2026年7月25日の
セキュリティ情報

Subject: [Security Advisory] Fastjson 1.x RCE Vulnerability (CVE-2026-16723)

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Alibaba's Fastjson 1.x library.

■ Overview
A critical remote code execution (RCE) vulnerability (CVE-2026-16723) has been discovered in Fastjson 1.x. It allows unauthenticated attackers to execute arbitrary code with the privileges of the Java process. The Alibaba-assigned CVSS score is 9.0.

■ Affected Scope
- Fastjson versions 1.2.68 through 1.2.83
- Spring Boot executable fat-JAR deployments
- Environments where SafeMode is disabled (default setting)

■ Mitigation Steps
1. Enable SafeMode by adding the JVM argument: `-Dfastjson.parser.safeMode=true`.
2. Alternatively, use the dependency `com.alibaba:fastjson:1.2.83_noneautotype`.
3. For a long-term fix, migrate to Fastjson2.

■ Reference
- Alibaba Official Advisory (Published July 21, 2026)

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Rockwell Arena Simulation Vulnerabilities (CVE-2026-8085 et al.)

Dear IT/Security Team,

We are sharing information regarding high-severity vulnerabilities identified in Rockwell Automation's Arena Simulation software.

■ Overview
Four memory corruption vulnerabilities (out-of-bounds write) stemming from improper validation of user-supplied data have been discovered. Successful exploitation could allow an attacker to execute arbitrary code in the context of the current process, provided a user opens a malicious file.

■ Scope
- Product: Arena Simulation
- Affected Versions: Up to and including 17.00.00

■ Remediation
1. Identify systems running Arena Simulation version 17.00.00 or earlier.
2. Update the software to version 17.00.01 to mitigate these risks.

■ Reference
- Official advisories from CISA and Rockwell Automation

Priority: High
Deadline: Immediate

Subject: [Urgent] Vulnerability in PTC Windchill / FlexPLM (CVE-2026-12569)

Dear IT/Security Team,

We are sharing critical information regarding an active exploitation campaign targeting PTC products.

■ Overview
Threat actors linked to Cl0p ransomware are exploiting a chain of vulnerabilities in PTC Windchill and FlexPLM to achieve unauthenticated Remote Code Execution (RCE). This involves CVE-2026-12569 (CVSS 9.3), allowing attackers to deploy JSP web shells and exfiltrate sensitive engineering and design data for double extortion.

■ Scope
- Affected Products: PTC Windchill, PTC FlexPLM
- Exposure: Internet-facing deployments

■ Mitigation Steps
1. Apply the latest security patches provided by PTC immediately.
2. Restrict direct internet access to these services; ensure they are behind a VPN or Zero Trust gateway.
3. Audit the /Windchill/login/ directory for unauthorized JSP web shells.

■ Reference
- Coordinated advisory by Ransom-ISAC, eCrime.ch, and DEFUSED

Priority: High
Deadline: Immediate