📊 SecuPortal 日次脆弱性ダイジェスト
新規 KEV 3
|
更新ソフト 6
|
対象期間 7日
|
生成 2026-10-07 11:00:41
📦 更新された主要ソフトウェア
| 製品 | 新バージョン | リリース日 | CVE件数 | Critical | High | KEV | 状態 |
|---|---|---|---|---|---|---|---|
| jenkins | 2.585 | 2026-10-06 | 279 | 19 | 65 | 4 | ⚠️要確認 |
| caddy | 2.11.7 | 2026-10-03 | 20 | 5 | 7 | 1 | ⚠️要確認 |
| mediawiki (1.46) | 1.46.1 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.45) | 1.45.5 | 2026-10-02 | 416 | 20 | 75 | 0 | ⚠️要確認 |
| mediawiki (1.43) | 1.43.10 | 2026-10-02 | 409 | 20 | 75 | 0 | ⚠️要確認 |
| ubuntu (24.04) | 24.04.5 | 2026-09-30 | 3114 | 268 | 1177 | 40 | ⚠️要確認 |
非主要製品の更新: 0件（OS ディストリや Alpine 派生など。要対応度は低い）
🔴 ★★★ 要対応 CVE
本日の要対応該当なし
| CVE ID | 製品 | CVSS | KEV | AV | 推奨アクション |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
※ 期間中に新しく KEV に追加された CVE は 3 件ありますが、いずれも is_major_product=false のため ★★★ には入れていません。
🟠 ★★ 参考 CVE
展開して表示 (3件)
zammad ユーザー権限での RCE につながる可能性があります。CVE-2026-102490 と組み合わせて悪用される可能性があります。Zammad は PRODUCTS 辞書に登録されていないため影響は低いとみられますが、OSS のヘルプデスクとして部署単位で導入されている（シャドー IT）可能性は残ります。zammad ユーザーが root に昇格できる可能性があります。102489 と組み合わせると「リモートから RCE → root 奪取」まで到達する可能性があり、2 件とも KEV に入っています。使っていなければ影響はありませんが、使っている場合は優先度が大きく上がるため、Zammad の公式セキュリティアドバイザリで修正版を確認してください。📝 AI 全体サマリ
展開して読む
- 期間中（2026-10-01〜10-07）に KEV へ新しく追加されたのは、エンタープライズ製のネットワーク機器（Cisco SD-WAN）と OSS のヘルプデスク（Zammad）でした。自社の主要製品に直接当たるものはありませんでした。
- 主要ソフトでは jenkins / caddy / mediawiki / ubuntu の定期更新が出ています。CVE 件数の多くは過去分の累積とみられますが、Critical か KEV が 1 件以上あるため、表上はすべて「⚠️要確認」になっています。
- Jenkins (2.585): 累計で KEV 該当が 4 件あります。上位には CVE-2024-23897（CLI 経由で任意のファイルを読める問題）や CVE-2017-1000353 が含まれます。自社の Jenkins が古いまま残っていないか、バージョンと公開範囲（インターネットに出ていないか）を確認することを推奨します。
- Caddy (2.11.7): KEV 該当が 1 件あり、上位に 2026 年採番の Critical（CVE-2026-27590 / 9.8、CVE-2026-27587 / 9.1）があります。運用中の Caddy が修正版より古い可能性があるため、公式リリースノートで修正対象を確認したうえで、計画的な更新を検討してください。
- MediaWiki 1.43 系: still_vulnerable: 7 となっており、最新の 1.43.10 でも未修正の CVE が残っている可能性があります。1.43 系を使っている場合は、未修正 CVE の内容と回避策を公式アドバイザリで確認してください。また、1.45 系は EOL が 2026-12-31 で近いため、1.46 系への移行計画を立てておくことを推奨します。
- Ubuntu 24.04.5: ポイントリリースです。数字は累計の統計なので、通常の apt 更新を続けていれば特別な対応は不要とみられます。
- Zammad の連鎖: CVE-2026-102489 と CVE-2026-102490 は、組み合わせると「リモートから RCE → root 奪取」まで到達する可能性があります。社内で使われていないかを資産台帳などで一度確認しておくと安全です。
- 自社で Zammad が見つかった場合に限り、修正前と修正後の挙動を比べる検証環境を作ることを推奨します。公式の zammad-docker-compose リポジトリ（GitHub）を使い、バージョンだけを固定する方法が簡単です。
```yaml
# 骨子のみ。正確なイメージ名・環境変数は公式リポジトリで確認してください
# 公式 zammad-docker-compose を clone し、.env でバージョンを固定する
# IMAGE_REPO=ghcr.io/zammad/zammad
# VERSION=<脆弱とされる版> # 比較用に修正版でも同じ構成を用意する
# 外部に出ない隔離ネットワークで起動する
networks:
default:
internal: true
```
- Caddy の更新前後で問題が出ないかを確認する場合の、最小構成の例です。
```yaml
services:
caddy-old:
image: caddy:<現行運用バージョン>
volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro"]
ports: ["8080:80"]
caddy-new:
image: caddy:2.11.7
volumes: ["./Caddyfile:/etc/caddy/Caddyfile:ro"]
ports: ["8081:80"]
```
本番と同じ Caddyfile で両方を起動し、レスポンスや設定の互換性を比べてください。脆弱性そのものの再現は、公式アドバイザリに書かれた条件の範囲に留めてください。
原本データ (JSON) — 表示するにはクリック
{
"range": {
"from": "2026-10-01",
"to": "2026-10-07",
"days": 7
},
"summary": {
"total_kev_new": 3,
"total_software_update": 6,
"by_date": {
"2026-10-07": {
"kev_new": 0,
"software_update": 1
},
"2026-10-04": {
"kev_new": 0,
"software_update": 1
},
"2026-10-03": {
"kev_new": 2,
"software_update": 3
},
"2026-10-01": {
"kev_new": 1,
"software_update": 1
}
}
},
"kev_new": [
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102489",
"cve_id": "CVE-2026-102489",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Session Fixation Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.",
"epss_score": 0.00582
},
{
"digest_date": "2026-10-03",
"key": "CVE-2026-102490",
"cve_id": "CVE-2026-102490",
"vendor_project": "Zammad GmbH",
"product": "Zammad",
"vulnerability_name": "Zammad GmbH Zammad Improper Privilege Management Vulnerability",
"date_added": "2026-10-02",
"short_description": "Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-05",
"known_ransomware": "Unknown",
"cvss_score": null,
"cvss_severity": null,
"cvss_vector": null,
"attack_vector": null,
"is_remote": null,
"is_major_product": false,
"matched_product": null,
"title_en": "All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.",
