📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 2
|
更新ソフト 3
|
対象期間 7日
|
生成 2026-09-29 11:00:43
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| amazon-corretto (25) | 25.0.4.10.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-corretto (21) | 21.0.12.12.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
| amazon-corretto (17) | 17.0.20.12.1 | 2026-09-26 | 0 | 0 | 0 | 0 | ✅計画 |
非主要製品 の更新: 0件（OS ディストリ / Alpine 派生など、要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
🟠 ★★ 参考 CVE
展開して表示 (0件)
is_major_product=false かつ CVSS が 9.5 未満（または未採点）のため、本方針では ★ その他に分類される可能性があります。📝 AI 全体サマリ
展開して読む
- amazon-corretto は JDK ディストリビューションであるため、CVE 件数 0 でも Java アプリの稼働バージョンとの整合性（ビルドイメージ・CI の JDK 固定）を確認しておくと安全です。各サイクルの EOL は 17 → 2029-10-31、21 → 2030-10-31、25 → 2032-10-31 と登録されており、長期サポート計画上は 21 以降への移行を検討する余地がある可能性があります。詳細は Amazon Corretto の公式リリースノートで確認してください。
- CVE-2026-67279 は CVSS 未採点のため、本方針のスコア基準では ★★★ に到達しませんが、「未認証 + 他 CVE との連鎖で RCE」という性質上、実運用上のリスクは数値以上である可能性があります。自社での RouterOS 利用がない前提は、ネットワーク機器台帳で一度裏取りすることを推奨します。公式アドバイザリ（MikroTik および CISA KEV カタログ）で最新の記載を確認してください。
- CVE-2026-65660 は "authorized attacker" と記載されており、事前認証が前提となる可能性があります。SharePoint Online / オンプレ運用がある場合は Microsoft のセキュリティ更新プログラムガイドで適用状況を確認してください。
# docker-compose.yml（骨子：Corretto のサイクル差分を並べて挙動比較する用）
services:
corretto17:
image: amazoncorretto:17.0.20
command: ["sh", "-c", "java -version && sleep infinity"]
corretto21:
image: amazoncorretto:21.0.12
command: ["sh", "-c", "java -version && sleep infinity"]
corretto25:
image: amazoncorretto:25.0.4
command: ["sh", "-c", "java -version && sleep infinity"]
# 用途: 検証対象アプリの jar を各サービスにマウントし、
# 修正前後のバージョンで挙動差（例外/ログ出力）のみを比較する。
# 実際のタグは Docker Hub の amazoncorretto で公開状況を確認すること。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-09-23",
"to": "2026-09-29",
"days": 7
},
"summary": {
"total_kev_new": 2,
"total_software_update": 3,
"by_date": {
"2026-09-27": {
"kev_new": 0,
"software_update": 3
},
"2026-09-26": {
"kev_new": 2,
"software_update": 0
}
}
},
"kev_new": [
{
"digest_date": "2026-09-26",
"key": "CVE-2026-65660",
"cve_id": "CVE-2026-65660",
"vendor_project": "Microsoft",
"product": "SharePoint",
"vulnerability_name": "Microsoft SharePoint Code Injection Vulnerability",
"date_added": "2026-09-25",
"short_description": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-28",
"known_ransomware": "Unknown",
"cvss_score": 6.5,
"cvss_severity": "MEDIUM",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.",
"epss_score": 0.01221
},
{
"digest_date": "2026-09-26",
"key": "CVE-2026-67279",
"cve_id": "CVE-2026-67279",
"vendor_project": "MikroTik",
"product": "RouterOS",
"vulnerability_name": "Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability",
"date_added": "2026-09-25",
"short_description": "Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-09-28",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-",
"epss_score": 0.0071
}
],
"software_update": [
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:17",
"product": "amazon-corretto",
"category": "programming",
"cycle": "17",
"latest": "17.0.20.12.1",
"release_date": "2021-08-24",
"latest_release_date": "2026-09-26",
"eol_date": "2029-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:21",
"product": "amazon-corretto",
"category": "programming",
"cycle": "21",
"latest": "21.0.12.12.1",
"release_date": "2023-08-21",
"latest_release_date": "2026-09-26",
"eol_date": "2030-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-09-27",
"key": "amazon-corretto:25",
"product": "amazon-corretto",
"category": "programming",
"cycle": "25",
"latest": "25.0.4.10.1",
"release_date": "2025-09-17",
"latest_release_date": "2026-09-26",
"eol_date": "2032-10-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 0,
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"kev": 0,
"top_cves": [],
"still_vulnerable": 0
}
}
]
}