📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 0
|
対象期間 7日
|
生成 2026-09-18 11:02:00
📦 更新された主要ソフトウェア
主要ソフトの更新なし
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
🟠 ★★ 参考 CVE
展開して表示 (3件)
📝 AI 全体サマリ
展開して読む
software_update は空で、主要ソフトウェアのバージョンリリース情報も取得されていません。結果として ★★★ 要対応は 0 件で、今週は緊急のパッチ対応は不要と判断できる可能性があります。- 3 件のうち 2 件（CVE-2026-76460 / CVE-2026-87886）は CVSS・EPSS・攻撃元区分がいずれも未付与のまま KEV に登録されています。KEV 登録は実際の悪用が確認されたことを示すため、スコア未付与であっても軽視せず、後日スコアが付与された時点で再評価するのが望ましいと考えられます。
- Cisco ISE の件は「未認証・リモートでの管理インタフェース認証回避」という性質上、同種の製品を利用している取引先・グループ会社からの問い合わせが発生する可能性があります。自社導入はないものの、概要を把握しておくと有用と思われます。
- software_update が空である点については、対象期間に実際にリリースがなかったのか、収集側（SecuPortal API の差分取得）で取りこぼしが起きているのかを区別できません。nginx / PostgreSQL 等は定期リリースがあるため、次回実行時も空が続く場合は取得処理側の確認を推奨します。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-12",
"to": "2026-09-18",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 0,
"by_date": {
"2026-09-17": {
"kev_new": 3,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-09-17",
"key": "CVE-2026-58704",
"cve_id": "CVE-2026-58704",
"vendor_project": "Google",
"product": "Pixel",
"vulnerability_name": "Google Pixel Improper Authorization Vulnerability",
"date_added": "2026-09-16",
"short_description": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"epss_score": 0.00112
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-76460",
"cve_id": "CVE-2026-76460",
"vendor_project": "Cisco",
"product": "Identity Services Engine",
"vulnerability_name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
"date_added": "2026-09-16",
"short_description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-87886",
"cve_id": "CVE-2026-87886",
"vendor_project": "Acronis",
"product": "Backup",
"vulnerability_name": "Acronis Backup Incorrect Default Permissions Vulnerability",
"date_added": "2026-09-16",
"short_description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": []
}