AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
SECURITY REVIEW · 2026-10-26 14:56 JST /05:56 UTC
From perimeter devices, backups, certificates, and AI tools to domestic delivery outages and contractor impacts. Organized 18 issues from primary sources, distinguishing new registrations from supplementary responses to existing incidents.
As of: 2026-10-26 14:56 JST /05:56 UTC. Change window: 13:01–14:56 JST.
Actual retrieval began at 15:00 JST. Same-day follow-ups with dates only are reference material.
Additionally cross-check the 4 hotfixes for PAN-OS branch 11.1. For Ahsay, watch for incomplete old fixes and follow through with compromise investigation and clean rebuilding as needed.
Update status and sources →For .NET Brotli, check paths with decompression explicitly enabled. Updating a shared runtime alone is insufficient for NativeAOT; republish and redeploy after updating the SDK and other components.
Actions by deployment method →SoftBank earthquake and tsunami alerts have resumed; national and local government disaster and evacuation information remains suspended. Blastmail also remains suspended with no resumption date; check alternative paths and individual notifications.
Japanese service status →Do not treat all 3 Yoosee issues as remote RCE. NocoDB already has remediation in its development version; also disclose failure to retrieve Zcode's original report and the undetermined minimum fixed version.
Conditions for additional records →Organized by database inclusion/revision and advisory update times. These are not attack start times or counts of newly occurring harm.
13:17:47 JST (NVD inclusion) · Caveats on CNA record and prerequisites
CVE-2026-116113. CNA scope extends through 6.1.2. The researcher report dated 9/28 explicitly requires ordinary employee authentication. The issue concerns extensions after joining and processing in a web-accessible area. Actual exploitation and the minimum fixed version are unconfirmed.
What to checkRestrict multipart upload privileges, post-merge extensions, and code execution in storage areas, and investigate suspicious files.
13:17:54–55 JST (NVD inclusion) · Caveats on CNA records and prerequisites.
CVE-2026-116114–116116. GM8135S 21.00.01.36. Research published 7/20. Distinguish video eavesdropping requiring a running stream and a position such as on the communication path, default SSID connections involving proximity or similar conditions, and local firmware modification. Do not call all of them remote RCE. The minimum fixed version is unconfirmed.
What to checkCheck sensitive installation locations, IoT isolation, outbound communications, and encrypted viewing paths. Ethernet alone does not address every issue.
14:17:54 JST (NVD inclusion) · Disclosure and updates checked
CVE-2026-113345. A local file-permission issue in Ver.4.0.36 and earlier. Already included in the previous report as a 12:00 JVN publication; this is not new harm.
What to checkUpdate existing installations; use the latest installer for new installations.
14:17:54 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
CVE-2026-116117. The CNA covers versions through 2.27.0-beta.1. Official code confirms requested-name resolution into the theme templates area, but all HTTP reachability conditions and RCE have not been demonstrated. The minimum fixed version and actual exploitation remain undetermined.
What to checkCheck features and permissions that process untrusted template names, and track distributor fixes.
14:17:54 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
CVE-2026-116118. The CNA scope extends through 3.14.3/3.15.1. The original report could not be retrieved due to a redirect loop; exploit conditions such as approval settings and the minimum fixed version remain undetermined.
What to checkCheck versions and command auto-execution/approval settings, and restrict processing of untrusted input.
14:17:54 JST (NVD inclusion) · Qualifications on CNA record and exploit conditions
CVE-2026-116119. CNA scope extends through 2026.08.0. Issue deletion was confirmed, but the official commit of 10/15 also implements atomic token consumption. Do not assume all current versions are unpatched. The minimum shipped fixed version and inclusion in distributed builds remain unconfirmed.
What to checkCheck whether the distribution includes remediation code, and review reset and session invalidation logs.
