsoft Configuration Manager）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Microsoft Configuration Manager のバージョン 1.0.0 から 5.00.9106 未満が影響を受けます。\n・公式の対象表：Microsoft / Microsoft Configuration Manager。影響ありとして記載：1.0.0以上、5.00.9106未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2024-43468", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:53.893Z", "lastSuccess": "2026-10-23T03:24:53.893Z", "sourceCheckedAt": "2026-10-23T02:43:32.864Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-15556", "aliases": [], "title": "notepad-plus-plus：コード実行", "summary": "Notepad++ のバージョン 8.8.9 未満で WinGUp アップデーターを使用している場合、更新メタデータとインストーラが暗号的に検証されない脆弱性があります。攻撃者が更新トラフィックを傍受またはリダイレクトできると、アップデーターが攻撃者が制御するインストーラをダウンロードして実行し、ユーザー権限で任意のコードを実行させられます。", "risk": "攻撃者が制御したインストーラが実行され、ユーザー権限で任意のコードが実行される可能性があります。", "product": "notepad-plus-plus", "category": "other", "component": "package", "severity": "high", "cvss": 7.7, "cvssVersion": "4.0", "cvssSource": "VulnCheck", "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "affected": [ { "product": "notepad-plus-plus", "range": "< 8.8.9" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15556", "label": "CVE公式レコード" }, { "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "label": "CISAが示す関連情報" }, { "url": "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "label": "CVE掲載の参考情報" }, { "url": "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "label": "CVE掲載の参考情報" }, { "url": "https://notepad-plus-plus.org/news/clarification-security-incident/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15556", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-03T00:50:29.516Z", "modifiedAt": "2026-03-05T01:29:51.538Z", "fetchedAt": "2026-10-23T02:43:35.614Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.", "sourceTitle": "Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "unaffected", "product": "notepad-plus-plus", "repo": "https://github.com/notepad-plus-plus", "vendor": "notepad-plus-plus", "versions": [ { "lessThan": "8.8.9", "status": "affected", "version": "0", "versionType": "semver" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-15556", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "fetchedAt": "2026-10-23T02:43:35.614Z", "publishedAt": "2026-02-03T00:50:29.516Z", "modifiedAt": "2026-03-05T01:29:51.538Z", "state": "published", "provider": "VulnCheck", "title": "Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification", "descriptions": [ { "lang": "en", "value": "Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "notepad-plus-plus", "product": "notepad-plus-plus", "sourcePath": "/containers/cna/affected/0", "repo": "https://github.com/notepad-plus-plus", "defaultStatus": "unaffected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "8.8.9", "versionType": "semver", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-494", "lang": "en", "description": "CWE-494 Download of Code Without Integrity Check", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 7.7, "baseSeverity": "HIGH", "provider": "VulnCheck", "sourcePath": "/containers/cna/metrics/0/cvssV4_0" } ], "references": [ { "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "label": "VulnCheck", "tags": [ "release-notes", "patch" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/0" }, { "url": "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "label": "VulnCheck", "tags": [ "vendor-advisory" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/1" }, { "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "label": "VulnCheck", "tags": [ "patch" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/2" }, { "url": "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "label": "VulnCheck", "tags": [ "patch" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/3" }, { "url": "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "label": "VulnCheck", "tags": [ "third-party-advisory" ], "provider": "VulnCheck", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-15556", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://notepad-plus-plus.org//news//clarification-security-incident/", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"unaffected\",\"product\":\"notepad-plus-plus\",\"repo\":\"https://github.com/notepad-plus-plus\",\"vendor\":\"notepad-plus-plus\",\"versions\":[{\"lessThan\":\"8.8.9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-494\",\"description\":\"CWE-494 Download of Code Without Integrity Check\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV4_0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourcePath": "/containers/cna/metrics/0/cvssV4_0", "text": "{\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"attackVector\":\"NETWORK\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"privilegesRequired\":\"NONE\",\"providerUrgency\":\"NOT_DEFINED\",\"subAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"valueDensity\":\"NOT_DEFINED\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\",\"version\":\"4.0\",\"vulnAvailabilityImpact\":\"HIGH\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-03-05T01:29:51.538Z", "fetchedAt": "2026-10-23T02:43:35.614Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-12T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "notepad-plus-plusにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:53.914Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "86e03bea3b68ad4de2e0dffdcf187d33c8d6983cff72023ed4400fa435215dfd", "sourceModifiedAt": "2026-03-05T01:29:51.538Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Notepad++ のバージョン 8.8.9 未満で WinGUp アップデーターを使用している場合、更新メタデータとインストーラが暗号的に検証されない脆弱性があります。攻撃者が更新トラフィックを傍受またはリダイレクトできると、アップデーターが攻撃者が制御するインストーラをダウンロードして実行し、ユーザー権限で任意のコードを実行させられます。", "risk": "攻撃者が制御したインストーラが実行され、ユーザー権限で任意のコードが実行される可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "影響を受けるのは Notepad++ のバージョン 8.8.9 未満です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "この脆弱性は WinGUp アップデーターを使用している場合に限ります。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E1", "E2" ] }, { "text": "公式の対象表：notepad-plus-plus / notepad-plus-plus。影響ありとして記載：8.8.9未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556" ], "evidenceIds": [ "E4" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E3" ] }, { "text": "「notepad-plus-plus」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-15556", "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "https://notepad-plus-plus.org/news/clarification-security-incident/", "https://nvd.nist.gov/vuln/detail/CVE-2025-15556" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-15556", "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "https://notepad-plus-plus.org/news/clarification-security-incident/", "https://nvd.nist.gov/vuln/detail/CVE-2025-15556" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-15556", "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "https://notepad-plus-plus.org/news/clarification-security-incident/", "https://nvd.nist.gov/vuln/detail/CVE-2025-15556" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "label": "CVE：VulnCheck" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15556", "label": "CVE公式レコード" }, { "url": "https://community.notepad-plus-plus.org/topic/27298/notepad-v8-8-9-vulnerability-fix", "label": "CISAが示す関連情報" }, { "url": "https://notepad-plus-plus.org/news/hijacked-incident-info-update/", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/notepad-plus-plus/notepad-plus-plus/commit/bcf2aa68ef414338d717e20e059459570ed6c5ab", "label": "CVE掲載の参考情報" }, { "url": "https://github.com/notepad-plus-plus/wingup/commit/ce0037549995ed0396cc363544d14b3425614fdb", "label": "CVE掲載の参考情報" }, { "url": "https://www.vulncheck.com/advisories/notepad-plus-plus-wingup-updater-lacks-update-integrity-verification", "label": "CVE掲載の参考情報" }, { "url": "https://notepad-plus-plus.org/news/clarification-security-incident/", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15556", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v4.0/specification-document", "label": "FIRST公式：CVSS 4.0の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourceField": "/containers/cna/title", "excerpt": "Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/15xxx/CVE-2025-15556.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"unaffected\",\"product\":\"notepad-plus-plus\",\"repo\":\"https://github.com/notepad-plus-plus\",\"vendor\":\"notepad-plus-plus\",\"versions\":[{\"lessThan\":\"8.8.9\",\"status\":\"affected\",\"version\":\"0\",\"versionType\":\"semver\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-15556", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-15556\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-15556（notepad-plus-plus）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・影響を受けるのは Notepad++ のバージョン 8.8.9 未満です。\n・この脆弱性は WinGUp アップデーターを使用している場合に限ります。\n・公式の対象表：notepad-plus-plus / notepad-plus-plus。影響ありとして記載：8.8.9未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-15556", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:53.914Z", "lastSuccess": "2026-10-23T03:24:53.914Z", "sourceCheckedAt": "2026-10-23T02:43:35.614Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2025-40536", "aliases": [], "title": "Web Help Desk：脆弱性情報", "summary": "SolarWinds Web Help Desk は、認証されていない攻撃者が特定の制限された機能にアクセスできる可能性があるセキュリティ制御バイパス脆弱性があることが判明しました。", "risk": "認証されていない攻撃者が制限された機能にアクセスできる可能性があります。", "product": "Web Help Desk", "category": "other", "component": "package", "severity": "high", "cvss": 8.1, "cvssVersion": "3.1", "cvssSource": "SolarWinds", "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "affected": [ { "product": "Web Help Desk", "range": "12.8.8 HF1 and below" }, { "product": "Web Help Desk", "range": "原典の既定状態: 影響あり。