📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 0
|
対象期間 7日
|
生成 2026-09-19 14:53:14
📦 更新された主要ソフトウェア
主要ソフトの更新なし
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（本期間（2026-09-13〜2026-09-19）に取得した 6 件はいずれも is_major_product=false であり、CVSS 9.0 以上・ランサムウェア既知の該当もないため、★★★ の条件を満たすものはありません。）
🟠 ★★ 参考 CVE
展開して表示 (6件)
recvmsg() のレコード種別処理を回避し、以降の TLS レコードが誤った zero-copy 前提で処理される可能性がある。kTLS を明示的に利用する構成でなければ影響は限定的と見られる。📝 AI 全体サマリ
展開して読む
software_update も空であり、主要ソフトのバージョン更新は検知されていません。privileged 付きコンテナではカーネルはホスト共有となり検証の意味が薄いため、以下のような「隔離された VM でカーネルを差し替える」構成が適切です。 - ベース: debian:bookworm 等のコンテナで kTLS を有効化した nginx をビルドし、ssl_conf_command Options KTLS; 相当の設定で TLS オフロード有効／無効の 2 系統を用意
- カーネル側の挙動差分を見る場合はコンテナではなく QEMU/KVM 上の使い捨て VM（脆弱版カーネルと修正版カーネルの 2 台）を用意し、docker compose はクライアント側の負荷生成（openssl s_client によるレコード送信パターンの比較）に限定する
- 観測対象は dmesg のカーネルログとプロセス異常終了の有無に留め、攻撃コードの作成は行わない
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-13",
"to": "2026-09-19",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 0,
"by_date": {
"2026-09-19": {
"kev_new": 3,
"software_update": 0
},
"2026-09-17": {
"kev_new": 3,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39682",
"cve_id": "CVE-2025-39682",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39964",
"cve_id": "CVE-2025-39964",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Race Condition Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2026-53266",
"cve_id": "CVE-2026-53266",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and wo",
"epss_score": 0.00121
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-58704",
"cve_id": "CVE-2026-58704",
"vendor_project": "Google",
"product": "Pixel",
"vulnerability_name": "Google Pixel Improper Authorization Vulnerability",
"date_added": "2026-09-16",
"short_description": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"epss_score": 0.00112
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-76460",
"cve_id": "CVE-2026-76460",
"vendor_project": "Cisco",
"product": "Identity Services Engine",
"vulnerability_name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
"date_added": "2026-09-16",
"short_description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-87886",
"cve_id": "CVE-2026-87886",
"vendor_project": "Acronis",
"product": "Backup",
"vulnerability_name": "Acronis Backup Incorrect Default Permissions Vulnerability",
"date_added": "2026-09-16",
"short_description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": []
}