「うちの会社、大丈夫かな？」

Subject: [Security Alert] Exploited Vulnerabilities in Fortinet and BeyondTrust

Dear IT/Security Team,

CISA has added the following vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

■ Overview
- Fortinet Multiple Products: Path Traversal (CVE-2025-61624). This has been linked to the deployment of the PEERSTITCH implant.
- BeyondTrust Remote Support: Authentication Bypass via Spoofing (CVE-2026-102764).

■ Affected Scope
- Fortinet Multiple Products
- BeyondTrust Remote Support

■ Action Plan
1. Identify if the affected products and versions are deployed in our environment.
2. Apply the latest security updates provided by the vendors immediately.
3. Review system logs for indicators of compromise (IoCs) related to PEERSTITCH.

■ Reference
- CISA KEV Catalog

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Linux Kernel Vghost (CVE-2026-74580) Mitigation

Dear IT Administration Team,

We are sharing information regarding a critical vulnerability in the Linux Kernel.

■ Overview
A memory corruption vulnerability known as 'Vghost' (CVE-2026-74580) has been identified in the vhost module. With a CVSS v3.1 score of 8.8, this flaw allows for local privilege escalation to root and potential VM Escape in certain virtualization environments.

■ Affected Scope
- Linux Kernel versions 4.11 through 7.2-rc4

■ Mitigation Steps
1. Audit the kernel versions of all production servers and hypervisors.
2. Update affected systems to the latest patched kernel version and perform a reboot.
3. As a temporary measure, restrict access to vhost devices for non-privileged users.

■ Reference
- ThaiCERT Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Palo Alto Networks PAN-OS CVE-2026-0322

Dear Team,

We are sharing critical information regarding a vulnerability in PAN-OS.

■ Overview
An authenticated remote code execution (RCE) vulnerability (CVE-2026-0322, CVSS 8.6) has been identified in the PAN-OS management interface. This flaw allows an authenticated attacker to execute arbitrary code with root privileges and is currently being exploited in the wild.

■ Scope
- PA-Series firewalls
- VM-Series firewalls
- Panorama (virtual and M-Series)
*Cloud NGFW and Prisma Access are not affected.

■ Action Plan
1. Apply the latest security updates provided by Palo Alto Networks immediately.
2. Restrict access to the management interface to trusted internal IP addresses or a dedicated jump box to minimize risk.

■ Reference
- Palo Alto Networks Official Security Advisory

Priority: High
Deadline: Immediate