新一代智能的企業IT解決方案

KJ Intelligent Corp. 4F. 5A, No. 7, Sec. 3, New Taipei Blvd., Xinzhuang Dist., New Taipei City 242032 , Taiwan (R.O.C.)

【出處:台灣電腦緊急應變小組 TWCert】◎ 內容說明【與舊系統情資編號 TWCERT-TWISAC-202608-0032 同內容】以下為2026/08/17 至 2026/08/23 期間已知遭駭客利用之漏洞，詳細漏洞說明請參閱「漏洞資訊」。【CVE-2025-62593】Ray-Project Ray Code Injection Vulnerability (CVSS v3.1: 8.8)【是否遭勒索軟體利用:未知】【CVE-2026-33824】Microsoft Internet Key Exchange (IKE) Service Extensions DoubleFree Vulnerability (CVSS v3.1: 9.8)【是否遭勒索軟體利用:未知】【CVE-2026-59310】Broadcom VMware vCenter Path Traversal Vulnerability (CVSS v3.1: 9.8)【是否遭勒索軟體利用:未知】【CVE-2026-55040】Microsoft SharePoint Weak Authentication Vulnerability (CVSS v3.1: 9.1)【是否遭勒索軟體利用:未知】【CVE-2026-65400】Apple macOS Improper Authentication Vulnerability (CVSS v3.1: 9.8)【是否遭勒索軟體利用:未知】【CVE-2026-64849】MLflow Server-Side Request Forgery Vulnerability (CVSS v3.1: 9.3)【是否遭勒索軟體利用:未知】【CVE-2026-72530】TrueConf Server Code Injection Vulnerability (CVSS v3.1: 9.0)【是否遭勒索軟體利用:未知】【CVE-2026-72529】TrueConf Server Missing Authentication for Critical Function Vulnerability (CVSS v3.1: 9.8)【是否遭勒索軟體利用:未知】TLP:CLEAR TWCERT-TWISAC-202608-00312【CVE-2026-73570】Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability (CVSS v3.1: 8.9)【是否遭勒索軟體利用:未知】◎ 影響平台【CVE-2025-62593】請參考官方所列的影響版本https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v【CVE-2026-33824】請參考官方所列的影響版本https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824【CVE-2026-59310】請參考官方所列的影響版本https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017【CVE-2026-55040】請參考官方所列的影響版本https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040【CVE-2026-65400】請參考官方所列的影響版本https://support.apple.com/en-us/100100【CVE-2026-64849】請參考官方所列的影響版本https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j【CVE-2026-72530】請參考官方所列的影響版本https://trueconf.com/blog/news/security-fixes-updates-and-advisories【CVE-2026-72529】請參考官方所列的影響版本TLP:CLEAR TWCERT-TWISAC-202608-00313https://trueconf.com/blog/news/security-fixes-updates-and-advisories【CVE-2026-73570】請參考官方所列的影響版本https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories◎ 建議措施【CVE-2025-62593】官方已針對漏洞釋出修復更新，請更新至相關版本https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v【CVE-2026-33824】官方已針對漏洞釋出修復更新，請更新至相關版本https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824【CVE-2026-59310】官方已針對漏洞釋出修復更新，請更新至相關版本https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017【CVE-2026-55040】官方已針對漏洞釋出修復更新，請更新至相關版本https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040【CVE-2026-65400】官方已針對漏洞釋出修復更新，請更新至相關版本https://support.apple.com/en-us/100100【CVE-2026-64849】官方已針對漏洞釋出修復更新，請更新至相關版本https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j【CVE-2026-72530】官方已針對漏洞釋出修復更新，請更新至相關版本https://trueconf.com/blog/news/security-fixes-updates-and-advisoriesTLP:CLEAR TWCERT-TWISAC-202608-00314【CVE-2026-72529】官方已針對漏洞釋出修復更新，請更新至相關版本https://trueconf.com/blog/news/security-fixes-updates-and-advisories【CVE-2026-73570】官方已針對漏洞釋出修復更新，請更新至相關版本https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories◎ 漏洞資訊名稱描述CVE-2025-62593 Ray-Project Ray存在程式碼注入漏洞，可能導致遠端程式碼執行。該漏洞可透過Firefox和Safari被利用。CVE-2026-33824 Microsoft Internet Key Exchange(IKE)服務擴充功能存在記憶體雙重釋放漏洞，可能導致遠端程式碼執行。CVE-2026-59310 Broadcom VMware vCenter存在路徑遍歷漏洞，可能使具備 vCenter網路存取權限的威脅行為者得以執行任意程式碼。CVE-2026-55040 Microsoft SharePoint 存在驗證機制不足漏洞，可能使未經授權的攻擊者透過網路繞過安全性功能。CVE-2026-65400 Apple macOS存在不當驗證漏洞，可能使網路上的攻擊者無需有效憑證即可通過Screen Sharing驗證。CVE-2026-64849 MLflow存在伺服器端請求偽造漏洞，可能使攻擊者得以存取內部或雲端中繼資料服務，並取得response_status和response_body。CVE-2026-72530 TrueConf Server存在程式碼注入漏洞，可能讓未經授權且可透過4307/TCP埠存取網路的遠端攻擊者，利用特製指令碼突破隔離環境，並在主機系統上執行任意程式碼。CVE-2026-72529 TrueConf Server存在關鍵功能缺乏驗證漏洞，可能讓未經授權且可透過4307/TCP埠存取網路的遠端攻擊者，執行任意指令碼。CVE-2026-73570 Zimbra Collaboration Suite(ZCS)存在作業系統指令注入漏洞，可能使未經身分驗證的攻擊者發送特製的SMTP請求，進而以Zimbra使用者的身分執行任意作業系統指令。◎ 參考資訊TLP:CLEAR TWCERT-TWISAC-202608-00315CVE-2025-62593https://nvd.nist.gov/vuln/detail/cve-2025-62593Critical RCE Vulnerability against Ray Devs exploitable via Browser (Safari &Firefox) due to DNS Rebinding Attackhttps://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6vCVE-2026-33824https://nvd.nist.gov/vuln/detail/cve-2026-33824Windows 網際網路金鑰交換 (IKE) 服務擴充功能遠端執行程式碼弱點https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824CVE-2026-59310https://nvd.nist.gov/vuln/detail/cve-2026-59310VMSA-2026-0006.1: VMware ESX, vCenter, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876, CVE-2026-41703, CVE-2026-41709)https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017CVE-2026-55040https://nvd.nist.gov/vuln/detail/cve-2026-55040Microsoft SharePoint Server 安全性功能略過弱點https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040CVE-2026-65400https://nvd.nist.gov/vuln/detail/cve-2026-65400Apple security releaseshttps://support.apple.com/en-us/100100CVE-2026-64849https://nvd.nist.gov/vuln/detail/cve-2026-64849Unauthenticated full-read SSRF in MLflow webhook delivery: _validate_webhook_urlbypassed via unvalidated HTTP redirects (and DNS rebinding)https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969jCVE-2026-72530https://nvd.nist.gov/vuln/detail/cve-2026-72530TrueConf Security Vulnerabilities, Fixes and Advisorieshttps://trueconf.com/blog/news/security-fixes-updates-and-advisoriesCVE-2026-72529https://nvd.nist.gov/vuln/detail/cve-2026-72529CVE-2026-73570https://nvd.nist.gov/vuln/detail/cve-2026-73570TLP:CLEAR TWCERT-TWISAC-202608-00316Zimbra Security Advisorieshttps://wiki.zimbra.com/wiki/Zimbra_Security_Advisories https://www.kjintelligent.com/en/hot_538866.html [TWCERT 分享資安情資]_CISA新增9個已知遭駭客利用之漏洞至KEV目錄(2026/08/17-2026/08/23) 2026-08-28 2027-08-28