個別指定外の版は例外・条件を原文で確認してください。" } ], "fixed": [], "steps": [ "SolarWinds は顧客に Web Help Desk バージョン 2026.1 へアップグレードすることを推奨しています。", "「CVE-2025-40536」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "label": "CVE：SolarWinds" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-40536", "label": "CVE公式レコード" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "label": "CISAが示す関連情報" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40536", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-01-28T07:30:09.503Z", "modifiedAt": "2026-02-26T15:04:49.700Z", "fetchedAt": "2026-10-23T02:43:38.174Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.", "sourceTitle": "SolarWinds Web Help Desk Security Control Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "defaultStatus": "affected", "product": "Web Help Desk", "vendor": "SolarWinds", "versions": [ { "status": "affected", "version": "12.8.8 HF1 and below" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2025-40536", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "fetchedAt": "2026-10-23T02:43:38.174Z", "publishedAt": "2026-01-28T07:30:09.503Z", "modifiedAt": "2026-02-26T15:04:49.700Z", "state": "published", "provider": "SolarWinds", "title": "SolarWinds Web Help Desk Security Control Bypass Vulnerability", "descriptions": [ { "lang": "en", "value": "SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "SolarWinds", "product": "Web Help Desk", "sourcePath": "/containers/cna/affected/0", "defaultStatus": "affected", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "12.8.8 HF1 and below", "status": "affected" } ] } ], "solutions": [ { "lang": "en", "value": "SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.", "sourcePath": "/containers/cna/solutions/0/value" } ], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "provider": "SolarWinds", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "label": "SolarWinds", "tags": [ "vendor-advisory", "patch" ], "provider": "SolarWinds", "sourcePath": "/containers/cna/references/0" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "label": "SolarWinds", "tags": [ "release-notes" ], "provider": "SolarWinds", "sourcePath": "/containers/cna/references/1" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40536", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399", "label": "CISA-ADP", "tags": [ "third-party-advisory" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"defaultStatus\":\"affected\",\"product\":\"Web Help Desk\",\"vendor\":\"SolarWinds\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.8.8 HF1 and below\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/solutions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourcePath": "/containers/cna/solutions/0/value", "text": "SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"cweId\":\"CWE-693\",\"description\":\"CWE-693 Protection Mechanism Failure\",\"lang\":\"en\",\"type\":\"CWE\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"attackComplexity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"scope\":\"UNCHANGED\",\"userInteraction\":\"NONE\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"version\":\"3.1\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-02-26T15:04:49.700Z", "fetchedAt": "2026-10-23T02:43:38.174Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-12T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Web Help Deskに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:54.571Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8df9cf355b3a42cf43f54ad6ebb51861a3057af36a08abed147ecbe41e8d2e85", "sourceModifiedAt": "2026-02-26T15:04:49.700Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "SolarWinds Web Help Desk は、認証されていない攻撃者が特定の制限された機能にアクセスできる可能性があるセキュリティ制御バイパス脆弱性があることが判明しました。", "risk": "認証されていない攻撃者が制限された機能にアクセスできる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Web Help Desk 12.8.8 HF1 以前のバージョンが影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "公式の対象表：SolarWinds / Web Help Desk。影響ありとして記載：12.8.8 HF1 and below。個別に例外が記されていない版も、原資料では影響ありとされています。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json" ], "evidenceIds": [ "E3" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536" ], "evidenceIds": [ "E5" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Web Help Desk」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-40536", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "https://nvd.nist.gov/vuln/detail/CVE-2025-40536" ] } ], "actions": [ { "text": "SolarWinds は顧客に Web Help Desk バージョン 2026.1 へアップグレードすることを推奨しています。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json" ], "evidenceIds": [ "E4" ] }, { "text": "「CVE-2025-40536」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-40536", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "https://nvd.nist.gov/vuln/detail/CVE-2025-40536" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-40536", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "https://nvd.nist.gov/vuln/detail/CVE-2025-40536" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2025-40536", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "https://nvd.nist.gov/vuln/detail/CVE-2025-40536" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2025-40536", "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "https://nvd.nist.gov/vuln/detail/CVE-2025-40536" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "label": "CVE：SolarWinds" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-40536", "label": "CVE公式レコード" }, { "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536", "label": "CISAが示す関連情報" }, { "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40536", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourceField": "/containers/cna/title", "excerpt": "SolarWinds Web Help Desk Security Control Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"defaultStatus\":\"affected\",\"product\":\"Web Help Desk\",\"vendor\":\"SolarWinds\",\"versions\":[{\"status\":\"affected\",\"version\":\"12.8.8 HF1 and below\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/40xxx/CVE-2025-40536.json", "sourceField": "/containers/cna/solutions/0/value", "excerpt": "SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.", "language": "en", "representation": "source_excerpt" }, { "id": "E5", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-40536", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2025-40536\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2025-40536（Web Help Desk）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Web Help Desk 12.8.8 HF1 以前のバージョンが影響を受けます。\n・公式の対象表：SolarWinds / Web Help Desk。影響ありとして記載：12.8.8 HF1 and below。個別に例外が記されていない版も、原資料では影響ありとされています。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2025-40536", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:54.571Z", "lastSuccess": "2026-10-23T03:24:54.571Z", "sourceCheckedAt": "2026-10-23T02:43:38.174Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-20700", "aliases": [], "title": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS：コード実行", "summary": "メモリ破損の問題が状態管理の改善により対処されました。この問題は iOS 26.3、iPadOS 26.3、macOS Tahoe 26.3、tvOS 26.3、visionOS 26.3、watchOS 26.3 で修正されています。メモリ書き込み権限を持つ攻撃者は任意のコードを実行できる可能性があります。Apple は、iOS 26 未満のバージョンで特定の標的個人に対し極めて高度な攻撃が行われたという報告を認識しています。", "risk": "メモリ書き込み権限を持つ攻撃者が任意のコードを実行できる可能性があります。", "product": "iOS and iPadOS / macOS / tvOS / visionOS / watchOS", "category": "other", "component": "package", "severity": "unknown", "cvss": null, "cvssVersion": null, "cvssSource": "apple", "cvssVector": null, "affected": [ { "product": "iOS and iPadOS", "range": "< 26.3" }, { "product": "macOS", "range": "< 26.3" }, { "product": "tvOS", "range": "< 26.3" }, { "product": "visionOS", "range": "< 26.3" }, { "product": "watchOS", "range": "< 26.3" } ], "fixed": [], "steps": [ "iOS と iPadOS をバージョン 26.3 に更新してください。", "macOS Tahoe をバージョン 26.3 に更新してください。", "tvOS をバージョン 26.3 に更新してください。", "visionOS をバージョン 26.3 に更新してください。", "watchOS をバージョン 26.3 に更新してください。", "「CVE-2026-20700」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20700", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/126346", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126348", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126351", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126352", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126353", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-11T22:58:54.448Z", "modifiedAt": "2026-04-02T18:23:25.647Z", "fetchedAt": "2026-10-23T02:43:47.527Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.", "sourceTitle": "", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Apple", "product": "iOS and iPadOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.3", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "macOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.3", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "tvOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.3", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "visionOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.3", "versionType": "custom" } ] }, { "vendor": "Apple", "product": "watchOS", "versions": [ { "version": "0", "status": "affected", "lessThan": "26.3", "versionType": "custom" } ] } ], "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-20700", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "fetchedAt": "2026-10-23T02:43:47.527Z", "publishedAt": "2026-02-11T22:58:54.448Z", "modifiedAt": "2026-04-02T18:23:25.647Z", "state": "published", "provider": "apple", "title": "", "descriptions": [ { "lang": "en", "value": "A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Apple", "product": "iOS and iPadOS", "sourcePath": "/containers/cna/affected/0", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "0", "lessThan": "26.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "macOS", "sourcePath": "/containers/cna/affected/1", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "0", "lessThan": "26.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "tvOS", "sourcePath": "/containers/cna/affected/2", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "0", "lessThan": "26.