14:45 JST (official CNA JSON update history) · Publication/update confirmed
The ETAs for 11.1.4-h38 / 11.1.6-h40 / 11.1.10-h36 / 11.1.13-h16 were removed and the versions marked released. The CNA JSON says 05:45 UTC, while the same CSAF history says 22:45 UTC the previous day, a 7-hour discrepancy. Do not treat the CSAF generation time as the binary's first availability time.
What to checkCompare running release series with distributed hotfixes and maintain access restrictions on the management Web UI / XML API. Check ETAs for other release series separately.
Vendor product table / Official CNA JSON / Official CSAF and history with timestamp discrepancies
Supplementing conditions, fix/deployment methods, and operational impacts in previously published material. These are not recounted as new compromises during this period.
Created 04:06:12 JST, updated 04:23:38 JST. NVD updated 14:17 · Supplement to existing issues and response scope
Official advisory 494 for CVE-2026-111497 was published before the previous report. ASP.NET Core/HttpClient do not decompress Brotli by default. Exposure requires explicit enablement or direct API processing of untrusted data. Framework is excluded. Updating the shared runtime alone does not replace the NativeAOT decoder.
What to checkCheck 8.0.33/9.0.22/10.0.14 and related versions. Redeploy self-contained applications; for NativeAOT, update the SDK and related tools, then republish and redeploy. Do not enable previously disabled automatic decompression as a mitigation.
13:17:57 JST (NVD revision). First disclosed in June (month 6) · Supplement to existing issues and response scope
CVE-2026-55653/55655 concern FIPS DH-GEX client termination by a malicious SSH server and interception of explicitly enabled X11 forwarding by a local attacker. These affect Red Hat distributions; do not equate them with upstream OpenSSH generally or Tailworm.
What to checkCheck product-specific errata and disable unnecessary X11 forwarding. Align FIPS negotiation settings with the product's cryptographic policy.
Previously published advisories from 10/12–22, times unspecified · Supplement to existing issues and response scope.
9.15.2.59 / 10.3.4.0 do not fully fix CVE-2026-105133 / -105134; 9.15.2.70 / 10.3.4.45 are recommended. The additional hardening text dated 10/22 inconsistently lists 10.3.5.54 and 10.3.4.54. Reports of actual exploitation date from 10/9, not newly occurring now.
What to checkCheck legitimate distributions and release branches in the partner portal. Investigate unknown JSPs, administrators, RPS receivers, and similar artifacts; if compromise is suspected, rebuild cleanly including the OS and restore from pre-compromise configuration.
Official notice of incomplete earlier fixes / Official compromise investigation and recovery steps / Additional hardening and numbering discrepancies
Published 10/22, updated 10/23; device rollout planned for 10/26 · Supplement to existing issues and response scope.
Neat OS 26.5.4 addresses the eMudhra trust store. Phased delivery begins 10/26, with Pulse rollout by organization and non-Pulse OTA targeted for 10/28. Fixes for outbound Pulse / Open cloud communications are separate and expected in about 2 weeks. Actual exploitation is unconfirmed and requires a key and a position on the communication path.
What to checkCheck Neat Pulse's Roadmap and installed device versions, including devices with automatic updates disabled. Consider required webhook credential updates after cloud remediation is complete, and check certificates for your own services.
Official Neat security advisory / 26.5.4 official release notes
Disclosed 10/23; earthquake/tsunami alerts resumed 10/25 09:25 JST. Revision time unconfirmed · Supplement to existing issues and response scope
Among emergency alert email suspensions for PHP remediation, JMA earthquake and tsunami information resumed at 10/25 09:25. National and local government disaster and evacuation information remains suspended. Completion of maintenance on 10/26 is planned; it does not confirm full restoration.
What to checkSoftBank / Y!mobile / LINEMO users should prepare alternative disaster-information channels for suspended disaster and evacuation information and check official resumption notices.
Disclosed 10/21; current guidance updated 10/26 10:00 JST · Supplement to existing issues and response scope
Exfiltration of sales management information for all subscribers and recipient lists and other data for some contracts was confirmed. The latter covers 344 contracts; all 344 have been contacted individually, unchanged from report 12. The management interface, API, and delivery remain suspended, with no resumption date determined. The next report is planned around 17:00. Entry-point details remain under investigation.
