📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 10
|
更新ソフト 3
|
対象期間 7日
|
生成 2026-09-01 11:45:25
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| dovecot | 2.4.5 | 2026-08-28 | 11 | 0 | 4 | 0 | 🟠重要 |
| ubuntu | 26.04.1 | 2026-08-28 | 5 | 0 | 1 | 0 | 🟠重要 |
| jenkins | 2.579 | 2026-08-25 | 16 | 0 | 5 | 0 | 🟠重要 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（唯一 is_major_product=true の KEV 追加は CVE-2019-1068 / Microsoft SQL Server ですが、CVSS・attack_vector・ransomware 情報がいずれも未取得のため、方針上の ★★★ 条件を満たすと断定できません。ただし KEV 収載済みの RCE であり、自社で SQL Server を運用している場合は実質的に最優先で確認すべき可能性があります。詳細は下記 ★★ 参考および公式アドバイザリで確認してください。）
🟠 ★★ 参考 CVE
展開して表示 (2件)
（以下は KEV 新規収載だが is_major_product=false かつ CVSS<9.5 のため ★ その他に分類: CVE-2023-49105 ownCloud / CVE-2026-53362 Linux Kernel / CVE-2026-66384 JFrog Artifactory / CVE-2015-3246 Red Hat libuser / CVE-2015-5287 Red Hat ABRT / CVE-2021-23758 Ajax.NET Professional / CVE-2022-0995 Linux Kernel / CVE-2026-60004 Gitea。ただし Linux Kernel 2件は Ubuntu 運用ホストに間接的に関係する可能性があり、CVE-2026-60004 Gitea・CVE-2026-66384 JFrog Artifactory は社内 CI/CD 基盤で利用している場合に影響する可能性があるため、利用状況の確認を推奨。）
📝 AI 全体サマリ
展開して読む
- is_major_product=true の KEV 収載は CVE-2019-1068 のみですが、CVSS・attack_vector・ransomware がすべて null であり、SecuPortal 側のエンリッチメントが未完了の可能性があります。次回ダイジェストで再評価するか、MSRC のアドバイザリを直接確認することを推奨します。
- jenkins 2.579 は CVE 16 件 (High 5 件、うち CVE-2026-53435 / CVE-2026-33001 が CVSS 8.8) と件数が多く、社内 CI 基盤として利用している場合は優先度を一段上げる余地があります。同時に KEV の Gitea / Artifactory も開発基盤系のため、今週は「開発基盤 (Git ホスティング・アーティファクトリポジトリ・CI) の棚卸し」を一つのまとまった作業として実施するのが効率的と考えられます。
- CVE-2026-53362 / CVE-2022-0995 (いずれも Linux Kernel の権限昇格) は、更新対象に挙がっている Ubuntu 26.04.1 の運用ホストに関係する可能性があります。ローカル権限昇格であり単独での外部侵入経路にはなりにくいものの、コンテナホストや共有サーバでは影響が相対的に大きくなる可能性があるため、カーネル版数の確認を推奨します。
# 検証環境の骨子（脆弱バージョンの Gitea を隔離ネットワークで起動する例）
# ※ タグは公式アドバイザリで「影響を受けるバージョン」を確認してから指定してください
services:
gitea:
image: gitea/gitea:<影響を受けるバージョン>
environment:
- GITEA__security__INSTALL_LOCK=true
- GITEA__server__DISABLE_SSH=true
volumes:
- gitea-data:/data
ports:
- "127.0.0.1:3000:3000" # ループバックのみに公開
networks: [lab]
db:
image: postgres:17-alpine
environment:
- POSTGRES_DB=gitea
- POSTGRES_USER=gitea
- POSTGRES_PASSWORD=<検証用の任意値>
networks: [lab]
networks:
lab:
internal: true # 外部へ出さない
volumes:
gitea-data:
検証の観点（手順の骨子）:
1. 脆弱バージョンで起動し、リポジトリに write 権限のみを持つ一般ユーザーを作成する
2. そのユーザー権限で hooks ディレクトリ配下への書き込みが成立し得るかを、ファイルシステム上の変化の有無として観測する（コマンド実行そのものは再現させない）
3. 修正版イメージに差し替えて同じ観測を行い、挙動差分を確認する
4. 併せて、本番相当の権限設計で「write 権限を渡している対象が誰か」を棚卸しし、緩和策（write 権限の縮小、hooks の実行制限）の妥当性を評価する
なお、既存の 脆弱性検証環境の構築 プロジェクト配下に構築する場合は、そちらの CLAUDE.md の方針に合わせてください。検証は必ず外部と疎通しない隔離ネットワークで行い、実際の攻撃コードの作成・公開は行わない前提です。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-08-26",
"to": "2026-09-01",
"days": 7
},
"summary": {
"total_kev_new": 10,
"total_software_update": 3,
"by_date": {
"2026-08-29": {
"kev_new": 0,
"software_update": 2
},
"2026-08-28": {
"kev_new": 3,
"software_update": 0
},
"2026-08-27": {
"kev_new": 6,
"software_update": 0
},
"2026-08-26": {
"kev_new": 1,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-08-28",
"key": "CVE-2023-49105",
"cve_id": "CVE-2023-49105",
"vendor_project": "ownCloud",
"product": "ownCloud",
"vulnerability_name": "ownCloud Improper Authentication Vulnerability",
"date_added": "2026-08-27",
"short_description": "ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-53362",
"cve_id": "CVE-2026-53362",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Unspecified Vulnerability",
"date_added": "2026-08-27",
"short_description": "Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-30",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap ",
"epss_score": 0.00265
},
{
"digest_date": "2026-08-28",
"key": "CVE-2026-66384",
"cve_id": "CVE-2026-66384",
"vendor_project": "JFrog",
"product": "Artifactory",
"vulnerability_name": "JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability",
"date_added": "2026-08-27",
"short_description": "JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-10",
"known_ransomware": "Unknown",
"cvss_score": 5.3,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.",
"epss_score": 0.00264