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "visionOS", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "0", "lessThan": "26.3", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Apple", "product": "watchOS", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "0", "lessThan": "26.3", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "", "lang": "en", "description": "An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://support.apple.com/en-us/126346", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/0" }, { "url": "https://support.apple.com/en-us/126348", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/1" }, { "url": "https://support.apple.com/en-us/126351", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/2" }, { "url": "https://support.apple.com/en-us/126352", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/3" }, { "url": "https://support.apple.com/en-us/126353", "label": "apple", "tags": [], "provider": "apple", "sourcePath": "/containers/cna/references/4" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20700", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"lang\":\"en\",\"description\":\"An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/adp/0/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourcePath": "/containers/adp/0/metrics/0/cvssV3_1", "text": "{\"scope\":\"UNCHANGED\",\"version\":\"3.1\",\"baseScore\":7.8,\"attackVector\":\"LOCAL\",\"baseSeverity\":\"HIGH\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"integrityImpact\":\"HIGH\",\"userInteraction\":\"NONE\",\"attackComplexity\":\"LOW\",\"availabilityImpact\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"confidentialityImpact\":\"HIGH\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-04-02T18:23:25.647Z", "fetchedAt": "2026-10-23T02:43:47.527Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-12T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "iOS and iPadOS / macOS / tvOS / visionOS / watchOSにコード実行に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "攻撃者に対象のシステム上でコードやコマンドを実行される可能性があります。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:55.643Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "d74d18e1096e7480f53b46485ff5632e1096dca90213fb08ee6dfd98fae680fc", "sourceModifiedAt": "2026-04-02T18:23:25.647Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "メモリ破損の問題が状態管理の改善により対処されました。この問題は iOS 26.3、iPadOS 26.3、macOS Tahoe 26.3、tvOS 26.3、visionOS 26.3、watchOS 26.3 で修正されています。メモリ書き込み権限を持つ攻撃者は任意のコードを実行できる可能性があります。Apple は、iOS 26 未満のバージョンで特定の標的個人に対し極めて高度な攻撃が行われたという報告を認識しています。", "risk": "メモリ書き込み権限を持つ攻撃者が任意のコードを実行できる可能性があります。", "summaryEvidenceIds": [ "E1" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "iOS および iPadOS はバージョン 26.3 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E3" ] }, { "text": "macOS はバージョン 26.3 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E4" ] }, { "text": "tvOS はバージョン 26.3 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E5" ] }, { "text": "visionOS はバージョン 26.3 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E6" ] }, { "text": "watchOS はバージョン 26.3 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：26.3未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Apple / macOS。影響ありとして記載：26.3未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Apple / tvOS。影響ありとして記載：26.3未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Apple / visionOS。影響ありとして記載：26.3未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Apple / watchOS。影響ありとして記載：26.3未満の版。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E3" ] }, { "text": "「iOS and iPadOS / macOS / tvOS / visionOS / watchOS」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20700", "https://support.apple.com/en-us/126346", "https://support.apple.com/en-us/126348", "https://support.apple.com/en-us/126351", "https://support.apple.com/en-us/126352", "https://support.apple.com/en-us/126353", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ] } ], "actions": [ { "text": "iOS と iPadOS をバージョン 26.3 に更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E1" ] }, { "text": "macOS Tahoe をバージョン 26.3 に更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E1" ] }, { "text": "tvOS をバージョン 26.3 に更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E1" ] }, { "text": "visionOS をバージョン 26.3 に更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E1" ] }, { "text": "watchOS をバージョン 26.3 に更新してください。", "kind": "fix", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E1" ] }, { "text": "「CVE-2026-20700」と現在の版を管理担当者・提供元へ伝え、この問題に対応した修正版が提供されているか確認します。下の問い合わせ文に記入すれば、そのまま依頼できます。対象範囲の上限から修正版の番号を推測しないでください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20700", "https://support.apple.com/en-us/126346", "https://support.apple.com/en-us/126348", "https://support.apple.com/en-us/126351", "https://support.apple.com/en-us/126352", "https://support.apple.com/en-us/126353", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ] }, { "text": "対象製品の正規の更新機能、または提供元が指定する配布経路で修正を含む更新を適用します。業務用の機器・サーバーは管理担当者と停止時間を決め、更新に必要な再起動まで完了させてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20700", "https://support.apple.com/en-us/126346", "https://support.apple.com/en-us/126348", "https://support.apple.com/en-us/126351", "https://support.apple.com/en-us/126352", "https://support.apple.com/en-us/126353", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-20700", "https://support.apple.com/en-us/126346", "https://support.apple.com/en-us/126348", "https://support.apple.com/en-us/126351", "https://support.apple.com/en-us/126352", "https://support.apple.com/en-us/126353", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-20700", "https://support.apple.com/en-us/126346", "https://support.apple.com/en-us/126348", "https://support.apple.com/en-us/126351", "https://support.apple.com/en-us/126352", "https://support.apple.com/en-us/126353", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "label": "CVE：apple" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-20700", "label": "CVE公式レコード" }, { "url": "https://support.apple.com/en-us/126346", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126348", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126351", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126352", "label": "CISAが示す関連情報" }, { "url": "https://support.apple.com/en-us/126353", "label": "CISAが示す関連情報" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3, visionOS 26.3, watchOS 26.3. An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.", "language": "en", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/problemTypes/0/descriptions/0", "excerpt": "{\"lang\":\"en\",\"description\":\"An attacker with memory write capability may be able to execute arbitrary code. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26. CVE-2025-14174 and CVE-2025-43529 were also issued in response to this report.\"}", "language": null, "representation": "source_json" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"iOS and iPadOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"macOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"tvOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"visionOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/20xxx/CVE-2026-20700.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Apple\",\"product\":\"watchOS\",\"versions\":[{\"version\":\"0\",\"status\":\"affected\",\"lessThan\":\"26.3\",\"versionType\":\"custom\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20700", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-20700\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-20700（iOS and iPadOS / macOS / tvOS / visionOS / watchOS）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・iOS および iPadOS はバージョン 26.3 未満が影響を受けます。\n・macOS はバージョン 26.3 未満が影響を受けます。\n・tvOS はバージョン 26.3 未満が影響を受けます。\n・visionOS はバージョン 26.3 未満が影響を受けます。\n・watchOS はバージョン 26.3 未満が影響を受けます。\n・公式の対象表：Apple / iOS and iPadOS。影響ありとして記載：26.3未満の版。\n・公式の対象表：Apple / macOS。影響ありとして記載：26.3未満の版。\n・公式の対象表：Apple / tvOS。影響ありとして記載：26.3未満の版。\n・公式の対象表：Apple / visionOS。影響ありとして記載：26.3未満の版。\n・公式の対象表：Apple / watchOS。影響ありとして記載：26.3未満の版。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-20700", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:55.643Z", "lastSuccess": "2026-10-23T03:24:55.643Z", "sourceCheckedAt": "2026-10-23T02:43:47.527Z", "errorCode": null }, "glossary": [ { "term": "任意のコード実行", "meaning": "攻撃者が用意した処理や命令を、対象のサーバー・機器に実行させられることです。実行できる権限や必要な条件は、個別の説明を確認します。", "sourceUrl": "https://cwe.mitre.org/data/definitions/94.html", "kind": "general_definition" } ] } }, { "id": "CVE-2026-21510", "aliases": [], "title": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi：脆弱性情報", "summary": "Windows Shell の保護機構が失敗し、ネットワーク経由で認可されていない攻撃者がセキュリティ機能を回避できる脆弱性です。", "risk": "攻撃者がネットワークを通じて Windows Shell の保護機構を回避できる可能性があります。", "product": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi", "category": "windows", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.6937（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.6937（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.6649（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.6649（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.7840（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 Version 25H2", "range": ">= 10.0.26200.0 / < 10.0.26200.7840" }, { "product": "Windows 11 version 26H1", "range": ">= 10.0.28000.0 / < 10.0.28000.1575（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 26H1", "range": ">= 10.0.28000.0 / < 10.0.28000.1575" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25923（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25923（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.23022（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.23022（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.4773（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.2149（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.32370（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.32370（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21510", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21510", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21510", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2026-02-10T17:51:32.210Z", "modifiedAt": "2026-08-19T16:26:02.555Z", "fetchedAt": "2026-10-23T02:43:47.673Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Windows Shell Security Feature Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "versions": [ { "version": "10.0.26200.0", "lessThan": "10.0.26200.