2026年4月15日の
セキュリティ情報

Subject: [Action Required] Security Update for Microsoft Excel and SharePoint

Hi everyone,

Our security team has been notified of vulnerabilities in Microsoft Excel and SharePoint Server that are currently being exploited.

How you can help:
1. Please apply any pending updates for Microsoft Office/Excel as soon as they are available on your device.
2. Be extremely cautious when opening Excel files from unknown senders or unexpected sources.

Please prioritize these updates to keep our environment secure.

件名: 【脆弱性対応】Microsoft SharePoint ServerおよびExcelの脆弱性悪用について

お疲れさまです。標記の件に関する情報共有です。

■ 概要
米CISAにより、Microsoft SharePoint ServerおよびExcelの脆弱性が「悪用が確認された脆弱性カタログ（KEV）」に追加されました。SharePoint Serverの脆弱性（CVE-2026-32201）はなりすましによるデータ改ざんや漏洩の恐れがあり、Excelの脆弱性（CVE-2009-0238）はリモートでシステム制御を奪取される可能性があります。

■ 影響範囲
- Microsoft SharePoint Server
- Microsoft Excel

■ 対応手順
1. Microsoftが提供する最新のセキュリティ更新プログラムを速やかに適用してください。
2. 特にSharePoint Serverを運用している場合は、CVE-2026-32201への対応状況を確認してください。
3. 古いバージョンのExcelを利用している端末がないか確認し、更新を促してください。

■ 参考情報
- CISA Known Exploited Vulnerabilities (KEV) Catalog
- Microsoft Security Update Guide

対応優先度: 高（速やかな対応を推奨）

Subject: [Security Advisory] Exploited Vulnerabilities in Microsoft SharePoint Server and Excel

Hi all,

This is a notification regarding critical vulnerabilities recently added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

■ Overview
Two vulnerabilities are being actively exploited. CVE-2026-32201 (SharePoint Server) allows for impersonation, potentially leading to data tampering or leakage. CVE-2009-0238 (Excel) can allow an attacker to gain full system control if a specially crafted file is opened.

■ Scope
- Microsoft SharePoint Server
- Microsoft Excel

■ Mitigation Steps
1. Promptly apply the latest security updates provided by Microsoft.
2. Verify the patch status of SharePoint Server instances specifically for CVE-2026-32201.
3. Ensure all client endpoints are running updated versions of Microsoft Excel.

■ Reference
- CISA KEV Catalog
- Microsoft Security Update Guide

Priority: High (Prompt action recommended)

Subject: [Security Advisory] Architectural Flaw in Model Context Protocol (MCP)

Hi all,

This is a security notification regarding a critical architectural flaw identified in the Model Context Protocol (MCP).

■ Overview
An architectural flaw in the STDIO interface of Anthropic's MCP code allows for potential remote code execution. Due to a lack of input sanitization, malicious commands can be executed regardless of whether the process starts successfully, potentially leading to a complete adversarial takeover of the host system.

■ Scope
- Local STDIO MCP servers inheriting Anthropic's MCP implementation.
- Environments utilizing agentic AI frameworks that rely on MCP for data connectivity.

■ Recommended Actions
1. Check for and apply updates to all deployed MCP servers promptly.
2. Audit and restrict the use of third-party MCP servers from untrusted sources.
3. Implement the principle of least privilege (PoLP) for the environment where MCP servers are executed to mitigate the impact of a potential breach.

■ Reference
- OX Security Report / securityweek

Priority: High (Prompt action is recommended)

Subject: [Security Advisory] Rapid Vulnerability Discovery via AI (Bug Armageddon)

Hi all,

This is a security alert regarding the acceleration of vulnerability discovery driven by advanced AI models.

■ Overview
AI models such as Anthropic's "Mythos" are identifying software vulnerabilities at an unprecedented scale and speed. This trend, referred to as "Bug Armageddon," significantly increases the risk that long-dormant flaws in legacy systems and open-source projects will be discovered and exploited by threat actors before patches can be applied.

