2026年6月25日の
セキュリティ情報

Subject: [Security Alert] Exploitation of CVE-2025-67038 in Lantronix EDS5000

Dear Team,

We are sharing critical information regarding a vulnerability in Lantronix device servers.

■ Overview
An unauthenticated arbitrary OS command injection vulnerability (CVE-2025-67038) has been identified in Lantronix EDS5000 servers. CISA has confirmed that this flaw is being exploited in the wild to gain root privileges.

■ Scope
- Affected Product: Lantronix EDS5000 serial-to-IP device servers

■ Action Plan
1. Identify if Lantronix EDS5000 devices are deployed within the environment.
2. Apply the latest security patches/firmware provided by the vendor immediately.
3. Ensure these devices are isolated from the public internet and restricted to trusted management networks.

■ Reference
- CISA / Forescout (BRIDGE:BREAK)

Priority: High
Deadline: Immediate

Subject: [Action Required] GitLab Security Updates for Multiple Vulnerabilities

Dear IT/Security Team,

GitLab has released security updates addressing 13 vulnerabilities in both Community Edition (CE) and Enterprise Edition (EE).

■ Overview
Several high-severity flaws have been identified, including CVE-2026-10086 and CVE-2026-10712 (XSS allowing arbitrary code execution) and CVE-2026-12053 (information disclosure via insufficient output filtering). These could allow attackers to execute malicious scripts or access sensitive project data.

■ Scope
- GitLab Community Edition (CE)
- GitLab Enterprise Edition (EE)

■ Mitigation Steps
1. Verify the current version of your GitLab installation.
2. Apply the latest security patches provided by GitLab immediately.

■ Reference
- GitLab Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Cisco Unified CM SSRF Vulnerability (CVE-2026-20230) Mitigation

Dear Team,

We are sharing critical information regarding a vulnerability in Cisco Unified CM.

■ Overview
An improper input validation flaw in the WebDialer component (CVE-2026-20230) allows unauthenticated attackers to perform SSRF attacks. By using file:// URIs, attackers can write arbitrary files to the underlying OS, leading to the deployment of webshells and full root-level compromise. The CVSS base score is 8.6 (Critical).

■ Affected Products
- Cisco Unified CM
- Cisco Unified CM Session Management Edition (SME)

■ Action Plan
1. Immediately apply the security patches released by Cisco on June 3.
2. Review logs for suspicious HTTP requests to the WebDialer component and inspect the OS for unauthorized file creation.

■ Reference
- Cisco Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Cisco Catalyst SD-WAN CVE-2026-20245 Mitigation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Cisco Catalyst SD-WAN.

■ Overview
A high-severity command injection vulnerability (CVE-2026-20245) has been identified in Cisco Catalyst SD-WAN Manager (vManage), Controller (vSmart), and Validator (vBond). This flaw allows authenticated attackers to execute arbitrary commands as root by uploading a crafted file. There are reports of this being exploited in the wild to create rogue root accounts and push unauthorized configurations to edge devices.

■ Affected Scope
- Cisco Catalyst SD-WAN Manager (vManage)
- Cisco Catalyst SD-WAN Controller (vSmart)
- Cisco Catalyst SD-WAN Validator (vBond)

■ Mitigation Steps
1. Verify the current software versions of your SD-WAN components.
2. Upgrade to the fixed software versions provided by Cisco as soon as possible.

■ Reference
- Cisco Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Intel] New Stealth Backdoor 'Mistic' by KongTuke

Dear Team,

We are sharing intelligence regarding a new stealth backdoor named 'Mistic' linked to the threat actor KongTuke (Woodgnat).

■ Overview
KongTuke, acting as an access broker, utilizes the Mistic backdoor to maintain persistent access for later sale to ransomware groups (e.g., Qilin, Black Basta). The infection chain involves DLL side-loading where a legitimate process (MpExtMs.exe) loads a malicious 'version.dll', which subsequently drops the 'EndpointDlp.dll' loader.

■ Scope
- Windows-based endpoints and servers
- Targeted sectors: Insurance, Education, IT, and Professional Services

■ Recommended Actions
1. Monitor for the creation or loading of suspicious DLLs named 'version.dll' or 'EndpointDlp.dll'.
2. Review EDR logs for anomalous behavior originating from legitimate Microsoft processes.
3. Audit privileged account activity and enhance network segmentation to prevent lateral movement.

■ Reference
- Symantec Security Research

Priority: Medium
Deadline: Ongoing