2026年9月24日の
セキュリティ情報

Subject: [Security Alert] Vulnerability Remediation for ManageEngine Products

Dear IT Administration Team,

This is a notification regarding critical security updates for ManageEngine products.

■ Overview
Zoho has addressed 14 vulnerabilities across multiple ManageEngine products. The severity is rated as 2 'Critical' and 12 'High', covering risks such as Remote Code Execution (RCE), Privilege Escalation, Authentication Bypass, and Information Disclosure.

■ Affected Scope
- ManageEngine Applications Manager / Applications Manager Plugin
- OpManager (including Enterprise, Nexus, Nexus Enterprise, and MSP editions)
- Firewall Analyzer
- Network Configuration Manager Enterprise Edition

■ Remediation Steps
1. Identify the current versions of the aforementioned products in your environment.
2. Apply the latest security patches or upgrade to the latest versions provided by the vendor immediately.

■ Reference
- ManageEngine Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] WatchGuard AuthPoint Authentication Gateway CVE-2026-95676

Dear IT Administration Team,

We are sharing information regarding a vulnerability in WatchGuard products.

■ Overview
An authentication bypass vulnerability (CVE-2026-95676) has been identified in the WatchGuard AuthPoint Authentication Gateway. This flaw could allow an attacker to circumvent authentication mechanisms and gain unauthorized access.

■ Scope
- Product: AuthPoint Authentication Gateway
- Affected Versions: 4.2.2 to 7.5.0 (inclusive)

■ Mitigation Steps
1. Verify the current version of the AuthPoint Authentication Gateway in use.
2. Update the software to the latest patched version as recommended by the vendor.

■ Reference
- https://psirt.watchguard.com/CVE-2026-95676/

Priority: High
Deadline: Immediate

Subject: [Security Advisory] MikroTik RouterOS Authentication Bypass (MikroTrick)

Dear IT Administration Team,

We are sharing information regarding a critical vulnerability chain known as 'MikroTrick' affecting MikroTik RouterOS.

■ Overview
An attack chain has been identified that allows an attacker to bypass authentication and gain full administrative access by chaining two separate flaws. This was uncovered via AI-assisted analysis of recent vendor patches.

■ Scope
- Product: MikroTik RouterOS
- Affected Versions: Versions prior to the September 3, 2026 update.

■ Mitigation Steps
1. Immediately update RouterOS to the latest available version.
2. Restrict access to management interfaces (WinBox, WebFig, SSH) using strict ACLs to trusted IP addresses only.

■ Reference
- MikroTik Official Security Update (Released Sept 3, 2026)

Priority: High
Deadline: Immediate

Subject: [Security Alert] Warning Against Installing Unverified Applications

Dear employees,
We have observed a cyber campaign targeting the logistics sector that tricks users into installing malicious apps via fake websites.

What we need from you:
1. Do not install any applications from sources other than official stores like Google Play.
2. If you receive an email or message prompting you to download a 'system update' or 'company tool' from an external link, do not click it and report it to the IT department immediately.

Deadline: Immediate

Subject: [Urgent] Remediation for Microsoft SharePoint Server CVE-2026-65660

Dear IT Administration Team,

We are sharing critical information regarding a vulnerability in Microsoft SharePoint Server.

■ Overview
A code injection vulnerability (CVE-2026-65660) has been identified in Microsoft SharePoint Server, allowing authenticated attackers to execute arbitrary code. Active exploitation has been observed in the wild.

■ Scope
- Affected versions of Microsoft SharePoint Server

■ Remediation Steps
1. Verify the current version of SharePoint Server in your environment.
2. Apply the security updates released by Microsoft on August 11, 2026.

■ Reference
- Microsoft Security Advisory (August 11, 2026)
- Canadian Centre for Cyber Security Alert AL26-023

Priority: High
Deadline: Immediate