2026年8月15日の
セキュリティ情報

Subject: [Urgent] Remote Code Execution Vulnerability in NetScaler ADC/Gateway (CVE-2026-8452)

Dear Team,

We are sharing critical information regarding a vulnerability in Citrix NetScaler products.

■ Overview
An unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-8452) has been identified in NetScaler ADC and NetScaler Gateway. This heap-based buffer overflow can be exploited when the device is configured as a SAML SP or IdP. A PoC for deploying a webshell is already available, significantly increasing the risk of exploitation.

■ Affected Versions
- NetScaler ADC and NetScaler Gateway versions prior to 14.1-72.61
- NetScaler ADC and NetScaler Gateway versions prior to 13.1-63.18

■ Action Required
1. Verify the current version of NetScaler deployed in our environment.
2. If an affected version is in use, apply the latest security updates immediately.

■ Reference
- Cloud Software Group Security Bulletin: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
- watchTowr Labs Analysis: https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/

Priority: High
Deadline: Immediate

Subject: [Urgent] Please update your macOS immediately

Hi everyone,

A critical security flaw has been discovered in the macOS "Screen Sharing" feature, which attackers are using to install unauthorized software (cryptocurrency miners) on affected devices.

Action required:
1. Please check for software updates in "System Settings" and update your macOS to the latest version immediately.
2. If you notice any unusual system behavior or extreme slowdowns, please report it to the IT department right away.

Deadline: End of today

件名: 【共有】macOS Screen Sharing 脆弱性 (CVE-2026-65400) 対応について

お疲れさまです。macOSの画面共有機能における認証回避の脆弱性に関する情報共有です。

■ 概要
macOSの画面共有機能において、有効な資格情報なしで認証を回避し、ルート権限を取得できる脆弱性が確認されました（CVE-2026-65400, CVSS 9.8）。現在、ポート5900を公開している環境を標的にMoneroマイナーを配備する攻撃が観測されています。

■ 影響範囲
- macOS Tahoe, Sequoia, Sonoma の未修正バージョン
- 特にポート5900 (VNC/Screen Sharing) を外部に公開している端末

■ 対応手順
1. 以下の修正済みバージョンへのアップデートを強制適用してください：
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
2. ネットワーク境界において、不要なポート5900の外部公開を遮断してください。

■ 参考情報
- Apple Security Updates

対応優先度: 高
対応期限: 至急

Subject: [Technical Alert] macOS Screen Sharing Vulnerability (CVE-2026-65400)

Hi team,

This is a technical alert regarding a critical authentication bypass vulnerability in macOS Screen Sharing.

■ Overview
CVE-2026-65400 (CVSS 9.8) allows an attacker on the network to authenticate to Screen Sharing without valid credentials, potentially gaining root access. Active exploitation has been observed, specifically targeting systems with port 5900 exposed to deploy Monero miners.

■ Scope
- Unpatched versions of macOS Tahoe, Sequoia, and Sonoma.
- Systems with port 5900 (VNC/Screen Sharing) exposed to the internet/network.

■ Mitigation Steps
1. Ensure all macOS endpoints are updated to the following versions:
- macOS Tahoe 26.6.1
- macOS Sequoia 15.7.9
- macOS Sonoma 14.8.9
2. Audit firewall rules to block unauthorized access to port 5900.

■ Reference
- Apple Security Updates

Priority: High
Deadline: Immediate

Subject: [Urgent] SAP Commerce Cloud CVE-2026-58231 Remediation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in SAP Commerce Cloud.

■ Overview
CVE-2026-58231 is a critical vulnerability (CVSS 10.0) allowing unauthenticated Remote Code Execution (RCE). Active exploitation has been detected in the wild within three days of the patch release.

■ Scope
- Affected Product: SAP Commerce Cloud

■ Remediation Steps
1. Update to the latest patched version of SAP Commerce Cloud immediately.
2. Perform a full system rebuild and redeployment after the update.
3. If immediate patching is not possible, implement IP filtering to restrict access to the vulnerable endpoints.

■ Reference
- SAP Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Mitigation for GeoServer Zero-Day SQL Injection Vulnerability

Dear IT/Security Team,

We are sharing critical information regarding a zero-day vulnerability in GeoServer.

■ Overview
A vulnerability in the 'jsonArrayContains' function of GeoServer allows unauthenticated attackers to perform SQL injection. Active scanning has been observed in the wild, and depending on the server/DB configuration, this may lead to Remote Code Execution (RCE).

■ Scope
- Affected Product: GeoServer (All versions; no official patch available yet)

■ Mitigation Steps
1. Identify all GeoServer instances exposed to the public internet.
2. Restrict direct access using VPNs, IP whitelisting, or reverse proxies.
3. Enforce the principle of least privilege for database accounts used by GeoServer to limit potential impact.
4. Monitor server logs for abnormal SQL errors or suspicious request patterns.

■ Reference
- Discovered by: q1uf3ng
- Observed by: watchTowr

Priority: High
Deadline: Immediate action required.