2026年11月10日の
セキュリティ情報

Subject: [Security Advisory] SAP NetWeaver/Web Dispatcher Vulnerabilities (ICM2SHELL)

Dear IT Administration Team,

We are sharing information regarding critical vulnerabilities identified in SAP products.

■ Overview
A vulnerability dubbed 'ICM2SHELL' (CVE-2026-76964, CVE-2026-89126) has been discovered in the SAP kernel's handling of WebSocket messages. This flaw could lead to memory corruption, process crashes, or remote OS command execution.

■ Affected Scope
- SAP NetWeaver (ICM, SAML2 Service Provider)
- SAP Web Dispatcher
- SAP Gateway

■ Remediation Steps
1. Review the latest security notes on the SAP Support Portal.
2. Apply the necessary security patches to the affected product versions.

■ Reference
- SAP Security Notes

Priority: High
Deadline: Immediate

Subject: [Urgent] Vulnerabilities in IBM Aspera Faspex and SignalWire FreeSwitch

Dear Team,

This is a technical alert regarding critical vulnerabilities currently being exploited in the wild.

■ Overview
CISA has warned of active exploitation of vulnerabilities in IBM Aspera Faspex (CVE-2026-123218) and SignalWire FreeSwitch (CVE-2026-116779). Both have CVSS scores of 9.8, allowing for administrative privilege escalation and remote command execution.

■ Affected Products
- IBM Aspera Faspex (versions prior to 5.0.19 PL1)
- SignalWire FreeSwitch

■ Action Required
1. Update IBM Aspera Faspex to version 5.0.19 PL1 immediately.
2. Review SignalWire FreeSwitch deployments and apply the latest security patches.

■ Reference
- CISA Warning / IBM Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Xen Orchestra Authentication Bypass Vulnerability (VSA-2026-062)

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Xen Orchestra.

■ Overview
A critical authentication bypass flaw (VSA-2026-062) has been identified in Xen Orchestra and XOA. By sending a specially crafted cookie, remote attackers can bypass authentication and gain administrator privileges, potentially leading to the takeover of XCP-ng virtualization hosts. This vulnerability is currently being exploited in the wild.

■ Scope
- Xen Orchestra
- Xen Orchestra Appliance (XOA)

■ Action Plan
1. Immediately update Xen Orchestra/XOA to the latest patched version provided by Vates.
2. Ensure that the management interface is not exposed to the public internet and restrict access to trusted networks/VPNs.

■ Reference
- Vates Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Barracuda ESG Vulnerabilities (CVE-2026-116606, CVE-2026-111560) Mitigation

Dear Team,

This is a technical alert regarding critical vulnerabilities in Barracuda Email Security Gateway (ESG).

■ Overview
Two critical flaws (CVE-2026-116606 and CVE-2026-111560) are being exploited in the wild. These vulnerabilities allow attackers to bypass authorization and inject OS commands, potentially granting root access to the appliance.

■ Scope
- Affected Product: Barracuda Email Security Gateway (ESG)

■ Mitigation Steps
1. Apply the security updates released by Barracuda immediately.
2. Restrict access to the Administrative User Interface (Admin UI) to trusted internal networks only using network access controls.

■ Reference
- Barracuda Networks Official Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Please Update Your Google Chrome Browser

Hi everyone,

A critical security vulnerability has been discovered in Google Chrome and is currently being exploited by attackers.

Action required:
1. Go to 'Help' -> 'About Google Chrome' in your browser menu to check for updates.
2. Install any available updates and restart the browser.

Deadline: End of today

件名: 【共有】Google Chrome CVE-2026-125350 対応について

お疲れさまです。Chromeのゼロデイ脆弱性に関する情報共有です。

■ 概要
XML処理におけるUse-after-free (UAF) の脆弱性 (CVE-2026-125350) が報告されました。既に野生でのエクスプロイトが確認されており、メモリ破損による任意のコード実行の危険性があります。

■ 影響範囲
- Google Chrome (最新パッチ適用前のバージョン)

■ 対応手順
1. 社内端末のChromeバージョンが最新であるか確認し、未適用の場合は強制アップデートを検討してください。
2. ユーザーに対し、ブラウザの再起動を促してください。

■ 参考情報
- Google Chrome Security Advisory

対応優先度: 高
対応期限: 即時

Subject: [Technical Alert] Google Chrome CVE-2026-125350 Mitigation

Dear team,

This is a notification regarding a zero-day vulnerability in Google Chrome.