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 26H1", "versions": [ { "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.4773", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.2149", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-21510", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "fetchedAt": "2026-10-23T02:43:47.673Z", "publishedAt": "2026-02-10T17:51:32.210Z", "modifiedAt": "2026-08-19T16:26:02.555Z", "state": "published", "provider": "microsoft", "title": "Windows Shell Security Feature Bypass Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/4", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "sourcePath": "/containers/cna/affected/7", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.26200.0", "lessThan": "10.0.26200.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 26H1", "sourcePath": "/containers/cna/affected/9", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.4773", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.2149", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-693", "lang": "en-US", "description": "CWE-693: Protection Mechanism Failure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510", "label": "Windows Shell Security Feature Bypass Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21510", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 26H1\",\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4773\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2149\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-693: Protection Mechanism Failure\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-693\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-19T16:26:02.555Z", "fetchedAt": "2026-10-23T02:43:47.673Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-10T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versiに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:55.684Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "8ca56a13710de5eeec0183ca6ffeb8528557eb1f79ec197ec5e4dce813f33a5a", "sourceModifiedAt": "2026-08-19T16:26:02.555Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Windows Shell の保護機構が失敗し、ネットワーク経由で認可されていない攻撃者がセキュリティ機能を回避できる脆弱性です。", "risk": "攻撃者がネットワークを通じて Windows Shell の保護機構を回避できる可能性があります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E2" ], "applicability": [ { "text": "Windows 10 Version 1607、1809、21H2、22H2（32 ビットおよび x64、ARM64 対応）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満、10.0.17763.0 以上 10.0.17763.8389 未満、10.0.19044.0 以上 10.0.19044.6937 未満、10.0.19045.0 以上 10.0.19045.6937 未満のものが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E3", "E4", "E5", "E6", "E1" ] }, { "text": "Windows 11 version 22H3、23H2、24H2、25H2、26H1（各プラットフォームに応じたアーキテクチャ）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満、10.0.26100.0 以上 10.0.26100.7840 未満、10.0.26200.0 以上 10.0.26200.7840 未満、10.0.28000.0 以上 10.0.28000.1575 未満のものが対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E7", "E8", "E9", "E10", "E11", "E12", "E1" ] }, { "text": "Windows Server 2012（x64）および Windows Server 2012 (Server Core)（x64）で、バージョン 6.2.9200.0 以上 6.2.9200.25923 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E13", "E14", "E1" ] }, { "text": "Windows Server 2012 R2（x64）および Windows Server 2012 R2 (Server Core)（x64）で、バージョン 6.3.9600.0 以上 6.3.9600.23022 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E15", "E16", "E1" ] }, { "text": "Windows Server 2016（x64）および Windows Server 2016 (Server Core)（x64）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E17", "E18", "E1" ] }, { "text": "Windows Server 2019（x64）および Windows Server 2019 (Server Core)（x64）で、バージョン 10.0.17763.0 以上 10.0.17763.8389 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E19", "E20", "E1" ] }, { "text": "Windows Server 2022（x64）で、バージョン 10.0.20348.0 以上 10.0.20348.4773 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E21", "E1" ] }, { "text": "Windows Server 2022, 23H2 Edition (Server Core)（x64）で、バージョン 10.0.25398.0 以上 10.0.25398.2149 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E22", "E1" ] }, { "text": "Windows Server 2025（x64）および Windows Server 2025 (Server Core)（x64）で、バージョン 10.0.26100.0 以上 10.0.26100.32370 未満が対象です。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E23", "E24", "E1" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7840未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7840未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4773未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2149未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E23" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E24" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21510" ], "evidenceIds": [ "E25" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2026-21510", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21510", "https://nvd.nist.gov/vuln/detail/CVE-2026-21510" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21510", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21510", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21510", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/title", "excerpt": "Windows Shell Security Feature Bypass Vulnerability", "language": null }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 26H1\",\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4773\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2149\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21510.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21510", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-21510\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-21510（Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 10 Version 1607、1809、21H2、22H2（32 ビットおよび x64、ARM64 対応）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満、10.0.17763.0 以上 10.0.17763.8389 未満、10.0.19044.0 以上 10.0.19044.6937 未満、10.0.19045.0 以上 10.0.19045.6937 未満のものが対象です。\n・Windows 11 version 22H3、23H2、24H2、25H2、26H1（各プラットフォームに応じたアーキテクチャ）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満、10.0.26100.0 以上 10.0.26100.7840 未満、10.0.26200.0 以上 10.0.26200.7840 未満、10.0.28000.0 以上 10.0.28000.1575 未満のものが対象です。\n・Windows Server 2012（x64）および Windows Server 2012 (Server Core)（x64）で、バージョン 6.2.9200.0 以上 6.2.9200.25923 未満が対象です。\n・Windows Server 2012 R2（x64）および Windows Server 2012 R2 (Server Core)（x64）で、バージョン 6.3.9600.0 以上 6.3.9600.23022 未満が対象です。\n・Windows Server 2016（x64）および Windows Server 2016 (Server Core)（x64）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満が対象です。\n・Windows Server 2019（x64）および Windows Server 2019 (Server Core)（x64）で、バージョン 10.0.17763.0 以上 10.0.17763.8389 未満が対象です。\n・Windows Server 2022（x64）で、バージョン 10.0.20348.0 以上 10.0.20348.4773 未満が対象です。\n・Windows Server 2022, 23H2 Edition (Server Core)（x64）で、バージョン 10.0.25398.0 以上 10.0.25398.2149 未満が対象です。\n・Windows Server 2025（x64）および Windows Server 2025 (Server Core)（x64）で、バージョン 10.0.26100.0 以上 10.0.26100.32370 未満が対象です。\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7840未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7840未満。\n・公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4773未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2149未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-21510", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:55.684Z", "lastSuccess": "2026-10-23T03:24:55.684Z", "sourceCheckedAt": "2026-10-23T02:43:47.673Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-21513", "aliases": [], "title": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi：脆弱性情報", "summary": "MSHTML Framework の保護機構が失敗し、ネットワーク経由で認可されていない攻撃者がセキュリティ機能を回避できる可能性があります。", "risk": "攻撃者がネットワーク上で保護機構を回避できるため、対象システムのセキュリティ機能が無効化される恐れがあります。", "product": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi", "category": "windows", "component": "package", "severity": "high", "cvss": 8.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "affected": [ { "product": "Windows 10 Version 1607", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 1809", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Windows 10 Version 21H2", "range": ">= 10.0.19044.0 / < 10.0.19044.6937（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 10 Version 22H2", "range": ">= 10.0.19045.0 / < 10.0.19045.6937（環境: 32-bit Systems / ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 version 22H3", "range": ">= 10.0.22631.0 / < 10.0.22631.6649（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 23H2", "range": ">= 10.0.22631.0 / < 10.0.22631.6649（環境: x64-based Systems）" }, { "product": "Windows 11 Version 24H2", "range": ">= 10.0.26100.0 / < 10.0.26100.7840（環境: ARM64-based Systems / x64-based Systems）" }, { "product": "Windows 11 Version 25H2", "range": ">= 10.0.26200.0 / < 10.0.26200.7840" }, { "product": "Windows 11 version 26H1", "range": ">= 10.0.28000.0 / < 10.0.28000.1575（環境: ARM64-based Systems）" }, { "product": "Windows 11 Version 26H1", "range": ">= 10.0.28000.0 / < 10.0.28000.1575" }, { "product": "Windows Server 2012", "range": ">= 6.2.9200.0 / < 6.2.9200.25923（環境: x64-based Systems）" }, { "product": "Windows Server 2012 (Server Core installation)", "range": ">= 6.2.9200.0 / < 6.2.9200.25923（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2", "range": ">= 6.3.9600.0 / < 6.3.9600.23022（環境: x64-based Systems）" }, { "product": "Windows Server 2012 R2 (Server Core installation)", "range": ">= 6.3.9600.0 / < 6.3.9600.23022（環境: x64-based Systems）" }, { "product": "Windows Server 2016", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: x64-based Systems）" }, { "product": "Windows Server 2016 (Server Core installation)", "range": ">= 10.0.14393.0 / < 10.0.14393.8868（環境: x64-based Systems）" }, { "product": "Windows Server 2019", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: x64-based Systems）" }, { "product": "Windows Server 2019 (Server Core installation)", "range": ">= 10.0.17763.0 / < 10.0.17763.8389（環境: x64-based Systems）" }, { "product": "Windows Server 2022", "range": ">= 10.0.20348.0 / < 10.0.20348.4773（環境: x64-based Systems）" }, { "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "range": ">= 10.0.25398.0 / < 10.0.25398.2149（環境: x64-based Systems）" }, { "product": "Windows Server 2025", "range": ">= 10.0.26100.0 / < 10.0.26100.32370（環境: x64-based Systems）" }, { "product": "Windows Server 2025 (Server Core installation)", "range": ">= 10.0.26100.0 / < 10.0.26100.32370（環境: x64-based Systems）" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21513", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21513", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513", "label": "MSHTML Framework Security Feature Bypass Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21513", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "publishedAt": "2026-02-10T17:51:26.733Z", "modifiedAt": "2026-08-19T16:25:57.019Z", "fetchedAt": "2026-10-23T02:43:47.677Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "MSHTML Framework Security Feature Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19044.0", "lessThan": "10.0.19044.