2026年5月30日の
セキュリティ情報

Subject: [Action Required] Update Notepad++ to the Latest Version

Dear employees,

A security vulnerability has been identified in the Notepad++ text editor that could allow malicious code to be executed on your system.

Please take the following actions:
1. Update Notepad++ to the latest available version immediately.
2. Be cautious when opening unknown files or clicking suspicious links.

Deadline: By the end of this week

件名: 【共有】Notepad++ CVE-2026-48778 対応について

お疲れさまです。Notepad++ の脆弱性に関する情報共有です。

■ 概要
Notepad++ 8.9.6 以前において、config.xml の commandLineInterpreter 設定が検証されずに ShellExecute に渡されるため、任意のコード実行が可能です（CVE-2026-48778）。攻撃者が %APPDATA% への書き込み権限を持つ場合に成立します。

■ 影響範囲
- 対象製品: Notepad++
- 対象バージョン: <= 8.9.6

■ 対応手順
1. 組織内で利用されている Notepad++ のバージョンを確認してください。
2. 脆弱性が修正された最新バージョンへのアップデートを強制適用してください。

■ 参考情報
- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9

対応優先度: 中
対応期限: 速やかに

Subject: [Security Advisory] Notepad++ CVE-2026-48778 Mitigation

Dear IT/Security Team,

We are sharing information regarding a vulnerability in Notepad++.

■ Overview
Notepad++ versions 8.9.6 and below are vulnerable to arbitrary code execution (CVE-2026-48778). The application fails to validate the 'commandLineInterpreter' value in config.xml, allowing an attacker with write access to %APPDATA% to execute arbitrary binaries via the 'Open Containing Folder in cmd' feature.

■ Scope
- Product: Notepad++
- Affected Versions: <= 8.9.6

■ Mitigation Steps
1. Identify all installations of Notepad++ within the environment.
2. Ensure all instances are updated to the latest patched version.

■ Reference
- https://github.com/notepad-plus-plus/notepad-plus-plus/security/advisories/GHSA-7hm3-wp5q-ccv9

Priority: Medium
Deadline: Immediate

Subject: [Security Advisory] SSTI Vulnerability and GetShell Incident in RuoYi Framework

Dear IT Administration Team,

We are sharing information regarding a security incident involving the RuoYi framework.

■ Overview
An attacker successfully achieved Remote Code Execution (RCE) and obtained a shell by exploiting a Server-Side Template Injection (SSTI) vulnerability in the Thymeleaf template engine. The initial entry point was identified as weak administrative credentials.

■ Scope
- Applications built using the RuoYi framework.
- Specifically, Controller implementations where user input is directly reflected in return values or URL paths.

■ Mitigation Steps
1. Verify and change all default administrative passwords to strong, unique passwords.
2. Audit the codebase for instances where user-supplied input is directly returned to the template engine.
3. Ensure that @ResponseBody or @RestController annotations are used for API responses to bypass view resolution.

■ Reference
- FreeBuf: 记一次攻防演练中的若依getshell

Priority: High
Deadline: Immediate review required