2026年5月27日の
セキュリティ情報

Subject: [Security Advisory] Windows Kernel LPE Vulnerability (CVE-2026-40369)

Dear IT/Security Team,

We are sharing information regarding a local privilege escalation (LPE) vulnerability in the Windows kernel.

■ Overview
A vulnerability in the nt!ExpGetProcessInformation component allows an attacker to gain SYSTEM privileges via an untrusted pointer dereference. Since a full PoC is available on GitHub and the flaw enables browser sandbox escapes, the risk of exploitation is significant.

■ Affected Scope
- Windows 11 versions 24H2 through 25H2

■ Mitigation Steps
1. Apply the official security updates released in the May Patch Tuesday cycle.
2. Verify the patch status across all endpoints using centralized management tools.

■ Reference
- Microsoft Security Update Guide / CVE-2026-40369

Priority: High
Deadline: Immediate

Subject: [Security Alert] Malicious npm Package 'mouse5212-super-formatter' targeting Claude AI

Dear IT/Security Team,

We are sharing information regarding a supply chain attack involving a malicious npm package designed to exfiltrate data from Claude AI environments.

■ Overview
The package 'mouse5212-super-formatter' (codenamed Malware-Slop) masquerades as a sync utility. Upon installation, it targets the '/mnt/user-data' directory used by Anthropic's Claude AI and uploads files to a remote GitHub repository using stolen or hard-coded tokens.

■ Scope
- Affected Package: mouse5212-super-formatter
- Target: Environments utilizing Claude AI with the aforementioned directory structure.

■ Action Items
1. Audit all development environments and CI/CD pipelines for the presence of the 'mouse5212-super-formatter' package.
2. Review package-lock.json or yarn.lock files for unauthorized dependencies.
3. Review and rotate GitHub access tokens stored in environment variables to ensure the principle of least privilege.

■ Reference
- OX Security Threat Intelligence

Priority: High
Deadline: Immediate

Subject: [Urgent] Remediation for KnowledgeDeliver LMS CVE-2026-5426

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in KnowledgeDeliver LMS.

■ Overview
CVE-2026-5426 is a critical vulnerability caused by shared hard-coded ASP.NET/IIS machineKeys, allowing unauthenticated ViewState deserialization and subsequent Remote Code Execution (RCE). This is being exploited in the wild to deploy Godzilla (BLUEBEAM) web shells and distribute Cobalt Strike Beacons.

■ Scope
- Product: KnowledgeDeliver LMS
- Specifically installations deployed before February 24, 2026.

■ Remediation Steps
1. Update KnowledgeDeliver LMS to the latest patched version immediately.
2. Ensure that the machineKey in the web.config file is changed from the default to a unique, secure value.
3. Audit the IIS worker process for unauthorized shells and check application JavaScript files for unauthorized modifications.

■ Reference
- ThaiCERT Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Veeam Product Vulnerabilities (CVE-2026-32998 et al.)

Dear IT Administration Team,

This is a notification regarding critical security vulnerabilities identified in Veeam products.

■ Overview
Three vulnerabilities have been disclosed in Veeam's management console and backup solutions. These flaws could allow Remote Code Execution (RCE), arbitrary file writes, and privilege escalation, with one rated as 'Critical'.

■ Affected Scope
- Veeam Service Provider Console 9.x (versions prior to 9.2.0.33215)
- Veeam Backup & Replication 13.x (versions prior to 13.0.1.2067)

■ Mitigation Steps
1. Verify the current version of Veeam products deployed in the environment.
2. If an affected version is in use, immediately apply the latest security updates provided by the vendor.

■ Reference
- Veeam Official Security Bulletins

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Linux Kernel LPE Vulnerabilities (CVE-2026-43284 / CVE-2026-43500)

Dear IT Administration Team,

We are sharing critical information regarding a local privilege escalation (LPE) vulnerability in the Linux kernel.

■ Overview
An exploit named "Kukurigu" has been released. By chaining CVE-2026-43284 (xfrm-ESP) and CVE-2026-43500 (RxRPC), an unprivileged local attacker can bypass filesystem write protections via page-cache corruption to gain root privileges.

■ Scope
- Affected Product: Linux Kernel (All major distributions)

■ Mitigation Steps
1. Identify all Linux servers and endpoints currently in use.
2. Apply the latest security patches provided by your distribution vendor and reboot the systems.
3. Review and disable unnecessary kernel modules (e.g., RxRPC) where applicable.

■ Reference
- Exploit-DB EDB-ID: 52585

Priority: High
Deadline: Immediate