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.19045.0", "lessThan": "10.0.19045.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "versions": [ { "version": "10.0.26200.0", "lessThan": "10.0.26200.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "platforms": [ "ARM64-based Systems" ], "versions": [ { "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 26H1", "versions": [ { "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.20348.0", "lessThan": "10.0.20348.4773", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.25398.0", "lessThan": "10.0.25398.2149", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "platforms": [ "x64-based Systems" ], "versions": [ { "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems / ARM64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-21513", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "fetchedAt": "2026-10-23T02:43:47.677Z", "publishedAt": "2026-02-10T17:51:26.733Z", "modifiedAt": "2026-08-19T16:25:57.019Z", "state": "published", "provider": "microsoft", "title": "MSHTML Framework Security Feature Bypass Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Windows 10 Version 1607", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 1809", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 21H2", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "10.0.19044.0", "lessThan": "10.0.19044.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 10 Version 22H2", "sourcePath": "/containers/cna/affected/3", "platforms": [ "32-bit Systems", "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "10.0.19045.0", "lessThan": "10.0.19045.6937", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 22H3", "sourcePath": "/containers/cna/affected/4", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 23H2", "sourcePath": "/containers/cna/affected/5", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/5/versions/0", "version": "10.0.22631.0", "lessThan": "10.0.22631.6649", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 24H2", "sourcePath": "/containers/cna/affected/6", "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/6/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 25H2", "sourcePath": "/containers/cna/affected/7", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/7/versions/0", "version": "10.0.26200.0", "lessThan": "10.0.26200.7840", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 version 26H1", "sourcePath": "/containers/cna/affected/8", "platforms": [ "ARM64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/8/versions/0", "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows 11 Version 26H1", "sourcePath": "/containers/cna/affected/9", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/9/versions/0", "version": "10.0.28000.0", "lessThan": "10.0.28000.1575", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012", "sourcePath": "/containers/cna/affected/10", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/10/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "sourcePath": "/containers/cna/affected/11", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/11/versions/0", "version": "6.2.9200.0", "lessThan": "6.2.9200.25923", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2", "sourcePath": "/containers/cna/affected/12", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/12/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "sourcePath": "/containers/cna/affected/13", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/13/versions/0", "version": "6.3.9600.0", "lessThan": "6.3.9600.23022", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016", "sourcePath": "/containers/cna/affected/14", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/14/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "sourcePath": "/containers/cna/affected/15", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/15/versions/0", "version": "10.0.14393.0", "lessThan": "10.0.14393.8868", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019", "sourcePath": "/containers/cna/affected/16", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/16/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "sourcePath": "/containers/cna/affected/17", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/17/versions/0", "version": "10.0.17763.0", "lessThan": "10.0.17763.8389", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022", "sourcePath": "/containers/cna/affected/18", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/18/versions/0", "version": "10.0.20348.0", "lessThan": "10.0.20348.4773", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "sourcePath": "/containers/cna/affected/19", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/19/versions/0", "version": "10.0.25398.0", "lessThan": "10.0.25398.2149", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025", "sourcePath": "/containers/cna/affected/20", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/20/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Windows Server 2025 (Server Core installation)", "sourcePath": "/containers/cna/affected/21", "platforms": [ "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/21/versions/0", "version": "10.0.26100.0", "lessThan": "10.0.26100.32370", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-693", "lang": "en-US", "description": "CWE-693: Protection Mechanism Failure", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "baseScore": 8.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513", "label": "MSHTML Framework Security Feature Bypass Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/0" }, { "url": "https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework", "label": "CVE", "tags": [], "provider": "CVE", "sourcePath": "/containers/adp/1/references/1" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/5", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/6", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/7", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/8", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/9", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 26H1\",\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/10", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/11", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/12", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/13", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/14", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/15", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/16", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/17", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/18", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4773\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/19", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2149\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/20", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/affected/21", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-693: Protection Mechanism Failure\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-693\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":8.8,\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-19T16:25:57.019Z", "fetchedAt": "2026-10-23T02:43:47.677Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-10T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versiに脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:24:56.484Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "be9022ed1496f4295dc76654960dc1fbed2a05c5c239a4e2286990f9c8fb5b56", "sourceModifiedAt": "2026-08-19T16:25:57.019Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "MSHTML Framework の保護機構が失敗し、ネットワーク経由で認可されていない攻撃者がセキュリティ機能を回避できる可能性があります。", "risk": "攻撃者がネットワーク上で保護機構を回避できるため、対象システムのセキュリティ機能が無効化される恐れがあります。