"epss_score": 0.00262
},
{
"digest_date": "2026-10-01",
"key": "CVE-2026-76504",
"cve_id": "CVE-2026-76504",
"vendor_project": "Cisco",
"product": "Catalyst SD-WAN Manager",
"vulnerability_name": "Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability",
"date_added": "2026-09-30",
"short_description": "Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request.",
"required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"due_date": "2026-10-03",
"known_ransomware": "Unknown",
"cvss_score": 9.8,
"cvss_severity": "CRITICAL",
"cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attack_vector": "N",
"is_remote": true,
"is_major_product": false,
"matched_product": null,
"title_en": "A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.\r\n\r\nThis vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request t",
"epss_score": null
}
],
"software_update": [
{
"digest_date": "2026-10-07",
"key": "jenkins:2",
"product": "jenkins",
"category": "devops",
"cycle": "2",
"latest": "2.585",
"release_date": "2016-04-20",
"latest_release_date": "2026-10-06",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 279,
"critical": 19,
"high": 65,
"medium": 181,
"low": 14,
"kev": 4,
"top_cves": [
{
"cve_id": "CVE-2017-1000353",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2016-0791",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2024-23897",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-04",
"key": "caddy:2",
"product": "caddy",
"category": "webserver",
"cycle": "2",
"latest": "2.11.7",
"release_date": "2020-05-04",
"latest_release_date": "2026-10-03",
"eol_date": "false",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 20,
"critical": 5,
"high": 7,
"medium": 7,
"low": 1,
"kev": 1,
"top_cves": [
{
"cve_id": "CVE-2026-27590",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2018-21246",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-27587",
"severity": "CRITICAL",
"score": 9.1
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.43",
"product": "mediawiki",
"category": "cms",
"cycle": "1.43",
"latest": "1.43.10",
"release_date": "2024-12-21",
"latest_release_date": "2026-10-02",
"eol_date": "2027-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 409,
"critical": 20,
"high": 75,
"medium": 301,
"low": 13,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2026-58025",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2021-36128",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 7
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.45",
"product": "mediawiki",
"category": "cms",
"cycle": "1.45",
"latest": "1.45.5",
"release_date": "2025-12-04",
"latest_release_date": "2026-10-02",
"eol_date": "2026-12-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2014-9487",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2015-8009",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2017-0372",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-03",
"key": "mediawiki:1.46",
"product": "mediawiki",
"category": "cms",
"cycle": "1.46",
"latest": "1.46.1",
"release_date": "2026-06-30",
"latest_release_date": "2026-10-02",
"eol_date": "2027-07-31",
"support_date": null,
"is_major_product": true,
"cve_stats": {
"total": 416,
"critical": 20,
"high": 75,
"medium": 307,
"low": 14,
"kev": 0,
"top_cves": [
{
"cve_id": "CVE-2021-31556",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2022-29904",
"severity": "CRITICAL",
"score": 9.8
},
{
"cve_id": "CVE-2020-10534",
"severity": "CRITICAL",
"score": 9.8
}
],
"still_vulnerable": 0
}
},
{
"digest_date": "2026-10-01",
"key": "ubuntu:24.04",
"product": "ubuntu",
"category": "os",
"cycle": "24.04",
"latest": "24.04.5",
"release_date": "2024-04-25",
"latest_release_date": "2026-09-30",
"eol_date": "2029-05-31",
"support_date": "2029-05-31",
"is_major_product": true,
"cve_stats": {
"total": 3114,
"critical": 268,
"high": 1177,
"medium": 1482,
"low": 187,
"kev": 40,
"top_cves": [
{
"cve_id": "CVE-2014-0474",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2013-0767",
"severity": "HIGH",
"score": 10.0
},
{
"cve_id": "CVE-2018-18505",
"severity": "CRITICAL",
"score": 10.0
}
],
"still_vulnerable": 0
}
}
]
}