2026年9月14日の
セキュリティ情報

Subject: [Security Advisory] Microsoft Azure Multiple Vulnerabilities (CVE-2026-62895 et al.)

Dear IT Administration Team,

This is a notification regarding multiple vulnerabilities identified in several Microsoft Azure components.

■ Overview
Several vulnerabilities have been found in Azure Arc SQL Server Extension, CycleCloud, HDInsight, and Azure CLI. These flaws could potentially allow remote code execution (RCE), privilege escalation, and unauthorized access to confidential data.

■ Affected Scope
- Azure Arc SQL Server Extension (versions prior to 1.1.3518.465)
- Azure CycleCloud (versions prior to 8.9.2)
- Azure HDInsight (versions prior to 2606012120)
- Microsoft Azure CLI (specific versions)

■ Remediation Steps
1. Verify the current versions of the Azure components in your environment.
2. Update the affected components to the latest patched versions immediately.

■ Reference
- Microsoft Azure Security Bulletins
- CERT-FR (CERTFR-2026-AVI-1148)

Priority: High
Deadline: Immediate

Subject: [Info] Vulnerability Exploitation in Flowise and Gogs

Dear Admin,

We are sharing information regarding attack vectors targeting the Flowise AI platform and Gogs.

■ Overview
An exploit chain has been demonstrated where an attacker achieves Remote Code Execution (RCE) by leveraging Flowise's ability to execute user-provided configurations as JavaScript. Subsequently, local privilege escalation (LPE) is achieved via a symbolic link attack within Gogs.

■ Scope
- Flowise (versions allowing JS execution in configurations)
- Gogs (configurations susceptible to symlink attacks)

■ Mitigation Steps
1. Update Flowise to the latest version and restrict configuration changes to trusted users.
2. Review Gogs permissions and filesystem restrictions regarding symbolic links.
3. Ensure services are running under low-privileged service accounts rather than root.

■ Reference
- Hack The Box Silentium Walkthrough (xakep)

Priority: Medium
Deadline: Next maintenance window

Subject: [Security Advisory] ESET AV Remover CVE-2026-12858 Mitigation

Dear IT Administration Team,

We are sharing information regarding a vulnerability identified in ESET products.

■ Overview
A privilege escalation vulnerability (CVE-2026-12858) has been discovered in ESET AV Remover. An attacker could exploit this flaw to gain elevated privileges on the system.

■ Scope
- Product: ESET AV Remover
- Affected Versions: Prior to 1.6.17.0

■ Mitigation Steps
1. Verify the version of AV Remover currently deployed in your environment.
2. Update to version 1.6.17.0 or later immediately if an older version is in use.

■ Reference
- ESET Security Bulletin: https://support-feed.eset.com/link/15370/17443273/ca9000
- CVE-2026-12858: https://www.cve.org/CVERecord?id=CVE-2026-12858

Priority: Medium
Deadline: Immediate

Subject: [Security Alert] Please update the YAMAP app (Android users)

Hi everyone,

A security vulnerability has been found in the Android version of the YAMAP hiking app that could potentially lead to information leakage.

Requested Action:
1. If you use the YAMAP app on an Android device, please check the app store immediately.
2. Update the app to the latest version as soon as possible.

Deadline: End of today