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "Windows 10 Version 1607（32 ビット、x64）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E3", "E2" ] }, { "text": "Windows 10 Version 1809（32 ビット、x64）で、バージョン 10.0.17763.0 以上 10.0.17763.8389 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E4", "E2" ] }, { "text": "Windows 10 Version 21H2（32 ビット、ARM64、x64）で、バージョン 10.0.19044.0 以上 10.0.19044.6937 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E5", "E2" ] }, { "text": "Windows 10 Version 22H2（32 ビット、ARM64、x64）で、バージョン 10.0.19045.0 以上 10.0.19045.6937 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E6", "E2" ] }, { "text": "Windows 11 version 22H3（ARM64）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E7", "E2" ] }, { "text": "Windows 11 Version 23H2（x64）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E8", "E2" ] }, { "text": "Windows 11 Version 24H2（ARM64、x64）で、バージョン 10.0.26100.0 以上 10.0.26100.7840 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E9", "E2" ] }, { "text": "Windows 11 Version 25H2で、バージョン 10.0.26200.0 以上 10.0.26200.7840 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E10", "E2" ] }, { "text": "Windows 11 version 26H1（ARM64）で、バージョン 10.0.28000.0 以上 10.0.28000.1575 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E11", "E2" ] }, { "text": "Windows Server 2012（x64）および Windows Server 2012 (Server Core)（x64）で、バージョン 6.2.9200.0 以上 6.2.9200.25923 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E12", "E13", "E2" ] }, { "text": "Windows Server 2012 R2（x64）および Windows Server 2012 R2 (Server Core)（x64）で、バージョン 6.3.9600.0 以上 6.3.9600.23022 未満が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E14", "E15", "E2" ] }, { "text": "Windows Server 2016、Windows Server 2016 (Server Core)、Windows Server 2019、Windows Server 2019 (Server Core)、Windows Server 2022、Windows Server 2022 23H2 Edition (Server Core)、Windows Server 2025、Windows Server 2025 (Server Core)（すべて x64）で、各バージョンがそれぞれ 10.0.14393.0 以上 10.0.14393.8868 未満、10.0.17763.0 以上 10.0.17763.8389 未満、10.0.20348.0 以上 10.0.20348.4773 未満、10.0.25398.0 以上 10.0.25398.2149 未満、10.0.26100.0 以上 10.0.26100.32370 未満の範囲が影響を受けます。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E16", "E17", "E18", "E19", "E20", "E21", "E22", "E23" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E7" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E8" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7840未満。対象の環境：ARM64-based Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E9" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7840未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E10" ] }, { "text": "公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。対象の環境：ARM64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E11" ] }, { "text": "公式の対象表：Microsoft / Windows 11 Version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E24" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E12" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E13" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E14" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E15" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E16" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E17" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E18" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E19" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4773未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E20" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2149未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E21" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E22" ] }, { "text": "公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E23" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21513" ], "evidenceIds": [ "E25" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E3" ] }, { "text": "「スタート」→「設定」→「システム」→「バージョン情報」を開き、Windowsのエディション・バージョン・OSビルドを控えます。会社のPCやサーバーは、この情報とCVE番号を管理担当者へ渡してください。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "すぐ更新できない場合は、CVE番号、Windowsの版、業務で必要な機能を管理担当者に伝え、修正までの利用方法と更新予定を決めてください。すべてのWindowsの問題に同じ回避策が使えるわけではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "https://www.cve.org/CVERecord?id=CVE-2026-21513", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21513", "https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513", "https://nvd.nist.gov/vuln/detail/CVE-2026-21513" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json" ], "evidenceIds": [ "E3" ] }, { "text": "再起動後にWindows Updateを開き直して失敗・再起動待ちがないか確認し、管理担当者にこのCVEに対応する修正の適用結果を確認してもらってください。「最新の状態」と出ても、別製品の更新やサポート外の版の修正を保証するものではありません。", "kind": "procedure", "sourceUrls": [ "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21513", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21513", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513", "label": "MSHTML Framework Security Feature Bypass Vulnerability" }, { "url": "https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21513", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://support.microsoft.com/en-us/windows/experience/find-information-about-your-windows-device", "label": "Microsoft公式：Windowsの情報を調べる" }, { "url": "https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/install-windows-updates", "label": "Microsoft公式：Windows Updateの操作" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/title", "excerpt": "MSHTML Framework Security Feature Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1607\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 1809\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 21H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19044.0\",\"lessThan\":\"10.0.19044.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 10 Version 22H2\",\"platforms\":[\"32-bit Systems\",\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.19045.0\",\"lessThan\":\"10.0.19045.6937\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 22H3\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/5", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 23H2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.22631.0\",\"lessThan\":\"10.0.22631.6649\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E9", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/6", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 24H2\",\"platforms\":[\"ARM64-based Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E10", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/7", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 25H2\",\"versions\":[{\"version\":\"10.0.26200.0\",\"lessThan\":\"10.0.26200.7840\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E11", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/8", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 version 26H1\",\"platforms\":[\"ARM64-based Systems\"],\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E12", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/10", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E13", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/11", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.2.9200.0\",\"lessThan\":\"6.2.9200.25923\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E14", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/12", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E15", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/13", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2012 R2 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"6.3.9600.0\",\"lessThan\":\"6.3.9600.23022\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E16", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/14", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E17", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/15", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2016 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.14393.0\",\"lessThan\":\"10.0.14393.8868\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E18", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/16", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E19", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/17", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2019 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.17763.0\",\"lessThan\":\"10.0.17763.8389\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E20", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/18", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.20348.0\",\"lessThan\":\"10.0.20348.4773\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E21", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/19", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2022, 23H2 Edition (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.25398.0\",\"lessThan\":\"10.0.25398.2149\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E22", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/20", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E23", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/21", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows Server 2025 (Server Core installation)\",\"platforms\":[\"x64-based Systems\"],\"versions\":[{\"version\":\"10.0.26100.0\",\"lessThan\":\"10.0.26100.32370\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E24", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21513.json", "sourceField": "/containers/cna/affected/9", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Windows 11 Version 26H1\",\"versions\":[{\"version\":\"10.0.28000.0\",\"lessThan\":\"10.0.28000.1575\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E25", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21513", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-21513\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-21513（Windows 10 Version 1607 / Windows 10 Version 1809 / Windows 10 Version 21H2 / Windows 10 Version 22H2 / Windows 11 version 22H3 / Windows 11 Version 23H2 / Windows 11 Version 24H2 / Windows 11 Version 25H2 / Windows 11 version 26H1 / Windows 11 Versi）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・Windows 10 Version 1607（32 ビット、x64）で、バージョン 10.0.14393.0 以上 10.0.14393.8868 未満が影響を受けます。\n・Windows 10 Version 1809（32 ビット、x64）で、バージョン 10.0.17763.0 以上 10.0.17763.8389 未満が影響を受けます。\n・Windows 10 Version 21H2（32 ビット、ARM64、x64）で、バージョン 10.0.19044.0 以上 10.0.19044.6937 未満が影響を受けます。\n・Windows 10 Version 22H2（32 ビット、ARM64、x64）で、バージョン 10.0.19045.0 以上 10.0.19045.6937 未満が影響を受けます。\n・Windows 11 version 22H3（ARM64）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満が影響を受けます。\n・Windows 11 Version 23H2（x64）で、バージョン 10.0.22631.0 以上 10.0.22631.6649 未満が影響を受けます。\n・Windows 11 Version 24H2（ARM64、x64）で、バージョン 10.0.26100.0 以上 10.0.26100.7840 未満が影響を受けます。\n・Windows 11 Version 25H2で、バージョン 10.0.26200.0 以上 10.0.26200.7840 未満が影響を受けます。\n・Windows 11 version 26H1（ARM64）で、バージョン 10.0.28000.0 以上 10.0.28000.1575 未満が影響を受けます。\n・Windows Server 2012（x64）および Windows Server 2012 (Server Core)（x64）で、バージョン 6.2.9200.0 以上 6.2.9200.25923 未満が影響を受けます。