2026年10月4日の
セキュリティ情報

Subject: [Security Advisory] Citrix NetScaler CVE-2026-88779 Mitigation

Dear IT/Security Team,

We are sharing information regarding a high-severity vulnerability in Citrix NetScaler products.

■ Overview
A memory overflow vulnerability (CVE-2026-88779) has been identified in Citrix NetScaler ADC and Gateway. With a CVSS 4.0 score of 8.7, this flaw allows an unauthenticated remote attacker to cause a Denial of Service (DoS). Exploitation attempts in the wild have been observed.

■ Scope
- Affected Products: Citrix NetScaler ADC, Citrix NetScaler Gateway
- Condition: Instances configured as SAML Service Provider (SP) or SAML Identity Provider (IdP)

■ Mitigation Steps
1. Verify if your NetScaler instances are configured as SAML SP or IdP.
2. Apply the latest security updates provided by Citrix immediately.

■ Reference
- Citrix Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Beware of Sophisticated Impersonation Emails

Hi everyone,

We have observed an increase in phishing attacks where attackers impersonate trusted experts or partners to steal login credentials via fake login pages.

What we need from you:
1. Do not click links or open attachments in emails from unexpected sources, even if the sender's name looks familiar.
2. Always verify the URL of any login page before entering your credentials.
3. If you suspect you have entered your password into a suspicious site, please report it to the IT security team immediately.

Deadline: Immediate action requested.

件名: 【共有】TA419によるMicrosoft AitMフィッシングキャンペーンについて

お疲れさまです。中国系アクターTA419による標的型攻撃に関する情報共有です。

■ 概要
TA419がMicrosoftのAitM (Adversary-in-the-Middle) 手法を用い、AI政策専門家を標的とした認証情報窃取キャンペーンを展開しています。セッションCookieを奪取することでMFAをバイパスする可能性があります。

■ 影響範囲
- Microsoft 365 認証を利用している組織のユーザー
- 特にAI政策、研究、法務に関わる高権限ユーザー

■ 対応手順
1. フィッシング耐性のあるMFA（FIDO2/WebAuthn等）への移行を検討してください。
2. 条件付きアクセス（Conditional Access）の設定を見直し、信頼できない場所からのアクセスを制限してください。
3. 不審なログイン試行や、通常とは異なる場所からのセッション確立がないかログを確認してください。

■ 参考情報
- Proofpoint Analysis

対応優先度: 中
対応期限: 随時

Subject: [Intel] TA419 Microsoft AitM Phishing Campaign

Hi team,

Sharing intelligence regarding a campaign by the China-aligned actor TA419.

■ Overview
TA419 is utilizing Microsoft AitM (Adversary-in-the-Middle) phishing to target AI policy experts. This technique allows attackers to bypass traditional MFA by capturing session cookies in real-time.

■ Scope
- Users utilizing Microsoft 365 authentication
- High-value targets in AI research, policy, and legal sectors

■ Mitigation Steps
1. Evaluate and implement phishing-resistant MFA (e.g., FIDO2/WebAuthn).
2. Review Conditional Access policies to restrict access from untrusted locations/networks.
3. Monitor sign-in logs for anomalous session tokens or unusual geographic logins.

■ Reference
- Proofpoint Analysis

Priority: Medium
Deadline: Ongoing