2026年9月29日の
セキュリティ情報

Subject: [Security Advisory] axios Vulnerabilities (CVE-2026-101909 et al.)

Dear Team,

We are sharing information regarding vulnerabilities discovered in the axios HTTP client library.

■ Overview
PoCs have been released for seven vulnerabilities in axios, including Prototype Pollution (CVE-2026-101909, CVSS 4.0: 8.3) and SSRF (CVE-2026-101907). These could allow attackers to tamper with data or cause Denial of Service.

■ Scope
- Applications utilizing the axios library.

■ Mitigation Steps
1. Identify all projects using the axios library and check the current version.
2. Update axios to the latest patched version.
3. Review input validation logic to prevent prototype pollution and SSRF.

■ Reference
- CSIRT-ITA Alert AL07/260929/CSIRT-ITA

Priority: High
Deadline: Immediate review and update in the next deployment cycle.

Subject: [Security Alert] Proper Use and Management of AI Tools (ChatGPT, etc.)

Hi everyone,
We have observed an increase in malware attacks targeting login credentials and API keys for AI services. If these credentials are stolen, sensitive company data entered into AI tools could be exposed to attackers.

What we need you to do:
1. Avoid registering for unauthorized AI tools using your corporate email address.
2. Ensure that Multi-Factor Authentication (MFA) is enabled on all your AI accounts.
3. Be cautious of suspicious emails, attachments, and links.

Deadline: Immediate

Subject: [Security Advisory] Viidure Dashcam Android Application Vulnerabilities (CVE-2026-94204, CVE-2026-96587)

Dear IT/Security Team,

We are sharing critical vulnerability information regarding the Viidure Dashcam Android Application.

■ Overview
Two critical vulnerabilities have been identified: a misconfigured cloud storage backend with public-read permissions (CVE-2026-94204) and the use of hard-coded credentials (CVE-2026-96587). With a CVSS v3 score of 10, these flaws allow unrestricted access to sensitive user records and critical system files.

■ Affected Scope
- Product: Viidure Dashcam Android Application
- Versions: <= 3.3.1.260403

■ Mitigation Steps
1. Identify if the affected application is in use within the organization or on corporate fleet vehicles.
2. Ensure the application is updated to the latest patched version immediately.

■ Reference
- CISA ICS Advisory ICSA-26-272-07

Priority: High
Deadline: Immediate

Subject: [Intel] Persistence Malware NeedyMantis Analysis

Dear Team,

We are sharing information regarding the NeedyMantis malware family.

■ Overview
NeedyMantis is a malware family used by threat actors to maintain long-term persistence within breached networks. It has been linked to the actor Storm-3069 and observed in targeted attacks against telecommunications, academia, and government sectors.

■ Scope
- Targeted organizations (Telecom, Universities, Gov Contractors)
- Environments potentially affected by the DAEMON Tools Lite supply chain attack

■ Action Items
1. Deploy the IOCs (hashes, domains, file paths) published by Microsoft to your SIEM/EDR.
2. Execute the provided hunting queries to identify any signs of NeedyMantis persistence in your environment.

■ Reference
- Microsoft Technical Analysis

Priority: Medium
Deadline: Immediate review

Subject: [Security Advisory] OAuth Credential Leak in MCP Python SDK

Dear IT/Security Team,

We are sharing information regarding a vulnerability found in the official MCP (Model Context Protocol) Python SDK.

■ Overview
A flaw in the SDK allows a malicious MCP server to trick an application into sending sensitive OAuth credentials—including the client secret, authorization code, and PKCE proof key—to an attacker-controlled endpoint. This could allow an attacker to obtain a valid access token and impersonate the application.

■ Affected Scope
- Product: MCP Python SDK
- Fixed Versions: 1.30.0 and 2.2.0

■ Mitigation Steps
1. Identify all projects utilizing the MCP Python SDK.
2. Update the SDK to version 1.30.0 or 2.2.0 (or later).
3. Consider rotating OAuth client secrets if exposure is suspected.

■ Reference
- Cycode Security Report / Official MCP Advisory

Priority: High
Deadline: Immediate