},
{
"digest_date": "2026-08-27",
"key": "CVE-2015-3246",
"cve_id": "CVE-2015-3246",
"vendor_project": "Red Hat",
"product": "Libuser",
"vulnerability_name": "Red Hat Libuser Race Condition Vulnerability",
"date_added": "2026-08-26",
"short_description": "Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2015-5287",
"cve_id": "CVE-2015-5287",
"vendor_project": "Red Hat",
"product": "Automatic Bug Reporting Tool",
"vulnerability_name": "Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability",
"date_added": "2026-08-26",
"short_description": "Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2019-1068",
"cve_id": "CVE-2019-1068",
"vendor_project": "Microsoft",
"product": "SQL Server",
"vulnerability_name": "Microsoft SQL Server Remote Code Execution Vulnerability",
"date_added": "2026-08-26",
"short_description": "Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-29",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": true,
"matched_product": "mssqlserver",
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2021-23758",
"cve_id": "CVE-2021-23758",
"vendor_project": "Ajax.NET Professional",
"product": "Ajax.NET Professional",
"vulnerability_name": "Ajax.NET Professional Deserialization of Untrusted Data Vulnerability",
"date_added": "2026-08-26",
"short_description": "Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2022-0995",
"cve_id": "CVE-2022-0995",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
"date_added": "2026-08-26",
"short_description": "Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-09",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-08-27",
"key": "CVE-2026-8452",
"cve_id": "CVE-2026-8452",
"vendor_project": "Citrix",
"product": "NetScaler ADC and NetScaler Gateway",
"vulnerability_name": "Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
"date_added": "2026-08-26",
"short_description": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. ",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-29",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server",
"epss_score": 0.01041
},
{
"digest_date": "2026-08-26",
"key": "CVE-2026-60004",
"cve_id": "CVE-2026-60004",
"vendor_project": "Gitea",
"product": "Gitea",
"vulnerability_name": "Gitea Code Injection Vulnerability",
"date_added": "2026-08-25",
"short_description": "Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-08-28",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-08-29",
"key": "dovecot:2.4",
"product": "dovecot",
"category": "middleware",
"cycle": "2.4",
"latest": "2.4.5",
"release_date": "2025-01-24",
"latest_release_date": "2026-08-28",
"eol_date": "false",
"support_date": "true",
"is_major_product": true,
"cve_stats": {
"total": 11,
"critical": 0,
"high": 4,
"medium": 6,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-24031",
"severity": "HIGH",
"score": 7.7
},
{
"cve_id": "CVE-2026-27858",
"severity": "HIGH",
"score": 7.5
},
{
"cve_id": "CVE-2025-59032",
"severity": "HIGH",
"score": 7.5
}
]
}
},
{
"digest_date": "2026-08-29",
"key": "ubuntu:26.04",
"product": "ubuntu",
"category": "os",
"cycle": "26.04",
"latest": "26.04.1",
"release_date": "2026-04-23",
"latest_release_date": "2026-08-28",
"eol_date": "2031-04-30",
"support_date": "2031-04-30",
"is_major_product": true,
"cve_stats": {
"total": 5,
"critical": 0,
"high": 1,
"medium": 2,
"low": 2,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2025-33208",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2025-6966",
"severity": "MEDIUM",
"score": 5.5
},
{
"cve_id": "CVE-2026-47335",
"severity": "MEDIUM",
"score": 5.5
}
]
}
},
{
"digest_date": "2026-08-26",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.579",
"release_date": "2016-04-20",
"latest_release_date": "2026-08-25",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 16,
"critical": 0,
"high": 5,
"medium": 10,
"low": 1,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2026-53435",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-33001",
"severity": "HIGH",
"score": 8.8
},
{
"cve_id": "CVE-2026-27099",
"severity": "HIGH",
"score": 8.0
}
]
}
}
]
}