2026年10月30日の
セキュリティ情報

Subject: [Security Advisory] Vulnerabilities in Dell PowerProtect Data Domain and Related Products

Dear IT Administration Team,

We are sharing information regarding multiple vulnerabilities identified in Dell storage products.

■ Overview
Several vulnerabilities have been detected in Dell's Data Domain-based storage solutions, including 7 critical and 18 high-severity flaws. These could potentially allow Remote Code Execution (RCE), Authentication Bypass, and Elevation of Privilege.

■ Affected Products
- Dell PowerProtect Data Domain
- Data Domain Virtual Edition
- Dell APEX Protection Storage

■ Remediation Steps
1. Identify if the aforementioned products are deployed within the environment and check their current versions.
2. Apply the latest security updates as specified in the official Dell security bulletins.

■ Reference
- Dell Technologies Security Advisory

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Linux Kernel CVE-2026-98432 Remote Root RCE

Dear IT/Security Team,

We are sharing critical information regarding a vulnerability in the Linux kernel.

■ Overview
CVE-2026-98432 is a Use-After-Free vulnerability caused by a race condition in IPv4 TCP connection handling. It allows a remote attacker to execute arbitrary commands with root privileges on systems with Multipath TCP (MPTCP) enabled. The vulnerability has a CVSS 3.0 score of up to 9.8, and a proof-of-concept bypassing KASLR has been demonstrated by Anthropic.

■ Affected Scope
- Linux Kernel 4.4 and later (where MPTCP listening services are active).
- Various distributions including Ubuntu, Debian, Red Hat, Amazon Linux, Oracle Linux, and SUSE (patch status varies).

■ Remediation Steps
1. Identify servers running Linux with MPTCP enabled.
2. Apply the latest kernel security updates provided by your OS vendor and reboot the systems.
3. Monitor vendor advisories closely, as some distributions (e.g., Ubuntu, Amazon Linux 2) are still in the process of releasing patches.

■ Reference
- Linux Kernel CVE Team / Anthropic Research

Priority: High
Deadline: Immediate

Subject: [Security Alert] Attack Campaign Leveraging AI Framework 'ARTEX'

Dear IT/Security Team,

We are sharing information regarding a campaign by the threat actor Storm-0940.

■ Overview
Storm-0940 is utilizing the open-source AI penetration testing framework 'ARTEX' to conduct large-scale attacks. By leveraging stolen ConnectWise credentials, the actor has been able to gain high-level cloud permissions in as little as three hours.

■ Scope
- Organizations utilizing ConnectWise products
- Cloud environments exposed to automated AI attack tools

■ Recommended Actions
1. Audit and rotate credentials for ConnectWise and other privileged management tools; ensure MFA is strictly enforced.
2. Monitor cloud audit logs for unauthorized privilege escalation or suspicious API calls originating from AI agents.
3. Review the security posture of third-party service providers to mitigate supply chain risks.

■ Reference
- Microsoft Threat Intelligence

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Remediation for GitLab and Cisco Secure Firewall Vulnerabilities (CISA KEV)

Dear IT/Security Team,

CISA has added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.

■ Overview
- CVE-2026-97229: Integer Overflow or Wraparound vulnerability in GitLab Community and Enterprise Editions.
- CVE-2026-76418: Unchecked Return Value to NULL Pointer Dereference Vulnerability in Cisco Secure Firewall ASA and FTD Software.

■ Affected Products
- GitLab Community Edition / Enterprise Edition
- Cisco Secure Firewall ASA Software / Cisco Secure FTD Software

■ Action Plan
1. Identify if the affected products and versions are deployed within the environment.
2. Apply the latest security updates provided by the respective vendors immediately.

■ Reference
- CISA KEV Catalog

Priority: High
Deadline: Immediate

Subject: [Security Advisory] Exploitation of VMware CVE-2026-41709

Dear IT Administration Team,

We are sharing information regarding the active exploitation of CVE-2026-41709 in VMware products.

■ Overview
A vulnerability categorized as "Insufficient logging" (CVSS v3.1: 2.7) has been detected in VMware ESX and related platforms. This flaw allows an attacker with administrative privileges to execute specific operations without generating audit logs, effectively bypassing monitoring controls.

■ Affected Products
- VMware ESX
- VMware Cloud Foundation
- VMware vSphere Foundation
- VMware Telco Cloud Platform

■ Mitigation Steps
1. Verify the current version of your VMware environment.
2. Apply the security patches released in July 2026 to update to the latest version.

■ Reference
- Please refer to the official VMware security advisory.

Priority: Medium
Deadline: Immediate