2026年9月22日の
セキュリティ情報

Subject: [Urgent] Check Point Management Server CVE-2026-93616 Remediation

Dear Team,

This is a technical alert regarding a critical vulnerability in Check Point products.

■ Overview
A remote code execution (RCE) vulnerability (CVE-2026-93616) has been identified in Check Point Management Server and related components. It has a CVSS v3.1 score of 9.8 and is currently being exploited in the wild. Unauthenticated remote attackers can execute arbitrary code via specially crafted requests.

■ Affected Scope
- Check Point Security Management Server
- Multi-Domain Security Management Server
- Log Server
- Multi-Domain Log Server
- SmartEvent
- Versions: R82.20 (prior to Hotfix Take 1), R82.10, and earlier versions.

■ Remediation Steps
1. Verify the current version of your Check Point management and log servers.
2. Apply the latest Hotfix (Hotfix Take 1 or newer) provided by the vendor immediately.

■ Reference
- Check Point Official Advisory

Priority: High
Deadline: Immediate

Subject: [Info] Microsoft Defender Update Inhibition Exploit (BigDiskBuster)

Dear Team,

We are sharing information regarding a new PoC exploit targeting Microsoft Defender.

■ Overview
Researcher Abdelhamid Naceri (Nightmare Eclipse) has released 'BigDiskBuster,' a PoC exploit that prevents Microsoft Defender from completing platform and signature updates. This could leave systems vulnerable by preventing the latest threat definitions from being applied.

■ Scope
- All currently supported versions of Windows

■ Recommended Actions
1. Monitor for official security updates and patches from Microsoft.
2. Audit Defender update statuses across the fleet to ensure signatures are current.
3. Ensure defense-in-depth measures (EDR, network monitoring) are active to mitigate risks if Defender is compromised.

■ Reference
- SecurityWeek: Nightmare Eclipse Drops New Microsoft Defender Exploit

Priority: Medium
Deadline: Upon release of official patch

Subject: [Security Advisory] ZyXEL GS1900 Switches CVE-2026-7273

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in ZyXEL GS1900 switches.

■ Overview
A stack-based buffer overflow vulnerability (CVE-2026-7273, CVSS 8.8) has been identified in ZyXEL GS1900 switches, allowing unauthenticated OS command execution. Active exploitation by a Chinese threat actor has been observed, targeting sensitive information such as hashed root credentials and network configurations.

■ Scope
- Affected Products: ZyXEL GS1900 series (10 models)
- Vulnerable Versions: Firmware versions 2.10-2.90 and others in scope

■ Action Plan
1. Verify the firmware version of all deployed GS1900 switches and apply the latest security patches released by ZyXEL.
2. Ensure that factory default credentials have been changed to strong, unique passwords.
3. Restrict access to the management interface via ACLs or network segmentation to prevent external exposure.

■ Reference
- GreyNoise Threat Intelligence Report
- ZyXEL Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Alert] Malicious NPM Package 'indexed-btree' Supply Chain Attack

Dear IT/Security Team,

We are sharing information regarding a supply chain attack targeting the NPM ecosystem.

■ Overview
A malicious package named 'indexed-btree' has been identified, mimicking the legitimate 'sorted-btree' utility. The attacker bypassed standard security detections by embedding the malicious trigger within the JavaScript prototype code instead of using install scripts. The package has reportedly reached millions of downloads.

■ Scope
- Affected Package: indexed-btree (NPM)
- Impacted Environments: Any project utilizing this package as a dependency.

■ Action Plan
1. Audit project package.json and lock files to identify if 'indexed-btree' is present.
2. If found, immediately remove the package and conduct an incident response investigation to determine if any data exfiltration occurred.
3. Educate development teams on the risks of typosquatting and the importance of verifying package authenticity.

■ Reference
- Checkmarx Report

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Microsoft SharePoint Server CVE-2026-65660

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Microsoft SharePoint Server.

■ Overview
CVE-2026-65660 was initially classified by Microsoft as a spoofing flaw. However, technical analysis has revealed that it actually allows authenticated Remote Code Execution (RCE). The NVD has assigned a CVSS score of 8.8, indicating a high severity level.

■ Affected Products
- SharePoint Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition

■ Remediation Steps
1. Verify the current patch level of your SharePoint installations.
2. Apply the security updates released on August 11, 2026, if not already installed.

■ Reference
- Microsoft Security Update (August 11)
- NVD CVE-2026-65660

Priority: High
Deadline: Immediate