📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 11
|
更新ソフト 3
|
対象期間 7日
|
生成 2026-08-31 04:40:58
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| dovecot | 2.4.5 | 2026-08-28 | 11 | 0 | 4 | 0 | 🟠重要 |
| ubuntu | 26.04.1 | 2026-08-28 | 5 | 0 | 1 | 0 | 🟠重要 |
| jenkins | 2.579 | 2026-08-25 | 16 | 0 | 5 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（KEV 新規追加のうち is_major_product=true は CVE-2019-1068 (Microsoft SQL Server) の 1 件のみですが、CVSS スコアが未登録で is_remote も不明のため、方針上の ★★★ 条件を満たしません。ただし KEV 該当かつ主要製品であり、実運用上は ★★ 相当以上として下記で扱っています。運用状況によっては優先度の再評価が必要となる可能性があります。）
🟠 ★★ 参考 CVE
展開して表示 (4件)
📝 AI 全体サマリ
展開して読む
全体トレンド
本週の KEV 新規追加は 11 件で、そのうち 5 件が 2015〜2022 年の古い CVE（Red Hat libuser / ABRT、Linux Kernel、Ajax.NET Professional、Microsoft SQL Server 2019）であり、CISA が過去分の悪用実績を遡って登録する動きが続いている可能性がある。うち複数は EoL/EoS 製品として「利用停止または サポート版への移行」が勧告されており、レガシー資産の棚卸しが実務上の論点になると考えられる。新規 CVE 側では Oracle HTTP Server (CVSS 10.0, EPSS 0.43) と Citrix NetScaler (CVSS 9.8) が突出しているが、いずれも自社の運用対象外のエンタープライズ製品である。
主要ソフトの更新は dovecot 2.4.5 / Ubuntu 26.04.1 / Jenkins 2.579 の 3 件で、いずれも Critical・KEV 該当は 0 件、High が 1〜5 件という構成であり、通常のメンテナンスウィンドウでの計画適用で対応可能な範囲と考えられる。特に Jenkins は CVE 総数 16 件（High 5 件、CVE-2026-53435 / CVE-2026-33001 が CVSS 8.8）と件数が多く、プラグイン起因の脆弱性が含まれる可能性があるため、コア更新と併せてプラグイン側の更新状況も確認することを推奨。
特記事項
is_major_product=false と判定されているが、実態として自社の Ubuntu / コンテナ基盤のカーネルに該当し得る。Ubuntu 26.04.1 適用時にカーネルパッケージのバージョンが対策済みかどうか、ディストリのセキュリティ通知で確認することを推奨。EPSS は 0.00265 と低く、ローカル権限昇格のため緊急性は限定的と見られる。PoC 検証を推奨する CVE
自社運用対象に直結する ★★★ が 0 件のため、今週は緊急の検証環境構築は不要と考えられる。参考として、社内で Gitea を自前ホストしている場合の CVE-2026-60004（diffpatch API 経由の Git hook 混入）は、影響有無の切り分けを検証環境で行う価値がある。以下は挙動確認用の環境骨子のみで、攻撃コードは含まない。
# 検証目的: 脆弱バージョンと修正版で diffpatch API の挙動差を比較する
services:
gitea-vuln:
image: gitea/gitea:<脆弱とされるタグ> # 公式アドバイザリで影響バージョンを確認して指定
environment:
- GITEA__security__DISABLE_GIT_HOOKS=true # 緩和設定の有効性も併せて確認
ports: ["3000:3000"]
volumes: ["./data-vuln:/data"]
gitea-fixed:
image: gitea/gitea:<修正版タグ>
ports: ["3001:3000"]
volumes: ["./data-fixed:/data"]
検証の観点としては、(1) DISABLE_GIT_HOOKS=true が緩和策として機能するか、(2) リポジトリ書き込み権限の付与範囲（外部コラボレータの有無）が実質的な攻撃前提を満たすか、の 2 点を確認するのが実務上有効と考えられる。具体的な攻撃手順は公式アドバイザリおよびベンダの修正コミットを参照のこと。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-25",
"to": "2026-08-31",
"days": 7
},
"summary": {
"total_kev_new": 11,
"total_software_update": 3,
"by_date": {
"2026-08-29": {
"kev_new": 0,
"software_update": 2
},
"2026-08-28": {
"kev_new": 3,
"software_update": 0
},
"2026-08-27": {
"kev_new": 6,
"software_update": 0
},
"2026-08-26": {
"kev_new": 1,
"software_update": 1
},
"2026-08-25": {
"kev_new": 1,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-08-28",
"key": "CVE-2023-49105",
"cve_id": "CVE-2023-49105",
"vendor_project": "ownCloud",
"product": "ownCloud",
"vulnerability_name": "ownCloud Improper Authentication Vulnerability",
"date_added": "2026-08-27",
"short_description": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-53362",
"cve_id": "CVE-2026-53362",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Unspecified Vulnerability",
"date_added": "2026-08-27",
"short_description": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap ",
"epss_score": 0.00265
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-66384",
"cve_id": "CVE-2026-66384",
"vendor_project": "JFrog",
"product": "Artifactory",
"vulnerability_name": "JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
"date_added": "2026-08-27",
"short_description": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-10",
"known_ransomware": "Unknown",
"cvss_score": 5.3,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.",
"epss_score": 0.00264
},
{
"digest_date": "2026-08-27",
"key": "CVE-2015-3246",
"cve_id": "CVE-2015-3246",
"vendor_project": "Red Hat",
"product": "Libuser",
"vulnerability_name": "Red Hat Libuser Race Condition Vulnerability",
"date_added": "2026-08-26",