■ Overview
A Use-after-free (UAF) vulnerability (CVE-2026-125350) residing in XML has been identified and is being actively exploited in the wild. This memory corruption flaw could lead to arbitrary code execution.

■ Scope
- Google Chrome (versions prior to the latest security patch)

■ Mitigation Steps
1. Ensure all corporate endpoints are updated to the latest Chrome version.
2. Enforce a browser restart to ensure the patch is active.

■ Reference
- Google Chrome Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Plex Media Server Vulnerabilities (Plex2Shell)

Dear IT/Security Team,

This is a notification regarding critical vulnerabilities in Plex Media Server.

■ Overview
Multiple vulnerabilities (including CVE-2026-96652) allow unauthenticated remote code execution (RCE). An exploit chain known as "Plex2Shell" leverages SSRF and other flaws to write malicious files to the server. Active exploitation has been observed, leading to the installation of cryptominers and unauthorized proxies.

■ Scope
- Affected Product: Plex Media Server v1.43.2 and earlier
- High risk for environments running Plex as an add-on on NAS devices (e.g., QNAP).

■ Remediation Steps
1. Immediately update Plex Media Server to the latest version.
2. Review network exposure and restrict public access to the server where possible.
3. Inspect systems for signs of compromise, such as unauthorized processes or abnormal CPU usage.

■ Reference
- Plex Official Announcements
- CISA Known Exploited Vulnerabilities (KEV) Catalog

Priority: High
Deadline: Immediate

Subject: [Urgent] Please Update Your Apple Devices (iOS, iPadOS, macOS)

Hi everyone,
Critical security vulnerabilities have been discovered in Apple products that could allow unauthorized access or data theft if left unpatched.

Action Required:
1. Check for software updates in the "Settings" menu of your iPhone, iPad, and Mac.
2. Install the latest available OS updates immediately.

Deadline: End of today

件名: 【共有】Apple製品の脆弱性 (CVE-2026-111497) 対応について

お疲れさまです。Apple製品の脆弱性に関する情報共有です。

■ 概要
Google Brotliのメモリ破損脆弱性に起因する複数の脆弱性が確認されました。特にCVE-2026-111497は既に実環境で悪用されており、リモートコード実行 (RCE) や機密情報の漏洩を招く恐れがあるため、リスクレベルは「極めて高い」とされています。

■ 影響範囲
- iOS / iPadOS: 27.2.1, 26.7.3, 18.7.12 未満のバージョン
- macOS Golden Gate: 27.2.1 未満のバージョン

■ 対応手順
1. 社内管理デバイスのOSバージョンを確認し、未適用の端末を特定する。
2. MDM等を用いて、最新バージョンへの強制アップデートを配信する。
3. ユーザーに対し、手動でのアップデートを促す通知を行う。

■ 参考情報
- hkcert アドバイザリ

対応優先度: 高
対応期限: 即時

Subject: [Technical Alert] Apple Product Vulnerabilities (CVE-2026-111497)

Dear IT Security Team,

This is a technical alert regarding multiple vulnerabilities in Apple products.

■ Overview
Several vulnerabilities have been identified, including a critical flaw in Google Brotli that allows remote unauthenticated attackers to corrupt memory, disclose sensitive contents, or execute arbitrary code. CVE-2026-111497 is confirmed to be exploited in the wild, resulting in an "Extremely High Risk" rating.

■ Affected Scope
- iOS / iPadOS: Versions prior to 27.2.1, 26.7.3, and 18.7.12
- macOS Golden Gate: Versions prior to 27.2.1

■ Remediation Steps
1. Audit current OS versions across the fleet via MDM.
2. Push mandatory updates to the latest patched versions.
3. Notify end-users to complete the update process immediately.

■ Reference
- hkcert Advisory

Priority: High
Deadline: Immediate