2026年10月31日の
セキュリティ情報

Subject: [Urgent] Ivanti Connect Secure Vulnerability Chain (CVE-2026-111357 et al.)

Dear Team,

We are sharing critical information regarding a vulnerability chain in Ivanti Connect Secure (ICS).

■ Overview
An exploit chain involving three vulnerabilities (CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935) allows unauthenticated attackers to gain root access. These have been added to CISA's KEV catalog as they are being actively exploited in the wild by threat actor UTA0576.

■ Scope
- Ivanti Connect Secure (ICS)

■ Action Plan
1. Verify the current version of Ivanti Connect Secure in our environment.
2. Apply the latest security patches provided by the vendor immediately.
3. Review system logs for any signs of unauthorized access or privilege escalation.

■ Reference
- CISA Known Exploited Vulnerabilities (KEV) Catalog
- Ivanti Official Security Advisory

Priority: High
Deadline: Immediate

Subject: [Intel] AI-Driven Attack Campaign using ARTEX Framework

Dear Team,

We are sharing intelligence regarding a high-speed attack campaign by the China-backed threat group Vapor Panda.

■ Overview
Vapor Panda is utilizing ARTEX, an automated agentic AI penetration testing framework integrated with DeepSeek. This allows the actor to pursue multiple attack paths concurrently with extreme speed (requests every 10 seconds), resulting in the compromise of ~140 sensitive targets within 11 days.

■ Scope
- Government agencies, Defense, Intelligence, and critical sectors (Semiconductors, Pharma, Finance, Telecom).

■ Recommended Actions
1. Monitor logs for high-frequency reconnaissance patterns and anomalous authentication attempts on external-facing assets.
2. Enforce and audit Multi-Factor Authentication (MFA) for all privileged accounts.
3. Increase the frequency of vulnerability scanning and accelerate patching for perimeter devices.

■ Reference
- CrowdStrike Threat Report

Priority: High
Deadline: Immediate review

Subject: [Security Alert] Caution Regarding Suspicious ChatGPT Shared Links

Dear Employees,

A vulnerability was reported in ChatGPT where opening a malicious shared link could allow an attacker to read your private conversations.

While OpenAI has already patched this issue, please remain vigilant and follow these guidelines:

Requested Actions:
1. Do not click on ChatGPT shared links from unknown or untrusted sources.
2. Immediately close the page if you encounter suspicious behavior after clicking a link.

Deadline: Immediate

Subject: [Security Alert] Drupal Commerce Core CVE-2026-118539 Remediation

Dear IT/Security Team,

We are sharing information regarding a critical vulnerability in Drupal Commerce Core.

■ Overview
A critical authorization flaw (CVE-2026-118539) has been identified in the Drupal Commerce Core module. Due to missing authorization checks, attackers can perform forceful browsing to bypass access controls, which may lead to financial loss for the vendor. This vulnerability is currently being exploited in the wild.

■ Affected Scope
- Drupal Commerce Core versions 0.0.0 through 2.41

■ Remediation Steps
1. Verify if Drupal Commerce Core is deployed within the environment.
2. Immediately update the module to the latest patched version.

■ Reference
- Official Drupal Security Advisory

Priority: High
Deadline: Immediate

Subject: [Urgent] Remediation for GitLab and Cisco Vulnerabilities (CVE-2026-97229 / CVE-2026-76418)

Hi team,

This is a notification regarding the addition of GitLab and Cisco vulnerabilities to the CISA KEV catalog.

■ Overview
CISA has added CVE-2026-97229 (GitLab) and CVE-2026-76418 (Cisco) to the Known Exploited Vulnerabilities catalog. The GitLab flaw is particularly critical (CVSS 10.0), allowing unauthenticated remote code execution via integer overflow in CI/CD configurations.

■ Affected Scope
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- Cisco Secure Firewall ASA Software and Cisco Secure FTD Software

■ Action Plan
1. Identify all instances of GitLab and Cisco Secure Firewall in the environment.
2. Apply the latest security updates and patches provided by the vendors immediately.

■ Reference
- CISA KEV Catalog
- Official Vendor Advisories

Priority: High
Deadline: Immediate