What to checkCheck affected information in contract-specific notices, and prepare alternative delivery and inquiry handling. Do not interpret this as leakage for 344 people or all recipients; prepare for fake emails using the leaked information.
Published 10/22, time unspecified · Supplement to existing issues and response scope.
Separately describes up to 13,323 forms from 2021/5–2023/3 and 35 Studio accounts belonging to staff and contracted workers. Possible leakage is under examination; this is not confirmation of actual acquisition or secondary harm. This supplements downstream effects of the previously reported Studio incident, not a new compromise of government systems as a whole.
What to checkCheck the forms, periods, and optional fields you used, and beware of communications impersonating the Digital Agency. Do not add record and account counts together as people.
Official notices on 10/18 and 23; company-provided statement at 10/26 11:50 KST/JST · Supplement to existing issues and response scope.
Smart A 10 concerns unauthorized development-server access using a VPN account and possible leakage of some customer information. After inquiries about vulnerabilities in the Ahsay infrastructure, APO described signs that some encrypted data had been taken. Evidence of key leakage, affected people, and any relationship between the incidents remain undetermined. Do not assign a specific CVE based solely on the company's zero-day wording.
What to checkCheck the services used, individual notifications, and stored data; take preventive two-factor authentication measures and watch for suspicious communications. Do not assert plaintext leakage for all customers or a common cause.
Smart A 10: 10/18 primary notice / APO: 10/23 primary notice / Timestamped statement distributed by the company
This is current content retrieved after the target time. The following information is excluded from confirmed changes before the cutoff.
Only a 10/26 date; publication before 14:56 is unconfirmed · Publication before the cutoff is unconfirmed.
The subsequently retrieved apology describes weak keys caused by a script error, planned RCA publication in CCADB, and review by independent experts. The Middle East/Africa statement says regional customers are unaffected. Midnight 0 metadata may reflect date normalization and is excluded from confirmed changes.
What to checkCheck affected services and certificate chains separately. Do not expand statements about service impact on regional customers into claims that third-party apps need no trust store updates or that fraudulent certificate risks do not exist.
Incident page: 10/26 apology / 10/26 statement for the Middle East and Africa
Only a 10/26 date; publication before 14:56 is unconfirmed · Publication before the cutoff is unconfirmed.
The later-retrieved official apology describes normal operation of current customer services, investigation cooperation, and a dedicated contact, but publication and revision times are unknown. Exclude it from confirmed changes before 14:56; normal operation is not proof that information did not leak.
What to checkCheck the previously published Smart A 10 / APO notices and individual scope guidance; do not reinterpret a same-day apology with an unconfirmed publication time as confirmation of a new leak.
Only a 10/26 date; publication before 14:56 is unconfirmed · Publication before the cutoff is unconfirmed.
Retained in the reference section since the previous report. Describes 1,213 corporate information records, sales and other data for 875 companies, and confirmed external transmission, but personal information counts remain under investigation. Publication time is still unconfirmed. Phased resumption and mandatory password changes across services are plans or guidance, not completed full recovery.
What to checkCheck individual notices and recovery status for affected services. Retain the caveat that the PHP-cause explanation was withdrawn, and do not elevate same-day report 3 to confirmed information available before the target time.
All 8 new NVD records overlap the 11 revised records. GHSA covers only the new-publication window; this does not mean all changes, including revisions to existing information, total 0. KEV is the 2026.10.23 edition with 1,756 entries, identical to the previous original. Inclusion and changes in originals differ from attack start times. Absence from the list is not proof of no exploitation. Of 82 responses, 15 reference earlier originals to avoid duplicate storage.
data/2026-10-26-1456/incident-register.json / data/2026-10-26-1456/collection-summary.json / data/2026-10-26-1456-vendors/collection-summary.json / docs/research-collection-2026-10-26-1456.md / docs/research-2026-10-26-1456.md / data/latest.json