「うちの会社、大丈夫かな？」

Subject: [Security Advisory] Cisco Unified CM/SME CVE-2026-20230 Mitigation

Dear Team,

We are sharing critical information regarding a vulnerability in Cisco Unified CM and Unified CM SME.

■ Overview
An SSRF vulnerability (CVE-2026-20230, CVSS 8.6) has been identified. An attacker could send a crafted HTTP request to write files to the underlying OS, potentially leading to root privilege escalation. Proof-of-Concept (PoC) code is available.

■ Scope
- Cisco Unified Communications Manager (Unified CM)
- Unified Communications Manager Session Management Edition (Unified CM SME)
*Only affects appliances with the WebDialer service enabled (disabled by default).

■ Action Plan
1. Verify if the WebDialer service is enabled in your environment.
2. If enabled, upgrade to fixed versions 14SU6 or 15SU5 immediately.

■ Reference
- Cisco Official Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Windows Kernel LPE Vulnerability (CVE-2026-40369)

Dear IT/Security Team,

We are sharing information regarding a local privilege escalation (LPE) vulnerability in the Windows kernel.

■ Overview
A vulnerability in the nt!ExpGetProcessInformation component allows an attacker to gain SYSTEM privileges via an untrusted pointer dereference. Since a full PoC is available on GitHub and the flaw enables browser sandbox escapes, the risk of exploitation is significant.

■ Affected Scope
- Windows 11 versions 24H2 through 25H2

■ Mitigation Steps
1. Apply the official security updates released in the May Patch Tuesday cycle.
2. Verify the patch status across all endpoints using centralized management tools.

■ Reference
- Microsoft Security Update Guide / CVE-2026-40369

Priority: High
Deadline: Immediate

Subject: [Security Advisory] WP Maps Pro CVE-2026-8732 Mitigation

Dear IT Administration Team,

We are sharing critical information regarding a vulnerability in the WP Maps Pro plugin for WordPress.

■ Overview
A critical vulnerability (CVE-2026-8732) allows unauthenticated attackers to create a new administrator account. By exploiting a flaw in the temporary access function, an attacker can gain full control over the affected website.

■ Scope
- Product: WP Maps Pro
- Affected Versions: 6.1.0 and earlier

■ Mitigation Steps
1. Update the WP Maps Pro plugin to the latest available version immediately.
2. Audit the administrator user list for any unauthorized accounts, specifically looking for those associated with the email '[email protected]'.

■ Reference
- ThaiCERT Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Malicious npm Package 'mouse5212-super-formatter' targeting Claude AI

Dear IT/Security Team,

We are sharing information regarding a supply chain attack involving a malicious npm package designed to exfiltrate data from Claude AI environments.

■ Overview
The package 'mouse5212-super-formatter' (codenamed Malware-Slop) masquerades as a sync utility. Upon installation, it targets the '/mnt/user-data' directory used by Anthropic's Claude AI and uploads files to a remote GitHub repository using stolen or hard-coded tokens.

■ Scope
- Affected Package: mouse5212-super-formatter
- Target: Environments utilizing Claude AI with the aforementioned directory structure.

■ Action Items
1. Audit all development environments and CI/CD pipelines for the presence of the 'mouse5212-super-formatter' package.
2. Review package-lock.json or yarn.lock files for unauthorized dependencies.
3. Review and rotate GitHub access tokens stored in environment variables to ensure the principle of least privilege.

■ Reference
- OX Security Threat Intelligence

Priority: High
Deadline: Immediate

Subject: [Urgent] Remediation for KnowledgeDeliver LMS CVE-2026-5426

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in KnowledgeDeliver LMS.

■ Overview
CVE-2026-5426 is a critical vulnerability caused by shared hard-coded ASP.NET/IIS machineKeys, allowing unauthenticated ViewState deserialization and subsequent Remote Code Execution (RCE). This is being exploited in the wild to deploy Godzilla (BLUEBEAM) web shells and distribute Cobalt Strike Beacons.

■ Scope
- Product: KnowledgeDeliver LMS
- Specifically installations deployed before February 24, 2026.

■ Remediation Steps
1. Update KnowledgeDeliver LMS to the latest patched version immediately.
2. Ensure that the machineKey in the web.config file is changed from the default to a unique, secure value.
3. Audit the IIS worker process for unauthorized shells and check application JavaScript files for unauthorized modifications.

■ Reference
- ThaiCERT Advisory

Priority: High
Deadline: Immediate