2026年10月3日の
セキュリティ情報

Subject: [Security Alert] Fortra BoKS Authentication Bypass (CVE-2026-79901)

Dear IT/Security Team,

We are sharing critical vulnerability information regarding Fortra Core Privileged Access Manager (BoKS).

■ Overview
Fortra has released patches for eight vulnerabilities, most notably CVE-2026-79901 (CVSS 9.9). This flaw allows for authentication bypass because AD service account passwords are generated using a predictable pseudo-random sequence based on the Unix timestamp, enabling attackers to reproduce and verify passwords offline.

■ Scope
- Product: Fortra Core Privileged Access Manager (BoKS)
- Specifically affecting deployments relying on BoKS keytab for Active Directory service account management.

■ Action Required
1. Identify all BoKS Manager deployments within the environment.
2. Apply the latest security patches provided by Fortra immediately.

■ Reference
- Fortra Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Warlock Exploiting Microsoft SharePoint Vulnerabilities

Dear IT/Security Team,

We are sharing information regarding a campaign by the threat actor Warlock (also known as Gold Salem or Longlegs).

■ Overview
Warlock is weaponizing Microsoft SharePoint vulnerabilities (including "ToolShell") to disable security tools and deploy ransomware. The group specifically targets critical infrastructure, government, and education sectors.

■ Scope
- Microsoft SharePoint (unpatched versions)

■ Action Items
1. Ensure all Microsoft SharePoint servers are updated with the latest security patches.
2. Review audit logs for any unauthorized disabling of security software or configuration changes.
3. Enhance monitoring for suspicious privilege escalation or anomalous behavior from administrative accounts.

■ Reference
- Symantec / Carbon Black Threat Hunter Team reports

Priority: High
Deadline: Immediate