2026年8月24日の
セキュリティ情報

Subject: [Security Alert] Phishing Emails Spoofing Government Domains (gov.tw)

Dear employees,
It has been reported that attackers are abusing government website features to send phishing emails using the trusted gov.tw domain. These emails often claim there are outstanding payments or fines to trick users into clicking malicious links.

Requested Actions:
1. Be cautious of emails from government domains that contain unexpected requests for payment or suspicious links.
2. Do not enter personal information or passwords on websites linked from such emails.
3. Report any suspicious emails to the IT security team immediately.

Deadline: Immediate

Subject: [Security Advisory] Rapid7 Velociraptor CVE-2026-19200

Dear IT/Security Team,

We are sharing information regarding a vulnerability found in Rapid7 Velociraptor.

■ Overview
CVE-2026-19200 is a high-severity vulnerability in Velociraptor that could allow an attacker to perform unauthorized modification of data or code (Tampering).

■ Scope
- Product: Rapid7 Velociraptor
- Affected Versions: Prior to 0.77.2

■ Mitigation Steps
1. Verify the current version of Velociraptor in your environment.
2. Update to version 0.77.2 or later immediately if you are running an affected version.

■ Reference
- Vendor Advisory: https://www.rapid7.com/db/vulnerabilities/cve-2026-19200/

Priority: High
Deadline: Immediate

Subject: [Security Advisory] TP-Link TL-MR6400 V7 Vulnerability Remediation

Dear IT Team,

This is a notification regarding high-severity vulnerabilities identified in TP-Link products.

■ Overview
Three high-severity vulnerabilities have been discovered in the TL-MR6400 V7, which could lead to arbitrary code execution and Denial of Service (DoS).

■ Scope
- Affected Product: TL-MR6400 V7
- Affected Versions: All versions prior to 1.9.0 build 260714

■ Remediation Steps
1. Verify the current firmware version of any deployed TL-MR6400 V7 devices.
2. Update the firmware to version 1.9.0 build 260714 or later.

■ Reference
- https://www.tp-link.com/us/support/faq/5259/

Priority: High
Deadline: Immediate

Subject: [Security Alert] Password Leak on External Website

Dear employees,

It has been reported that personal information, including passwords, may have been leaked from the civil engineering information site 'Isabou Net'.

Requested Actions:
1. If you have an account on this site, please change your password immediately.
2. If you use the same password for other services, we strongly recommend changing those passwords as well to prevent secondary attacks.

Deadline: End of today

Subject: [Action Required] Oracle Critical Security Patch Update - August 2026

Dear IT Administration Team,

This is a notification regarding the Oracle Critical Security Patch Update (CSPU) for August 2026.

■ Overview
Oracle has released security patches addressing 943 vulnerabilities, including those within third-party components. Oracle has noted that some attacks have been successful because target systems had not applied available patches. Immediate action is recommended to mitigate these risks.

■ Scope
- Various Oracle products and versions (Refer to Oracle's Risk Matrices for specific details).

■ Action Plan
1. Identify all Oracle products and versions currently in use within the organization.
2. Review the August 2026 CSPU advisory to determine applicable patches.
3. Test and deploy the security patches to production environments as soon as possible.

■ Reference
- Oracle Critical Security Patch Update (CSPU) Official Advisory

Priority: High
Deadline: Immediate