2026年5月20日の
セキュリティ情報

Subject: [Technical Alert] Microsoft Vulnerabilities (CVE-2026-41091, CVE-2026-45498)

Dear Team,

This is a technical notification regarding security vulnerabilities in several Microsoft products.

■ Overview
Multiple vulnerabilities, including Elevation of Privilege and Remote Code Execution (RCE), have been identified in Microsoft Azure Local, Azure Resource Manager, Windows Admin Center, and Microsoft Defender. Notably, CVE-2026-41091 and CVE-2026-45498 have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation.

■ Affected Scope
- Microsoft Azure Local
- Microsoft Azure Resource Manager
- Microsoft Azure Portal
- Windows Admin Center
- Microsoft Bitlocker
- Microsoft Malware Protection Engine (versions prior to 1.1.26040.8)
- Microsoft Defender (versions prior to 4.18.26040.7)

■ Remediation Steps
1. Review and apply the latest security updates for the affected products.
2. Verify that Microsoft Defender and Malware Protection Engine are updated to the latest versions.
3. Prioritize patching for CVE-2026-41091 and CVE-2026-45498 due to their KEV status.

■ Reference
- Microsoft Security Advisory (AV26-489)
- CISA KEV Catalog

Priority: High
Deadline: Immediate

Subject: [Intel] Acceleration of Vulnerability Weaponization via AI (Claude Mythos Preview)

Dear Team,

We are sharing critical intelligence regarding the acceleration of cyber-weaponization using AI.

■ Overview
It has been reported that Anthropic's 'Claude Mythos Preview' can autonomously construct N-day exploit chains within 24 hours of a patch release. Furthermore, a security startup (Calif) successfully bypassed Apple M5 chip Memory Integrity Enforcement (MIE) in just five days using this model. This represents a 'step change' where the window between patch release and weaponization has shrunk significantly.

■ Scope
- All systems relying on OS kernels, network protocol stacks, and memory protection mechanisms.
- Specifically, devices equipped with Apple M5 chips.

■ Recommended Actions
1. Review and optimize the automation of the vulnerability management lifecycle to minimize the time-to-patch.
2. Redefine patch prioritization for critical assets to counter rapid AI-driven weaponization.
3. Enhance detection and response capabilities to handle high-velocity AI attacks.

■ Reference
- Anthropic Claude Mythos Preview Security Evaluation Report

Priority: High
Deadline: Ongoing process improvement

Subject: [Info] Credential Leakage Incident at CISA via Public GitHub

Dear Team,

We are sharing details regarding a recent security incident involving the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

■ Overview
Sensitive data, including AWS tokens, plaintext passwords, and SAML certificates (approx. 844MB), were exposed on a public GitHub repository for about six months. The leak included CI/CD logs and Terraform files, revealing detailed internal infrastructure configurations.

■ Scope
- CISA internal infrastructure and cloud environments

■ Recommended Actions
1. Perform secret scanning on all company-managed repositories (GitHub, GitLab, etc.) to ensure no credentials are hardcoded.
2. Enforce the use of secret management services (e.g., AWS Secrets Manager) and prohibit plaintext password storage in configuration files.
3. Review the visibility settings of repositories managed by third-party vendors or partners.

■ Reference
- GitGuardian Report

Priority: Medium
Deadline: Next scheduled audit

Subject: [Security Advisory] NGINX JavaScript (njs) CVE-2026-8711

Dear team,

This is a notification regarding a critical vulnerability identified in NGINX JavaScript (njs).

■ Overview
A critical vulnerability (CVE-2026-8711) has been discovered in the ngx_http_js_module of NGINX JavaScript (njs). Please refer to the vendor advisory for detailed technical impact.

■ Affected Scope
- NGINX JavaScript (njs) versions 0.9.4 to 0.9.8

■ Remediation Steps
1. Verify the current version of njs in use.
2. Update to the latest patched version provided by F5.

■ Reference
- F5 Security Advisory (K000161307)

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Cisco Secure Workload Unauthorized API Access Vulnerability

Dear IT/Security Team,

This is a notification regarding a vulnerability in Cisco Secure Workload.

■ Overview
Cisco has identified a vulnerability that could allow unauthorized API access to Cisco Secure Workload. This could potentially lead to unauthorized configuration changes or data access.

■ Affected Scope
- Cisco Secure Workload version 3.9 and prior
- Cisco Secure Workload versions prior to 3.10.8.3
- Cisco Secure Workload versions prior to 4.0.3.17

■ Remediation Steps
1. Verify the current version of Cisco Secure Workload in your environment.
2. If an affected version is in use, upgrade to the latest patched version immediately.

■ Reference
- Cisco Security Advisories (AV26-491)

Priority: High
Deadline: Immediate