2026年7月8日の
セキュリティ情報

Subject: [Security Alert] Warning Against Installing Unknown Apps

Dear employees,

It has been reported that Android spyware is being distributed through social media platforms like Telegram via deceptive links.

To protect your device and company data, please follow these steps:
1. Do not click on suspicious links or install apps from unknown sources (SMS, email, or social media).
2. Only install applications from official sources, such as the Google Play Store.
3. If you suspect you have installed a malicious app, please contact the IT security team immediately.

Deadline: Immediate

Subject: [Security Advisory] Langflow CVE-2026-55255 Mitigation

Dear IT/Security Team,

We are sharing information regarding a critical vulnerability in Langflow.

■ Overview
An authorization bypass vulnerability (CVE-2026-55255) has been identified in the Langflow API endpoint. With a CVSS v3.1 score of 8.4, this flaw allows an authenticated attacker to access and utilize workflows of other users. Active exploitation in the wild has been detected.

■ Scope
- Product: Langflow
- Affected Versions: Versions prior to the security patch

■ Mitigation Steps
1. Verify the current version of Langflow deployed in your environment.
2. Update Langflow to the latest patched version provided by the vendor immediately.

■ Reference
- CVE-2026-55255

Priority: High
Deadline: Immediate

Subject: [Security Alert] Vulnerabilities in Dell PowerProtect Data Domain

Dear IT/Security Team,

We are sharing critical vulnerability information regarding Dell PowerProtect Data Domain.

■ Overview
Dell has identified 143 vulnerabilities in PowerProtect Data Domain and its third-party components. Specifically, CVE-2026-53481 and CVE-2026-53483 have been assigned a CVSS v3.1 score of 9.8 (Critical), as they could allow an unauthenticated remote attacker to gain full system control.

■ Scope
- Affected Product: Dell PowerProtect Data Domain

■ Action Required
1. Review Dell Security Advisory DSA-2026-278 to determine if your environment is affected.
2. Apply the latest security updates immediately.

■ Reference
- Dell DSA-2026-278: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Vulnerability 'GhostApproval' in AI Coding Assistants

Dear IT/Security Team,

We are sharing information regarding a systematic vulnerability pattern named 'GhostApproval' affecting several AI coding assistants.

■ Overview
This vulnerability allows an attacker to trick AI agents into accessing files outside their designated workspace sandbox, which could lead to Remote Code Execution (RCE) on the developer's local machine.

■ Affected Products
- Amazon Q Developer (Patched)
- Cursor (Patched)
- Google Antigravity (Patched)
- Anthropic Claude Code
- Augment (Unpatched)
- Windsurf (Unpatched)

■ Action Plan
1. Ensure all AI coding tools used within the organization are updated to the latest versions.
2. For tools that remain unpatched (e.g., Augment, Windsurf), advise developers to be cautious of unusual file access requests from the AI agent.

■ Reference
- Wiz Security Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Ubiquiti Product Vulnerabilities (25 CVEs)

Dear IT/Security Team,

This is a notification regarding multiple vulnerabilities identified in Ubiquiti products.

■ Overview
Ubiquiti has addressed 25 vulnerabilities, including 7 critical and 18 high-severity issues. These include Remote Code Execution (RCE), Privilege Escalation, and Authentication Bypass.

■ Scope
- Affected Ubiquiti products (Please refer to the "Affected Products" section of each CVE in the security bulletin).

■ Mitigation Steps
1. Identify all Ubiquiti devices and software versions currently in use within the environment.
2. Apply the latest security updates provided by the vendor immediately.

■ Reference
- Ubiquiti Official Security Bulletin

Priority: High
Deadline: Immediate