KJ Intelligent Corp. 4F. 5A, No. 7, Sec. 3, New Taipei Blvd., Xinzhuang Dist., New Taipei City 242032 , Taiwan (R.O.C.) https://www.kjintelligent.com/en/hot_538866.html

https://schema.org/EventMovedOnline https://schema.org/OfflineEventAttendanceMode

2026-08-28 http://schema.org/InStock TWD 0 https://www.kjintelligent.com/en/hot_538866.html

Home Hot News Information Security [TWCERT 分享資安情資]_WatchGuard Firebox存在重大資安漏洞(CVE-2025-14733) [2026-01-15]

【出處:台灣電腦緊急應變小組 TWCert】

WatchGuard Firebox 是一款次世代防火牆產品，提供多層次防護，包括防毒、IPS、AP
T 阻擋及垃圾郵件過濾。WatchGuard發布重大資安漏洞(CVE-2025-14733，CVSS 4.x：9.3)公告，該
漏洞為越界寫入漏洞，可能允許遠端未經驗證的攻擊者執行任意程式碼，目前WatchGuard已觀察到攻
擊者正積極嘗試利用此漏洞，詳細說明請見WatchGuard官網。
◎建議措施:
請更新至以下版本：
WatchGuard Fireware OS 2025.1.4版本、
WatchGuard Fireware
OS 12.5.15版本、
WatchGuard Fireware OS 12.11.6版本、
WatchGuard Fireware OS 12.3.1_Upd
ate4 (B728352)版本
備註：WatchGuard Fireware OS 11.x版本已是EoL(End of Life)的產品，建
議升級至支援版本
◎相關IOC資訊:
◎備註:
◎參考資料:
1. https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027
2. https:/
/nvd.nist.gov/vuln/detail/CVE-2025-14733

Previous Back to List Next

Subscribe to Newsletter