\n・Windows Server 2012 R2（x64）および Windows Server 2012 R2 (Server Core)（x64）で、バージョン 6.3.9600.0 以上 6.3.9600.23022 未満が影響を受けます。\n・Windows Server 2016、Windows Server 2016 (Server Core)、Windows Server 2019、Windows Server 2019 (Server Core)、Windows Server 2022、Windows Server 2022 23H2 Edition (Server Core)、Windows Server 2025、Windows Server 2025 (Server Core)（すべて x64）で、各バージョンがそれぞれ 10.0.14393.0 以上 10.0.14393.8868 未満、10.0.17763.0 以上 10.0.17763.8389 未満、10.0.20348.0 以上 10.0.20348.4773 未満、10.0.25398.0 以上 10.0.25398.2149 未満、10.0.26100.0 以上 10.0.26100.32370 未満の範囲が影響を受けます。\n・公式の対象表：Microsoft / Windows 10 Version 1607。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 1809。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 21H2。影響ありとして記載：10.0.19044.0以上、10.0.19044.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 10 Version 22H2。影響ありとして記載：10.0.19045.0以上、10.0.19045.6937未満。対象の環境：32-bit Systems、ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 version 22H3。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 23H2。影響ありとして記載：10.0.22631.0以上、10.0.22631.6649未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 24H2。影響ありとして記載：10.0.26100.0以上、10.0.26100.7840未満。対象の環境：ARM64-based Systems、x64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 25H2。影響ありとして記載：10.0.26200.0以上、10.0.26200.7840未満。\n・公式の対象表：Microsoft / Windows 11 version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。対象の環境：ARM64-based Systems\n・公式の対象表：Microsoft / Windows 11 Version 26H1。影響ありとして記載：10.0.28000.0以上、10.0.28000.1575未満。\n・公式の対象表：Microsoft / Windows Server 2012。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 (Server Core installation)。影響ありとして記載：6.2.9200.0以上、6.2.9200.25923未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2012 R2 (Server Core installation)。影響ありとして記載：6.3.9600.0以上、6.3.9600.23022未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2016 (Server Core installation)。影響ありとして記載：10.0.14393.0以上、10.0.14393.8868未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2019 (Server Core installation)。影響ありとして記載：10.0.17763.0以上、10.0.17763.8389未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022。影響ありとして記載：10.0.20348.0以上、10.0.20348.4773未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)。影響ありとして記載：10.0.25398.0以上、10.0.25398.2149未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems\n・公式の対象表：Microsoft / Windows Server 2025 (Server Core installation)。影響ありとして記載：10.0.26100.0以上、10.0.26100.32370未満。対象の環境：x64-based Systems\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-21513", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:24:56.484Z", "lastSuccess": "2026-10-23T03:24:56.484Z", "sourceCheckedAt": "2026-10-23T02:43:47.677Z", "errorCode": null }, "glossary": [] } }, { "id": "CVE-2026-21514", "aliases": [], "title": "Microsoft 365 Apps for Enterprise / Microsoft Office LTSC 2021 / Microsoft Office LTSC 2024 / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024：脆弱性情報", "summary": "Microsoft Office Word のセキュリティ機能の判断に信頼できない入力が使用されており、認可されていない攻撃者がローカルでその機能を回避できる。", "risk": "セキュリティ機能が回避される可能性がある。", "product": "Microsoft 365 Apps for Enterprise / Microsoft Office LTSC 2021 / Microsoft Office LTSC 2024 / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024", "category": "windows", "component": "package", "severity": "high", "cvss": 7.8, "cvssVersion": "3.1", "cvssSource": "microsoft", "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "affected": [ { "product": "Microsoft 365 Apps for Enterprise", "range": ">= 16.0.1 / < https://aka.ms/OfficeSecurityReleases（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Microsoft Office LTSC 2021", "range": ">= 16.0.1 / < https://aka.ms/OfficeSecurityReleases（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Microsoft Office LTSC 2024", "range": ">= 16.0.0 / < https://aka.ms/OfficeSecurityReleases（環境: 32-bit Systems / x64-based Systems）" }, { "product": "Microsoft Office LTSC for Mac 2021", "range": ">= 16.0.1 / < 16.106.26020821" }, { "product": "Microsoft Office LTSC for Mac 2024", "range": ">= 16.0.0 / < 16.106.26020821" } ], "fixed": [], "steps": [ "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。" ], "references": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21514", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21514", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "publishedAt": "2026-02-10T17:51:34.153Z", "modifiedAt": "2026-08-19T16:26:04.274Z", "fetchedAt": "2026-10-23T02:43:47.714Z", "exploitStatus": "confirmed", "sources": [ "CVE", "CISA KEV" ], "originalText": "", "sourceTitle": "Microsoft Word Security Feature Bypass Vulnerability", "summaryMethod": "公式の公開情報を根拠に自動作成した日本語解説です。引用との整合性を自動検査しています。人による個別確認や利用環境の診断ではありません。", "state": "published", "affectedDetails": [ { "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "platforms": [ "32-bit Systems", "x64-based Systems" ], "versions": [ { "version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "versions": [ { "version": "16.0.1", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "versions": [ { "version": "16.0.0", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected" } ] } ], "configurationNotes": "対象環境・機能: 32-bit Systems / x64-based Systems。製品バージョンだけでなく、原文の利用条件を照合してください。", "officialEvidence": { "schemaVersion": "1.0", "id": "CVE-2026-21514", "sourceType": "CVE", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "fetchedAt": "2026-10-23T02:43:47.714Z", "publishedAt": "2026-02-10T17:51:34.153Z", "modifiedAt": "2026-08-19T16:26:04.274Z", "state": "published", "provider": "microsoft", "title": "Microsoft Word Security Feature Bypass Vulnerability", "descriptions": [ { "lang": "en-US", "value": "Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.", "sourcePath": "/containers/cna/descriptions/0/value" } ], "affected": [ { "vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "sourcePath": "/containers/cna/affected/0", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/0/versions/0", "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "sourcePath": "/containers/cna/affected/1", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/1/versions/0", "version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "sourcePath": "/containers/cna/affected/2", "platforms": [ "32-bit Systems", "x64-based Systems" ], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/2/versions/0", "version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2021", "sourcePath": "/containers/cna/affected/3", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/3/versions/0", "version": "16.0.1", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected" } ] }, { "vendor": "Microsoft", "product": "Microsoft Office LTSC for Mac 2024", "sourcePath": "/containers/cna/affected/4", "platforms": [], "modules": [], "programFiles": [], "cpes": [], "programRoutines": [], "versions": [ { "sourcePath": "/containers/cna/affected/4/versions/0", "version": "16.0.0", "lessThan": "16.106.26020821", "versionType": "custom", "status": "affected" } ] } ], "solutions": [], "workarounds": [], "exploits": [], "rejectedReasons": [], "problemTypes": [ { "cweId": "CWE-807", "lang": "en-US", "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0" } ], "metrics": [ { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "baseScore": 7.8, "baseSeverity": "HIGH", "provider": "microsoft", "sourcePath": "/containers/cna/metrics/0/cvssV3_1" } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "label": "Microsoft Word Security Feature Bypass Vulnerability", "tags": [ "vendor-advisory", "patch" ], "provider": "microsoft", "sourcePath": "/containers/cna/references/0" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21514", "label": "CISA-ADP", "tags": [ "government-resource" ], "provider": "CISA-ADP", "sourcePath": "/containers/adp/0/references/0" } ], "snippets": [ { "evidenceId": "official:/containers/cna/affected/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/affected/0", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft 365 Apps for Enterprise\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/affected/1", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC 2021\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/affected/2", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC 2024\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/affected/3", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC for Mac 2021\",\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"16.106.26020821\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/affected/4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/affected/4", "text": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC for Mac 2024\",\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.106.26020821\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/descriptions/0/value", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/descriptions/0/value", "text": "Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.", "truncated": false, "representation": "source_excerpt" }, { "evidenceId": "official:/containers/cna/problemTypes/0/descriptions/0", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/problemTypes/0/descriptions/0", "text": "{\"description\":\"CWE-807: Reliance on Untrusted Inputs in a Security Decision\",\"lang\":\"en-US\",\"type\":\"CWE\",\"cweId\":\"CWE-807\"}", "truncated": false, "representation": "source_json" }, { "evidenceId": "official:/containers/cna/metrics/0/cvssV3_1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourcePath": "/containers/cna/metrics/0/cvssV3_1", "text": "{\"version\":\"3.1\",\"baseSeverity\":\"HIGH\",\"baseScore\":7.8,\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C\"}", "truncated": false, "representation": "source_json" } ], "limits": { "completeness": "official_record", "truncatedFields": [], "note": "CVE公式レコードに記載された情報です。参照先の個別ページ本文は含みません。