📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 6
|
更新ソフト 0
|
対象期間 7日
|
生成 2026-09-21 14:43:10
📦 更新された主要ソフトウェア
主要ソフトの更新なし
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
（今回のダイジェストには is_major_product=true の CVE が含まれておらず、★★★ の条件を満たすものはありません）
🟠 ★★ 参考 CVE
展開して表示 (6件)
recvmsg() のレコード種別処理を回り込む可能性があり、以降の TLS レコードが誤った zero-copy 前提で処理される恐れがある。カーネル TLS（kTLS）を明示的に有効化していない構成では影響は限定的と考えられるが、EoL カーネルを載せたホストが無いかは確認したい。ディストリの定期更新で吸収される見込み。📝 AI 全体サマリ
展開して読む
software_update も 0 件のため、今週は主要ソフトのバージョン追随作業も発生していない可能性が高いと見られます。```yaml
# 骨子のみ: カーネル検証は Docker ではなく VM で分離する
# 例) Vagrant + libvirt/VirtualBox で対象カーネルを pin した VM を用意
# Vagrantfile (概念)
# config.vm.box = "generic/ubuntu2404"
# config.vm.provision "shell", inline: <<-SHELL
# apt-get update
# apt-get install -y linux-image-<検証対象バージョン> ethtool iproute2 bridge-utils
# # kTLS 有効性の確認のみ: ethtool -k / /proc/net/tls_stat 等を参照
# SHELL
# config.vm.network "private_network", type: "static", ip: "192.168.56.20" # 外部から隔離
```
補助的に、アプリ側の TLS 経路（nginx 等）が kTLS を使用しているかを確認するだけであれば、既存の 脆弱性検証環境の構築 プロジェクト配下の環境に nginx コンテナを 1 つ立て、nginx -V のビルドオプションと設定の ssl_conf_command 有無を見る程度で足りると考えられます。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-15",
"to": "2026-09-21",
"days": 7
},
"summary": {
"total_kev_new": 6,
"total_software_update": 0,
"by_date": {
"2026-09-19": {
"kev_new": 3,
"software_update": 0
},
"2026-09-17": {
"kev_new": 3,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39682",
"cve_id": "CVE-2025-39682",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2025-39964",
"cve_id": "CVE-2025-39964",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Race Condition Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-19",
"key": "CVE-2026-53266",
"cve_id": "CVE-2026-53266",
"vendor_project": "Linux",
"product": "Kernel",
"vulnerability_name": "Linux Kernel Out-of-Bounds Write Vulnerability",
"date_added": "2026-09-18",
"short_description": "Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-21",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb->data points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and wo",
"epss_score": 0.00121
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-58704",
"cve_id": "CVE-2026-58704",
"vendor_project": "Google",
"product": "Pixel",
"vulnerability_name": "Google Pixel Improper Authorization Vulnerability",
"date_added": "2026-09-16",
"short_description": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": 8.8,
"cvss_severity": "HIGH",
"cvss_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "A",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"epss_score": 0.00112
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-76460",
"cve_id": "CVE-2026-76460",
"vendor_project": "Cisco",
"product": "Identity Services Engine",
"vulnerability_name": "Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability",
"date_added": "2026-09-16",
"short_description": "Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
},
{
"digest_date": "2026-09-17",
"key": "CVE-2026-87886",
"cve_id": "CVE-2026-87886",
"vendor_project": "Acronis",
"product": "Backup",
"vulnerability_name": "Acronis Backup Incorrect Default Permissions Vulnerability",
"date_added": "2026-09-16",
"short_description": "Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-19",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": null,
"epss_score": null
}
],
"software_update": []
}