2026年4月18日の
セキュリティ情報

Subject: [Urgent] Vulnerability Remediation for Axios and SharePoint Server

Dear Team,

This is a technical alert regarding critical vulnerabilities currently being exploited.

■ Overview
1. Axios (CVE-2026-40175): A high-severity vulnerability allowing prototype pollution and request smuggling, potentially leading to AWS credential theft and Remote Code Execution (RCE).
2. SharePoint Server (CVE-2026-32201): A 0-day spoofing vulnerability (CVSS 6.5) is being exploited in the wild, allowing unauthenticated remote attacks.

■ Scope
- Axios: All versions prior to 1.15.0
- SharePoint Server: Multiple versions (especially on-premises instances)

■ Remediation Steps
1. Update Axios to version 1.15.0 or later and audit all project dependencies.
2. Apply the latest security patches for SharePoint Server and investigate logs for anomalous activity.

■ Reference
- Official vendor advisories and CVE databases

Priority: High
Deadline: Immediate

Subject: [Security Alert] RCE Vulnerability in Microsoft Windows Admin Center

Dear IT Security Team,

We are sharing critical information regarding a Remote Code Execution (RCE) vulnerability in Microsoft Windows Admin Center (WAC).

■ Overview
An unauthenticated one-click RCE vulnerability has been identified. The attack chain utilizes reflected XSS, insecure redirection, and credential storage flaws to allow attackers to execute arbitrary PowerShell commands or steal Azure access tokens via a malicious URL.

■ Scope
- Windows Admin Center (On-premises deployments)
*Azure-managed instances have been automatically patched by Microsoft.

■ Mitigation Steps
1. Identify all active Windows Admin Center deployments within the environment.
2. For on-premises installations, immediately upgrade to the latest patched version provided by Microsoft.
3. Review audit logs for any unauthorized command execution or suspicious administrative activity.

■ Reference
- Cymulate Research Lab Technical Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Remote Code Execution (RCE) Vulnerability in protobuf.js

Hi all,

This is a security notification regarding a critical vulnerability identified in the protobuf.js library.

■ Overview
A critical remote code execution (RCE) flaw has been discovered in protobuf.js, a widely used JavaScript implementation of Google's Protocol Buffers. The vulnerability stems from unsafe dynamic code generation where the library fails to validate schema-derived identifiers, allowing an attacker to inject malicious code via the Function() constructor. A proof-of-concept (PoC) exploit has already been published.

■ Scope
- Applications utilizing protobuf.js within Node.js or JavaScript environments.
- Systems that process protobuf schemas from untrusted sources.

■ Recommended Actions
1. Audit your project dependencies to identify the use of protobuf.js.
2. Update the library to the latest patched version as soon as practical.
3. Implement strict validation or restrictions to prevent the processing of protobuf schemas from untrusted sources.

■ Reference
- GitHub Advisory: GHSA-xq3m-2v4x-88gg

Priority: High (Prompt action is recommended)

Subject: [Security Advisory] Mirai Variant Nexcorium Exploiting CVE-2024-3721 in TBK DVRs

Hi all,

This is a security notification regarding a vulnerability affecting TBK DVR devices.

■ Overview
A command injection vulnerability (CVE-2024-3721, CVSS 6.3) in TBK DVRs is being actively exploited by threat actors to deploy a Mirai botnet variant known as "Nexcorium." These compromised devices are then used to launch large-scale DDoS attacks.

■ Affected Scope
- TBK DVR-4104
- TBK DVR-4216
- End-of-Life (EoL) TP-Link Wi-Fi routers

■ Recommended Actions
1. Update the firmware of the affected devices to the latest available version.
2. Replace any End-of-Life (EoL) hardware that no longer receives security patches.
3. Ensure that management ports are not exposed to the public internet and are properly firewalled.

■ Reference
- CVE-2024-3721
- Reports from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42

Priority: High (Prompt action is recommended)

Subject: [Security Advisory] Stealthy Malware Deployment via QEMU and Virtualization Platforms

Dear IT Administration Team,

We are sharing information regarding a technique where attackers leverage virtualization platforms to hide malicious activity.

■ Overview
Threat actors are increasingly abusing QEMU, an open-source emulator, to run malware within virtual machines (VMs). By isolating the malicious activity inside a VM, attackers can bypass host-based endpoint security controls and leave minimal forensic traces on the host system. This method is used for credential theft, data exfiltration, and the eventual deployment of ransomware such as PayoutsKing.

■ Scope
- Environments utilizing QEMU, Hyper-V, VMware, or similar virtualization platforms.

■ Recommended Actions
1. Monitor for the unauthorized execution of virtualization software and the creation of undocumented VMs.
2. Enhance EDR/XDR detection rules to identify anomalous process spawning on host systems and unusual resource consumption.
3. Audit network traffic for suspicious tunnels or covert communications originating from virtualized environments to C2 infrastructure.

■ Reference
- Sophos Research / secaffairs

Priority: High (Prompt review of monitoring capabilities is recommended)