2026年8月24日の
セキュリティ情報

Subject: [Security Advisory] Spring Application Framework Vulnerability Patching

Dear IT/Security Team,

Broadcom has announced updates patching 91 vulnerabilities in the Spring application framework.

■ Overview
One critical vulnerability (CVE-2026-59270) affects the embedded UnboundID LDAP server in Spring Security, potentially allowing unauthorized authentication and modification of directory entries. Additionally, multiple high-severity flaws enabling RCE, XSS, and DoS have been addressed.

■ Scope
- Spring Application Framework / Spring Security
- Specifically environments utilizing the embedded UnboundID LDAP server

■ Action Plan
1. Identify all applications utilizing the affected Spring Framework/Security versions.
2. Update to the latest patched versions provided by Broadcom.

■ Reference
- Official Broadcom/Spring Security Advisories

Priority: High
Deadline: Immediate

Subject: [Security Alert] Phishing Emails Spoofing Government Domains (gov.tw)

Dear employees,
It has been reported that attackers are abusing government website features to send phishing emails using the trusted gov.tw domain. These emails often claim there are outstanding payments or fines to trick users into clicking malicious links.

Requested Actions:
1. Be cautious of emails from government domains that contain unexpected requests for payment or suspicious links.
2. Do not enter personal information or passwords on websites linked from such emails.
3. Report any suspicious emails to the IT security team immediately.

Deadline: Immediate

Subject: [Security Advisory] Rapid7 Velociraptor CVE-2026-19200

Dear IT/Security Team,

We are sharing information regarding a vulnerability found in Rapid7 Velociraptor.

■ Overview
CVE-2026-19200 is a high-severity vulnerability in Velociraptor that could allow an attacker to perform unauthorized modification of data or code (Tampering).

■ Scope
- Product: Rapid7 Velociraptor
- Affected Versions: Prior to 0.77.2

■ Mitigation Steps
1. Verify the current version of Velociraptor in your environment.
2. Update to version 0.77.2 or later immediately if you are running an affected version.

■ Reference
- Vendor Advisory: https://www.rapid7.com/db/vulnerabilities/cve-2026-19200/

Priority: High
Deadline: Immediate

Subject: [Security Advisory] SPIP Vulnerability Mitigation

Dear IT/Security Team,

We are sharing critical vulnerability information regarding the SPIP CMS.

■ Overview
Multiple vulnerabilities have been identified in SPIP that could allow Remote Code Execution (RCE), SQL Injection (SQLi), and Server-Side Request Forgery (SSRF).

■ Scope
- Product: SPIP
- Affected Versions: Prior to 4.4.18

■ Mitigation Steps
1. Verify the current version of SPIP installed in your environment.
2. If the version is older than 4.4.18, immediately update to version 4.4.18 or later.

■ Reference
- Official SPIP Security Bulletin: https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-18.html

Priority: High
Deadline: Immediate

Subject: [Action Required] Please Update Your OS and Browser

Hi everyone,
Security vulnerabilities have been reported in several widely used software products, including macOS and Google Chrome.

What we need you to do:
1. Please check for and install any available OS updates (e.g., macOS) on your company device.
2. If your browser (e.g., Chrome) prompts you for an update, please restart it to apply the latest version.

Deadline: By the end of this week