unaffected（影響なし）の版を修正版とは推測しません。" } }, "sourceSnapshots": [ { "source": "CVE", "modifiedAt": "2026-08-19T16:26:04.274Z", "fetchedAt": "2026-10-23T02:43:47.714Z", "state": "published" }, { "source": "CISA KEV", "modifiedAt": "2026-02-10T00:00:00.000Z", "fetchedAt": "2026-10-23T02:17:50.489Z", "state": "published" } ], "sourceAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "sourceSummary": "Microsoft 365 Apps for Enterprise / Microsoft Office LTSC 2021 / Microsoft Office LTSC 2024 / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024に脆弱性情報に関する脆弱性情報があります。影響を受ける条件を確認してください。", "sourceRisk": "影響と攻撃の成立条件は、リンク先の公式情報で確認してください。", "guidance": { "schemaVersion": "1.0", "method": "automatic", "reviewedAt": null, "reviewState": "current", "generatedAt": "2026-10-23T03:48:22.528Z", "generatorVersion": "2026-10-23.3", "sourceFingerprint": "652594cec6f102b0f45c0446ecc78d322376edbe88f665ae78b02de1d8aa69b1", "sourceModifiedAt": "2026-08-19T16:26:04.274Z", "model": "@cf/openai/gpt-oss-120b", "verificationMethod": "exact_source_excerpt_and_independent_semantic_check", "summary": "Microsoft Office Word のセキュリティ機能の判断に信頼できない入力が使用されており、認可されていない攻撃者がローカルでその機能を回避できる。", "risk": "セキュリティ機能が回避される可能性がある。", "summaryEvidenceIds": [ "E1", "E2" ], "riskEvidenceIds": [ "E1" ], "applicability": [ { "text": "公式の対象表：Microsoft / Microsoft 365 Apps for Enterprise。影響ありとして記載：開始値は16.0.1。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E3" ] }, { "text": "公式の対象表：Microsoft / Microsoft Office LTSC 2021。影響ありとして記載：開始値は16.0.1。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E4" ] }, { "text": "公式の対象表：Microsoft / Microsoft Office LTSC 2024。影響ありとして記載：開始値は16.0.0。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E5" ] }, { "text": "公式の対象表：Microsoft / Microsoft Office LTSC for Mac 2021。影響ありとして記載：16.0.1以上、16.106.26020821未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E6" ] }, { "text": "公式の対象表：Microsoft / Microsoft Office LTSC for Mac 2024。影響ありとして記載：16.0.0以上、16.106.26020821未満。", "kind": "fact", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E7" ] }, { "text": "CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。", "kind": "fact", "sourceUrls": [ "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514" ], "evidenceIds": [ "E8" ] } ], "versionChecks": [ { "text": "管理担当者に、利用中の製品名・開発元・版やビルド番号を確認してもらいます。上に記載した対象の機能・設定・利用者の権限も、実際の環境と照合してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E3" ] }, { "text": "「Microsoft 365 Apps for Enterprise / Microsoft Office LTSC 2021 / Microsoft Office LTSC 2024 / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024」の管理画面・設定・製品情報で、正式な製品名、開発元、版・ビルド番号を控えます。見つからない場合は、購入先・提供元・管理担当者へ下の問い合わせ文を送ってください。製品名が似ているだけでは対象とは判断できません。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21514", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "https://nvd.nist.gov/vuln/detail/CVE-2026-21514" ] } ], "actions": [ { "text": "利用中の製品名・版と上の対象条件を管理担当者に伝え、この脆弱性に対応した修正の有無、適用する版・手順・実施日を確認してください。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E3" ] } ], "temporaryMitigations": [ { "text": "修正が間に合わない場合は、提供元に「このCVEに有効な回避策」「利用を続けてよい条件」「修正予定日」を確認します。機能停止や接続制限が必要かは、その製品・構成に合わせて管理担当者と決めてください。", "kind": "procedure", "sourceUrls": [ "https://www.cve.org/CVERecord?id=CVE-2026-21514", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "https://nvd.nist.gov/vuln/detail/CVE-2026-21514" ] } ], "verification": [ { "text": "対応を依頼した場合は、実施した版・設定と完了日時、この脆弱性への修正が含まれると判断した根拠を担当者から受け取ってください。更新後は普段使う主要な操作も確認します。", "kind": "procedure", "sourceUrls": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json" ], "evidenceIds": [ "E3" ] }, { "text": "更新後に製品情報を開き直して版・ビルド番号を記録し、このCVEへの修正が含まれることを提供元の回答・修正情報と照合します。通常使う主要な操作も確かめてください。", "kind": "procedure", "sourceUrls": [ "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "https://www.cve.org/CVERecord?id=CVE-2026-21514", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "https://nvd.nist.gov/vuln/detail/CVE-2026-21514" ] } ], "unknowns": [ "この解説は、利用中の機器・サイトの設定や修正の適用状況を検査した結果ではありません。製品名・版と上に示した条件を、実際の環境と照合してください。", "今回取得した資料から、修正済みと明記された版の番号を取り出せていません。修正が存在しないという意味ではありません。対象の製品・現在の版を添え、提供元に修正版の番号と適用方法を確認してください。" ], "sources": [ { "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "label": "CVE：microsoft" }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "label": "CISA KEV（悪用確認）" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-21514", "label": "CVE公式レコード" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514", "label": "CISAが示す関連情報" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21514", "label": "CISAが示す関連情報" }, { "url": "https://www.first.org/cvss/v3.1/specification-document", "label": "FIRST公式：CVSS 3.1の条件の定義" }, { "url": "https://www.cisa.gov/sites/default/files/2024-09/Secure-Our-World-Software-Updates-Tip-Sheet.pdf", "label": "CISA：ソフトウェア更新の基本" } ], "evidence": [ { "id": "E1", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/descriptions/0/value", "excerpt": "Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.", "language": "en-US", "representation": "source_excerpt" }, { "id": "E2", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/title", "excerpt": "Microsoft Word Security Feature Bypass Vulnerability", "language": null }, { "id": "E3", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/affected/0", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft 365 Apps for Enterprise\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E4", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/affected/1", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC 2021\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E5", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/affected/2", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC 2024\",\"platforms\":[\"32-bit Systems\",\"x64-based Systems\"],\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"https://aka.ms/OfficeSecurityReleases\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E6", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/affected/3", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC for Mac 2021\",\"versions\":[{\"version\":\"16.0.1\",\"lessThan\":\"16.106.26020821\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E7", "sourceUrl": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21514.json", "sourceField": "/containers/cna/affected/4", "excerpt": "{\"vendor\":\"Microsoft\",\"product\":\"Microsoft Office LTSC for Mac 2024\",\"versions\":[{\"version\":\"16.0.0\",\"lessThan\":\"16.106.26020821\",\"versionType\":\"custom\",\"status\":\"affected\"}]}", "language": null, "representation": "source_json" }, { "id": "E8", "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21514", "sourceField": "/exploitStatus", "excerpt": "{\"id\":\"CVE-2026-21514\",\"source\":\"CISA KEV\",\"knownExploited\":true,\"meaning\":\"CISA lists this vulnerability as known to have been exploited in the wild. This does not establish compromise of the reader's environment or prove ongoing attacks today.\"}", "language": "en", "representation": "normalized_feed_field" } ], "supportRequest": "件名：CVE-2026-21514（Microsoft 365 Apps for Enterprise / Microsoft Office LTSC 2021 / Microsoft Office LTSC 2024 / Microsoft Office LTSC for Mac 2021 / Microsoft Office LTSC for Mac 2024）の影響と対応確認\n\n利用中の製品・サービス：[記入してください]\n現在のバージョン・設定：[不明なら「不明」と記入]\n\n次の公式情報にある条件が、私たちの環境に当てはまるか確認をお願いします。\n・公式の対象表：Microsoft / Microsoft 365 Apps for Enterprise。影響ありとして記載：開始値は16.0.1。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Microsoft Office LTSC 2021。影響ありとして記載：開始値は16.0.1。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Microsoft Office LTSC 2024。影響ありとして記載：開始値は16.0.0。上限欄は版番号ではなく提供元の更新案内へのリンクです。対象となる更新チャネル・製品の版を管理担当者と確認してください。対象の環境：32-bit Systems、x64-based Systems\n・公式の対象表：Microsoft / Microsoft Office LTSC for Mac 2021。影響ありとして記載：16.0.1以上、16.106.26020821未満。\n・公式の対象表：Microsoft / Microsoft Office LTSC for Mac 2024。影響ありとして記載：16.0.0以上、16.106.26020821未満。\n・CISAの一覧では、この脆弱性が実際の攻撃に使われたことが確認されています。対象かどうかの確認と修正を優先してください。この情報だけで、あなたの環境が被害を受けたとは判断できません。\n\n対象の場合、適用する修正・回避策、実施予定、停止や再起動の必要性、完了後の確認結果を教えてください。\n確認している情報：https://zeijaku.ittrip.xyz/vulnerabilities/CVE-2026-21514", "publicationCheckVersion": "2026-10-23.1", "sourceNotices": [], "automation": { "status": "ready", "lastAttempt": "2026-10-23T03:48:22.528Z", "lastSuccess": "2026-10-23T03:48:22.528Z", "sourceCheckedAt": "2026-10-23T02:43:47.714Z", "errorCode": null }, "glossary": [] } } ], "total": 2206, "limit": 20, "offset": 640, "filters": { "product": "all", "type": "all", "q": "", "page": 33 }, "pagination": { "page": 33, "pageSize": 20, "totalPages": 111 }, "sources": [ { "name": "JVN", "status": "ok", "lastSuccess": "2026-10-24T01:17:49.328Z", "lastAttempt": "2026-10-24T01:17:49.328Z", "error": null, "recordCount": 20, "coverage": "JVNの新着・更新RSS。取得した記事を蓄積。JVN iPediaは含みません。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "PHP Security", "status": "error", "lastSuccess": "2026-10-24T00:17:49.426Z", "lastAttempt": "2026-10-24T01:17:49.328Z", "error": "GitHub API取得上限に到達 (2026-10-24T01:45:41.000Z以降に再取得)", "recordCount": 66, "coverage": "PHP開発元の公開アドバイザリ。公開日が新しい順とは限らない直近100件を取得し蓄積。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "CISA KEV", "status": "ok", "lastSuccess": "2026-10-24T01:17:49.328Z", "lastAttempt": "2026-10-24T01:17:49.328Z", "error": null, "recordCount": 1756, "coverage": "CISAの公式GitHubミラーにある悪用確認済み一覧全件。掲載日はKEV追加日。", "cursor": null, "freshness": "fresh", "stale": false }, { "name": "NVD", "status": "ok", "lastSuccess": "2026-10-23T21:17:50.096Z", "lastAttempt": "2026-10-24T01:17:49.328Z", "error": null, "recordCount": 1, "coverage": "WordPressを含む脆弱性。初回は公開7日分、以降は全製品の変更分からWordPressと保存済みIDを追跡。停止後は最後に確認できた時刻から最大7日幅・500件ずつ再開し、残りは次回取得。 今回: 2026-10-23T19:02:50.573Z 〜 2026-10-23T21:17:50.096Z、全製品の変更 2160/2160件まで確認、対象1件反映。", "cursor": null, "freshness": "stale", "stale": true }, { "name": "CVE", "status": "ok", "lastSuccess": "2026-10-24T01:17:49.328Z", "lastAttempt": "2026-10-24T01:17:49.328Z", "error": null, "recordCount": 6, "coverage": "取得したPHP/JVN情報のうち、公開日が新しい最大6件のCVE公式レコードで条件を補足。 PHP公式ニュース経由で候補補足（先頭20項目から2件）。GitHub全件代替ではない。CVE取得は既存候補と合わせ最大6件。", "cursor": null, "freshness": "fresh", "stale": false } ] }