2026年6月3日の
セキュリティ情報

Subject: [Security Advisory] Cisco Unified Communications Manager SSRF Vulnerability (CVE-2026-20230)

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Cisco products.

■ Overview
A Server-Side Request Forgery (SSRF) vulnerability has been identified in Cisco Unified Communications Manager (CM) and Session Management Edition (CM SME). As proof-of-concept (PoC) exploit code for CVE-2026-20230 is available, there is a heightened risk of exploitation.

■ Affected Scope
- Cisco Unified Communications Manager (CM) Release 14 (versions prior to 14SU6)
- Cisco Unified Communications Manager (CM) Release 15 (versions prior to 15SU5)
- Cisco Unified Communications Manager Session Management Edition (CM SME) release 14 (versions prior to 14SU6)
- Cisco Unified Communications Manager Session Management Edition (CM SME) release 15 (versions prior to 15SU5)

■ Action Plan
1. Verify the current version of CM / CM SME deployed in the environment.
2. If affected, apply the necessary updates to the fixed versions (14SU6 / 15SU5 or later) as per the Cisco advisory.

■ Reference
- Cisco Security Advisories (AV26-547)

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Livewire CVE-2025-54068 Remediation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in the Livewire framework.

■ Overview
A Remote Code Execution (RCE) vulnerability (CVE-2025-54068) has been identified in Livewire, a full-stack framework for Laravel. This vulnerability has a CVSS v3.1 score of 9.8 and is currently being exploited in the wild. It allows an unauthenticated remote attacker to execute arbitrary code due to improper state management during the hydration phase.

■ Affected Scope
- Livewire 3.x (versions prior to 3.6.4)

■ Remediation Steps
1. Verify the current version of Livewire used in your environments.
2. If an affected version is found, immediately update to Livewire version 3.6.4 or later.

■ Reference
- CSIRT-ITA Alert AL01/260603/CSIRT-ITA

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Mitigation for HTTP/2 Bomb Vulnerability in Major Web Servers

Dear IT/Security Team,

We are sharing information regarding a remote Denial-of-Service (DoS) vulnerability codenamed 'HTTP/2 Bomb'.

■ Overview
This vulnerability targets the HPACK header compression scheme used in HTTP/2. By combining a compression bomb with a zero-byte flow-control window, an attacker can force the server to allocate significant memory without releasing it, leading to resource exhaustion and service unavailability.

■ Affected Products
- NGINX
- Apache HTTPD
- Microsoft IIS
- Envoy
- Cloudflare Pingora

■ Mitigation Steps
1. Identify the versions of web servers currently in use and apply the latest security patches provided by the vendors.
2. Review HTTP/2 configurations, specifically focusing on header size limits and timeout settings to mitigate resource exhaustion.

■ Reference
- Please refer to the official security advisories from the respective vendors.

Priority: High
Deadline: Immediate

Subject: [Security Alert] Security Risk when using GitHub Web Editor

Hi everyone,
It has been reported that clicking a malicious link while using the web-based version of VS Code (github.dev) could allow an attacker to steal your GitHub access tokens.

What we need you to do:
1. Do not click on suspicious links or install VS Code extensions from untrusted sources.
2. Be cautious when using web-based code editors and ensure you are in a trusted environment.

Deadline: Immediate

Subject: [Security Advisory] Mitigation for HTTP/2 Bomb DoS Vulnerability

Dear IT/Security Team,

We are sharing information regarding a new DoS exploit dubbed 'HTTP/2 Bomb'.

■ Overview
This exploit chains an HPACK compression bomb (CVE-2016-6581) with a Slowloris-style hold to exhaust server memory rapidly. It can render a web server unavailable within seconds, even from a low-bandwidth connection.

■ Affected Scope
Web servers supporting HTTP/2 with default configurations of:
- NGINX
- Apache HTTPD
- Microsoft IIS
- Envoy
- Cloudflare Pingora

■ Mitigation Steps
1. Review and harden HTTP/2 header compression settings and resource limits (e.g., max header size).
2. Implement DoS protection rules on WAFs or Load Balancers to detect and block anomalous HTTP/2 traffic.
3. Ensure all web server software is updated to the latest stable versions.

■ Reference
- CVE-2016-6581

Priority: High
Deadline: Immediate review and configuration audit recommended.