2026年7月31日の
セキュリティ情報

Subject: [Security Alert] Caution Regarding Suspicious Email Attachments

Dear employees,

We have received reports of sophisticated phishing attacks targeting professional services firms.

Requested Actions:
1. Do not open attachments (especially password-protected archives or shortcut files) from unknown or unexpected senders.
2. If you have accidentally opened a suspicious file, please disconnect your device from the network immediately and notify the IT security team.

Deadline: Immediate

Subject: [Security Advisory] Koollab LMS Vulnerabilities (CVE-2026-63227 et al.)

Dear IT Administration Team,

We are sharing critical vulnerability information regarding the Koollab Learning Management System (LMS).

■ Overview
Sixteen vulnerabilities have been identified in Koollab LMS, including a critical RCE (CVE-2026-63227, CVSS 9.9) and Blind SQL Injection (CVE-2026-63229, CVSS 9.1). These flaws could allow an attacker to execute arbitrary code on the server or exfiltrate sensitive database information.

■ Scope
- Affected Product: Koollab Learning Management System (LMS)

■ Mitigation Steps
1. Verify the current version of your Koollab LMS installation.
2. Apply the latest security patches or update to the most recent version provided by the vendor.
3. Review server logs for any signs of unauthorized PHP file uploads or anomalous SQL query patterns.

■ Reference
- ThaiCERT / CSA Singapore Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Action Required: Cisco Secure Firewall Management Center CVE-2026-20316

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Cisco Secure Firewall Management Center (FMC).

■ Overview
A vulnerability (CVE-2026-20316) involving static credentials has been identified in FMC. This flaw is being actively exploited in the wild (Zero-Day), allowing attackers to gain unauthorized access to the system.

■ Scope
- Cisco Secure Firewall Management Center (FMC)

■ Mitigation Steps
1. Immediately update the FMC software to the latest patched version provided by Cisco.
2. Review administrator access logs and account activities for any signs of unauthorized access or anomalies.
3. Restrict access to the management interface to trusted networks only.

■ Reference
- Cisco Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] SolarWinds Web Help Desk Vulnerabilities (CVE-2026-28323 et al.)

Dear IT/Security Team,

This is a notification regarding critical vulnerabilities discovered in SolarWinds Web Help Desk (WHD).

■ Overview
A critical vulnerability (CVE-2026-28323, CVSS 9.8) allows for SAML 2.0 authentication bypass. Additionally, a high-severity DoS vulnerability (CVE-2026-28299, CVSS 8.2) and several RCE vulnerabilities in the bundled pgAdmin 4 have been identified.

■ Scope
- Product: SolarWinds Web Help Desk (WHD)
- Impact: Authentication bypass, Remote Code Execution (RCE), Denial of Service (DoS)

■ Remediation
1. Apply the security update version 2026.2.1 immediately.
2. Verify the stability of SAML authentication and administrative functions post-update.

■ Reference
- SolarWinds Official Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Exploitation of NetScaler and Marimo Vulnerabilities

Dear IT/Security Team,

We are sharing information regarding autonomous attacks leveraging DeepSeek AI and manual exploitations of specific vulnerabilities.

■ Overview
A Chinese-speaking threat actor is utilizing the DeepSeek AI model via the Hermes Agent framework for autonomous reconnaissance and exploitation. Additionally, manual attacks targeting NetScaler (CVE-2026-3055) and Marimo (CVE-2026-39987) have resulted in data exfiltration and command execution.

■ Scope
- NetScaler (CVE-2026-3055)
- Marimo (CVE-2026-39987)

■ Action Plan
1. Apply the latest security patches for NetScaler and Marimo immediately.
2. Review the deployment of AI agent frameworks (e.g., Hermes Agent) and ensure they are not exposed to the public internet without strict controls.
3. Monitor logs for exploitation attempts related to the mentioned CVEs.

■ Reference
- Palo Alto Networks Unit 42 Report

Priority: High
Deadline: Immediate