■ Scope of Impact
- Legacy systems (e.g., older versions of OpenBSD and similar OS)
- Open-source software (OSS) libraries with limited maintenance resources
- Internal infrastructure and applications relying on the aforementioned components

■ Recommended Actions
1. Review the dependency tree of your current middleware and OSS libraries; plan and execute updates to the latest stable versions promptly.
2. For legacy systems where patches are unavailable, prioritize implementing mitigating controls such as network segmentation or WAF rules.
3. Increase the frequency of vulnerability scanning for external-facing assets to counter AI-driven reconnaissance.

■ Reference
- freebuf: “漏洞末日”警钟预警：AI批量发现黑客可利用的漏洞

Priority: High (Prompt review and action are recommended due to the increased risk of AI-accelerated exploitation).

Subject: [Security Notice] Beware of Malicious Android Apps via Social Media Ads

Hi everyone,

We would like to alert you to a new Android malware called "Mirax" that is spreading through Meta (Facebook/Instagram) advertisements. This malware allows attackers to remotely control infected devices.

How you can help:
1. Avoid installing apps from suspicious advertisements on social media.
2. Ensure Google Play Protect is enabled and keep your OS and apps updated to the latest versions.
3. Promptly remove any unfamiliar apps or those requesting excessive permissions.

Please take these precautions as soon as practical to keep your devices secure.

件名: 【共有】Android向けRAT「Mirax」の感染拡大について

お疲れさまです。Android向け新型RAT「Mirax」に関する情報共有です。

■ 概要
Meta社の広告プラットフォームを配信経路とするAndroid向けリモートアクセスツール（RAT）およびバンキングマルウェアです。感染したデバイスを完全なリモートコントロール下に置くだけでなく、SOCKS5プロキシとして動作させ、攻撃者のトラフィックを中継させる機能を持っています。MaaSとして流通しており、既に22万人以上の感染が確認されています。

■ 影響範囲
- Android OS搭載端末（特にスペイン語圏を標的としたキャンペーンが確認されていますが、広域に拡散する可能性があります）

■ 対応手順
1. 社内端末において、不審な広告経由でサイドロードされたAPKが存在しないか確認を推奨します。
2. MDM（モバイルデバイス管理）を利用している場合は、未承認アプリのインストール制限を再確認してください。
3. ユーザーに対し、公式ストア以外からのアプリインストール禁止を改めて周知してください。

■ 参考情報
- secaffairs (Mirax malware campaign hits 220K accounts)

対応優先度: 高（速やかな注意喚起と確認を推奨）

Subject: [Security Advisory] Spread of Android RAT "Mirax"

Hi,

This is a security update regarding a newly identified Android Remote Access Trojan (RAT) known as "Mirax."

■ Overview
Mirax is an Android RAT and banking malware distributed via Meta advertisements. It enables full remote control of the infected device and transforms the device into a SOCKS5 proxy node to route malicious traffic. It is sold as Malware-as-a-Service (MaaS) and has already infected over 220,000 accounts.

■ Scope
- Android OS devices (primarily targeting Spanish-speaking regions, but potential for wider spread).

■ Recommended Actions
1. Audit corporate mobile devices for any unauthorized APKs installed via suspicious ads.
2. Review and enforce app installation restrictions via MDM (Mobile Device Management) policies.
3. Reiterate the policy against sideloading apps from unofficial sources to all employees.

■ Reference
- secaffairs (Mirax malware campaign hits 220K accounts)

Priority: High (Prompt action and user awareness are recommended)

Subject: [Action Required] Critical RCE Vulnerability in Apache ActiveMQ Classic (CVE-2026-34197)

Hi all,

This is a security advisory regarding a critical vulnerability discovered in Apache ActiveMQ Classic.

■ Overview
A Remote Code Execution (RCE) vulnerability has been identified in Apache ActiveMQ Classic, tracked as CVE-2026-34197 with a CVSS score of 8.8. This flaw, which remained undetected for 13 years, could allow an attacker to execute arbitrary code remotely.

■ Affected Versions
- Apache ActiveMQ/Broker: Versions prior to 5.19.4
- Apache ActiveMQ/Broker: Versions 6.0.0 through 6.2.3

■ Mitigation Steps
1. Audit your environment to identify any instances of Apache ActiveMQ Classic.
2. If an affected version is in use, please prioritize updating to the latest patched version promptly.

■ Reference
- CVE-2026-34197
- Apache ActiveMQ Official Security Advisories

Priority: High (Prompt update is strongly recommended)