"short_description": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2015-5287",
"cve_id": "CVE-2015-5287",
"vendor_project": "Red Hat",
"product": "Automatic Bug Reporting Tool",
"vulnerability_name": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability",
"date_added": "2026-08-26",
"short_description": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2019-1068",
"cve_id": "CVE-2019-1068",
"vendor_project": "Microsoft",
"product": "SQL Server",
"vulnerability_name": "Microsoft SQL Server Remote Code Execution Vulnerability",
"date_added": "2026-08-26",
"short_description": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-29",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": true,
"matched_product": "mssqlserver",
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2021-23758",
"cve_id": "CVE-2021-23758",
"vendor_project": "Ajax.NET Professional",
"product": "Ajax.NET Professional",
"vulnerability_name": "Ajax.NET Professional Deserialization of Untrusted Data Vulnerability",
"date_added": "2026-08-26",
"short_description": "Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2022-0995",
"cve_id": "CVE-2022-0995",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
"date_added": "2026-08-26",
"short_description": "Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2026-8452",
"cve_id": "CVE-2026-8452",
"vendor_project": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"vulnerability_name": "Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
"date_added": "2026-08-26",
"short_description": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-29",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server",
"epss_score": 0.01041
},
{
"digest_date": "2026-08-26",
"key": "CVE-2026-60004",
"cve_id": "CVE-2026-60004",
"vendor_project": "Gitea",
"product": "Gitea",
"vulnerability_name": "Gitea Code Injection Vulnerability",
"date_added": "2026-08-25",
"short_description": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-28",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-25",
"key": "CVE-2026-21962",
"cve_id": "CVE-2026-21962",
"vendor_project": "Oracle",
"product": "HTTP Server and Oracle Weblogic Server Proxy Plug-in",
"vulnerability_name": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability",
"date_added": "2026-08-24",
"short_description": "Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.",
"required_action": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"due_date": "2026-08-27",
"known_ransomware": "Unknown",
"cvss_score": 10.0,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in O",
"epss_score": 0.4323
}
],
"software_update": [
{
"digest_date": "2026-08-29",
"key": "dovecot:2.4",
"product": "dovecot",
"category": "middleware",
"cycle": "2.4",
"latest": "2.4.5",
"release_date": "2025-01-24",
"latest_release_date": "2026-08-28",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 11,
"critical": 0,
"high": 4,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-24031",
"severity": "HIGH",
"score": 7.7
},
{
"cve_id": "CVE-2026-27858",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-59032",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-29",
"key": "ubuntu:26.04",
"product": "ubuntu",
"category": "os",
"cycle": "26.04",
"latest": "26.04.1",
"release_date": "2026-04-23",
"latest_release_date": "2026-08-28",
"eol_date": "2031-04-30",
"support_date": "2031-04-30",
"is_major_product": true,
"cve_stats": {
"total": 5,
"critical": 0,
"high": 1,
"medium": 2,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-33208",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2025-6966",
"severity": "MEDIUM",
"score": 5.5
},
{
"cve_id": "CVE-2026-47335",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-26",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.579",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-25",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
}
]
}