2026年9月19日の
セキュリティ情報

Subject: [Security Advisory] TanStack npm Supply Chain Attack (CVE-2026-45321)

Dear IT/Security Team,

We are sharing information regarding a supply chain attack targeting TanStack npm packages.

■ Overview
Malicious versions of TanStack npm packages were published, allowing attackers to steal credentials (including GitHub tokens) from developers' machines (CVE-2026-45321). This vulnerability was recently exploited in an attack against CrowdSec, resulting in the theft of 170 private GitHub repositories via a former employee's account.

■ Scope
- Development environments utilizing affected versions of TanStack npm packages.

■ Action Plan
1. Audit all development environments for affected TanStack packages and update to the latest secure versions.
2. Rotate and revoke any GitHub tokens or secrets that may have been exposed on compromised machines.
3. Review identity and access management (IAM) processes to ensure that access for former employees is revoked immediately upon departure.

■ Reference
- CVE-2026-45321

Priority: High
Deadline: Immediate

Subject: [Urgent] Check Point Security Management Server CVE-2026-91843 Mitigation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Check Point management products.

■ Overview
A critical RCE vulnerability (CVE-2026-91843) has been identified in Check Point Security Management and Log Servers. With a CVSS score of 9.8, this flaw allows an unauthenticated attacker to execute arbitrary code with root privileges via a stack-based buffer overflow during the login process.

■ Affected Scope
- Security Management Server
- Multi-Domain Security Management Server
- Log Server
- Multi-Domain Log Server
- Standalone configurations
*Note: Smart-1 Cloud environments are already patched.

■ Action Plan
1. Identify the current version of your management and log servers.
2. Apply the latest security updates provided by Check Point immediately.
3. Review and tighten access control lists (ACLs) to restrict access to the management interface.

■ Reference
- Check Point Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Linux Kernel Vulnerabilities Added to CISA KEV

Dear Team,

Please be advised that CISA has added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog.

■ Overview
The following vulnerabilities are confirmed to be exploited in the wild:
- CVE-2025-39682: Improper handling of zero-length TLS records in kTLS.
- CVE-2026-53266: Out-of-bounds write in ebtables during ARP packet processing.
- CVE-2025-39964: Race condition in AF_ALG interface.

■ Scope
- Affected Product: Linux Kernel
- Affected Components: kTLS, ebtables, AF_ALG

■ Action Plan
1. Identify all Linux-based systems and network appliances in the environment.
2. Apply the latest kernel security patches provided by the distribution vendor.
3. Conduct a forensic review to ensure no signs of compromise exist on critical systems.

■ Reference
- CISA Known Exploited Vulnerabilities Catalog

Priority: High
Deadline: Immediate

Subject: [Security Advisory] SolarWinds Access Rights Manager (CVE-2026-28326) Patch

Dear IT/Security Team,

We are sharing information regarding a high-severity vulnerability in SolarWinds Access Rights Manager (ARM).

■ Overview
A vulnerability (CVE-2026-28326) has been identified in SolarWinds ARM that allows unauthenticated remote code execution (RCE) due to a hard-coded static key. The CVSS score is 8.8.

■ Scope
- Product: SolarWinds Access Rights Manager (ARM)
- Affected Versions: All versions 2026.2 and prior

■ Remediation
1. Verify the current version of ARM in your environment.
2. Update to the patched version: ARM 2026.2.1.

■ Reference
- SolarWinds Official Advisory (Released Sept 17, 2026)

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Linux Kernel Vulnerabilities (CVE-2025-39964, CVE-2026-53266)

Hi all,

This is a notification regarding the addition of two Linux Kernel vulnerabilities to the CISA KEV catalog.

■ Overview
Two vulnerabilities (CVE-2025-39964 and CVE-2026-53266) involving a race condition and out-of-bounds write have been identified as actively exploited in the wild. These could allow an attacker to gain full control of the affected asset.

■ Scope
- Product: Linux Kernel
- CVEs: CVE-2025-39964, CVE-2026-53266

■ Remediation Steps
1. Identify all systems running affected Linux Kernel versions.
2. Apply the latest security patches provided by your distribution vendor.
3. Prioritize publicly exposed assets to mitigate the risk of external exploitation.

■ Reference
- CISA Known Exploited Vulnerabilities (KEV) Catalog

Priority: High
Deadline: Immediate