2026年7月2日の
セキュリティ情報

Subject: [Security Advisory] Critical Vulnerability in Argo CD Repo Server

Dear IT/Security Team,

We are sharing information regarding a critical RCE vulnerability discovered in the Argo CD Repo Server by Synacktiv.

■ Overview
An unauthenticated attacker can trigger remote code execution (RCE) by inducing the Repo Server to fetch a specially crafted Git repository. This could lead to full control of the server and potentially the entire Kubernetes cluster, especially if combined with CVE-2024-31989.

■ Scope
- Argo CD Repo Server

■ Mitigation Steps
1. Since no official patch is currently available, implement network isolation immediately.
2. Restrict network access to the Argo CD Repo Server to only essential components to minimize the attack surface.

■ Reference
- Synacktiv Research Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Adobe ColdFusion and Campaign Classic Vulnerability Patching

Dear IT/Security Team,

This is a notification regarding critical vulnerabilities identified in Adobe ColdFusion and Adobe Campaign Classic.

■ Overview
Adobe has released security updates to address critical flaws that could lead to system compromise if exploited.

■ Affected Scope
- Adobe ColdFusion 2025 – Update 9 and prior
- Adobe ColdFusion 2023 – Update 20 and prior
- Adobe Campaign Classic – version ACC v7: 7.4.3 build 9396 and prior

■ Action Plan
1. Verify the versions of the aforementioned products currently in use within the environment.
2. Apply the latest security updates as specified in the official advisories:
- ColdFusion: APSB26-68
- Campaign Classic: APSB26-69

■ Reference
- Adobe Security Advisories

Priority: High
Deadline: Immediate

Subject: [Intel] Umbrij Malware Abusing OAuth for Gmail Access

Hi team,

We are sharing information regarding a new campaign by the threat actor ToddyCat.

■ Overview
A new malware named 'Umbrij' utilizes a technique called 'Shadow Token via Remote Debug (STRD)'. It connects to the remote debugging port of Chromium-based browsers to acquire OAuth tokens, enabling unauthorized access to Gmail via the Google API.

■ Scope
- Environments using Chromium-based browsers and Google API/Gmail.

■ Mitigation Steps
1. Ensure that browser remote debugging ports (e.g., 9222) are disabled or restricted on endpoints.
2. Audit OAuth application permissions within the Google Workspace Admin Console for unauthorized third-party apps.
3. Monitor API logs for anomalous access patterns, specifically those originating from headless browser sessions.

■ Reference
- Kaspersky Report

Priority: Medium
Deadline: As soon as possible

Subject: [Urgent] Remediation for Kemp LoadMaster CVE-2026-8037

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Progress Kemp LoadMaster.

■ Overview
An OS command injection vulnerability (CVE-2026-8037) has been discovered in Kemp LoadMaster. This flaw allows unauthenticated remote attackers to execute arbitrary system commands. The CVSS score is 9.8, and active exploitation attempts have been observed in the wild.

■ Scope
- Affected Product: Progress Kemp LoadMaster
- Patched Versions: 7.2.63.2 (GA) / 7.2.54.18 (LTSF)

■ Action Required
1. Verify the current version of your Kemp LoadMaster deployment.
2. Immediately upgrade to the patched version (7.2.63.2 or 7.2.54.18).

■ Reference
- Progress Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Microsoft SharePoint Server CVE-2024-30044

Dear Team,

This is a notification regarding a critical vulnerability in Microsoft SharePoint Server.

■ Overview
CISA has added CVE-2024-30044 to the Known Exploited Vulnerabilities (KEV) catalog. This RCE vulnerability allows an attacker with a valid account to execute arbitrary code on the server.

■ Scope
- Microsoft SharePoint Server (On-premises)

■ Action Required
1. Identify all on-premises SharePoint Server instances in the environment.
2. Apply the latest security updates provided by Microsoft immediately.

■ Reference
- CISA KEV Catalog
- Microsoft Security Update Guide

Priority: High
Deadline: Immediate