2026年6月16日の
セキュリティ情報

Subject: [Security Advisory] Cisco Catalyst and LiteSpeed cPanel Vulnerabilities added to CISA KEV

Dear Team,

Please be advised that CISA has added the following vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

■ Overview
- CVE-2026-20262 (CVSS 6.5): Arbitrary file write vulnerability in Cisco Catalyst SD-WAN Manager.
- CVE-2026-54420 (CVSS 8.5): Symbolic link following vulnerability in LiteSpeed cPanel Plugin.

■ Scope
- Cisco Catalyst SD-WAN Manager
- LiteSpeed cPanel Plugin

■ Action Plan
1. Identify if the affected products are deployed within our infrastructure.
2. Apply the latest security updates provided by the respective vendors immediately.

■ Reference
- CISA KEV Catalog

Priority: High
Deadline: Immediate

Subject: [Security Advisory] LiteSpeed cPanel Plugin CVE-2026-54420

Dear IT Administration Team,

We are sharing critical information regarding a vulnerability in the LiteSpeed cPanel Plugin.

■ Overview
A privilege escalation vulnerability (CVE-2026-54420, CVSS 8.5) has been identified in the LiteSpeed cPanel Plugin. This flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

■ Scope
- Affected Product: LiteSpeed cPanel Plugin (versions prior to 2.4.8)
- Environment: Shared hosting servers running CloudLinux or CageFS
- Impact: Users with FTP or web shell access can escalate privileges to root.

■ Remediation
1. Update LiteSpeed cPanel plugin to version 2.4.8 or later.
2. If using LiteSpeed WHM PlugIn, update to version 5.3.2.0 or later.

■ Reference
- CISA KEV Catalog
- CVE.org (CVE-2026-54420)

Priority: High
Deadline: June 18, 2026

Subject: [Intel] C2 Traffic Obfuscation via Microsoft Teams

Dear Team,

We are sharing intelligence regarding a new technique used by the DragonForce ransomware group to hide command-and-control (C2) traffic.

■ Overview
Attackers are deploying a custom Go-based backdoor called "Backdoor.Turn" that routes C2 communications through legitimate Microsoft Teams services. This allows malicious activity to blend in with routine corporate collaboration traffic, effectively bypassing traditional network monitoring.

■ Scope
- Environments utilizing Microsoft Teams
- Systems where unauthorized Go-based binaries may have been executed

■ Recommended Actions
1. Enhance network traffic analysis to identify anomalies in Teams communication patterns or data volumes.
2. Utilize EDR/XDR tools to monitor for suspicious Go-based processes and unusual network connections initiated by legitimate services.
3. Implement strict application whitelisting to prevent the execution of unauthorized binaries.

■ Reference
- Symantec Security Research

Priority: Medium
Deadline: Ongoing Monitoring

Subject: [Urgent] Jenkins Remote Code Execution Vulnerability (CVE-2026-53435)

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Jenkins.

■ Overview
A critical deserialization flaw in the processing of config.xml files allows remote attackers to execute arbitrary code (RCE). This vulnerability has a CVSS score of 8.8 and is currently being exploited in the wild via automated scanning.

■ Scope
- Product: Jenkins
- Affected Versions: All versions prior to 2.567 and LTS 2.555.2

■ Remediation Steps
1. Identify all Jenkins instances within the environment and check their current versions.
2. Immediately upgrade to the following patched versions:
- Jenkins 2.568
- Jenkins LTS 2.555.3
3. Review network access controls to ensure Jenkins instances are not unnecessarily exposed to the public internet.

■ Reference
- Jenkins Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Intel] Deployment of SprySOCKS Windows Malware by Earth Lusca

Dear Team,

We are sharing threat intelligence regarding the Windows version of the SprySOCKS malware, attributed to the Chinese APT group Earth Lusca (also known as FishMonger or Aquatic Panda).

■ Overview
ESET researchers have identified Windows variants of SprySOCKS used to target government entities. The 'WIN_DRV' variant is particularly dangerous as it employs kernel drivers for rootkit-like stealth capabilities, allowing it to hide artifacts and redirect traffic from arbitrary TCP ports to the backdoor.

■ Scope
- Windows OS environments
- Primary targets: Government organizations (Foreign Affairs, Tech, Telecommunications)

■ Recommended Actions
1. Monitor for the loading of unsigned or suspicious kernel drivers via EDR.
2. Analyze network traffic for anomalies involving redirection from arbitrary TCP ports.
3. Ensure all systems are patched and monitor for unauthorized privilege escalation.

■ Reference
- ESET Research Report

Priority: Medium
Deadline: Ongoing monitoring