2026年6月12日の
セキュリティ情報

Subject: [Technical Alert] BitLocker Bypass Vulnerability (GreatXML)

Dear IT Security Team,

We are sharing information regarding a vulnerability named 'GreatXML' that affects Windows Recovery Mode.

■ Overview
GreatXML allows an attacker with physical access to bypass BitLocker protection and execute a command shell with SYSTEM privileges by exploiting the way WinRE processes XML files and artifacts left by Windows Defender Offline Scan.

■ Scope
- Windows OS environments utilizing Windows Defender Offline Scan.
- Scenarios where physical access to the hardware is possible.

■ Recommended Actions
1. Enforce strict physical security controls for endpoints.
2. Monitor for official Microsoft security updates and patches.
3. Review recovery partition security configurations.

■ Reference
- thaicert advisory

Priority: Medium
Deadline: Upon patch release

Subject: [Urgent] Oracle PeopleSoft Enterprise PeopleTools CVE-2026-35273 Mitigation

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in Oracle PeopleSoft Enterprise PeopleTools.

■ Overview
A critical vulnerability (CVE-2026-35273) in the Updates Environment Management component allows unauthenticated attackers to perform remote code execution (RCE) via HTTP. The CVSS v3.1 score is 9.8, and active exploitation has been reported.

■ Affected Scope
- Oracle PeopleSoft Enterprise PeopleTools (Updates Environment Management component)

■ Action Plan
1. Verify the presence and version of PeopleSoft Enterprise PeopleTools in our environment.
2. Immediately apply the security updates released by Oracle.

■ Reference
- Oracle Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Alert] Stay Vigilant Against Phishing Attacks

Dear employees,

We would like to inform you that a major global phishing platform has recently been taken down by international law enforcement. While this is positive news, it often leads to a shift in attacker tactics or the misuse of previously stolen data.

What we need from you:
1. Do not click on links or open attachments from unknown or suspicious senders.
2. If you encounter a suspicious page asking for your password, close the browser immediately and report it to the IT security team.

Deadline: Immediate (Please review and stay alert)

Subject: [Info] Breach of US Water Utility by Threat Actor Handala

Dear Team,

We are sharing information regarding a recent attack on California Water Service by the Iran-linked actor Handala.

■ Overview
It is analyzed that the attackers compromised an RTKBase (GNSS base station platform) instance and laterally moved to a customer billing system to exfiltrate approximately 5GB of data.

■ Scope
- Environments utilizing RTKBase or similar GNSS base station platforms.
- Environments where ICS/OT networks are not properly segmented from corporate IT networks.

■ Recommended Actions
1. Review access logs for any externally facing industrial platforms (e.g., RTKBase) for unauthorized access.
2. Ensure that Multi-Factor Authentication (MFA) is enforced for all administrative interfaces.
3. Verify network segmentation between OT/control systems and corporate billing/business systems to prevent lateral movement.

■ Reference
- SecurityWeek Article

Priority: Medium
Deadline: Next scheduled security review

Subject: [Security Advisory] Microsoft Surface Firmware Vulnerability (Bricking Risk)

Dear IT Administration Team,

We are sharing information regarding a critical firmware vulnerability affecting Microsoft Surface devices.

■ Overview
A flaw has been identified that allows a device to be rendered inoperable (bricked) via a single packet, specifically when Secure Core and Secure Boot are disabled. This vulnerability was inadvertently uncovered through a Python script generated by Microsoft Copilot.

■ Scope
- Affected Products: Microsoft Surface series
- Condition: Devices with Secure Core and Secure Boot disabled

■ Mitigation Steps
1. Ensure all Surface devices in the organization have the latest firmware updates applied.
2. Verify that Secure Core and Secure Boot are enabled across all deployed units to prevent exploitation.

■ Reference
- The Register report

Priority: Medium
Deadline: Next scheduled maintenance window