Major Vulnerabilities in Products Japanese Enterprises Use (2026)

This page is a cross-vendor hub that tracks the current state of the serious vulnerabilities disclosed in 2026 in products Japanese enterprises rely on, updated each time new cases appear on JVN (Japan's vulnerability information portal). As of July 23, 2026, the cases confirmed to be exploited in real attacks and listed on CISA's KEV (the US catalog of vulnerabilities actually being used in attacks) are Trend Micro Apex One (CVE-2026-34926), Ubiquiti UniFi (CVE-2026-34908/34909/34910), F5 BIG-IP, Drupal, and Microsoft SharePoint / Cisco FMC. Fixed versions are available for nearly every product except the login platform Casdoor, so if you run an affected product, updating to the fixed version is the first thing to do. You can search the full list of vulnerabilities actually being used in attacks on the CISA KEV dashboard.

As a late-July 2026 addition, the newest JVN-disclosed vulnerabilities are gathered at the very top in "New vulnerabilities disclosed on JVN in late July 2026." This round covers several ELECOM models (including home Wi-Fi routers), Apache Tomcat, Trend Micro's cloud-based security platform Trend Vision One, the Japanese CMS baserCMS and Tegalog, and ECOVACS DEEBOT robot vacuums. Because devices used at home are included too, this matters not only to corporate IT teams but to ordinary users.

You can grasp each vulnerability by following them one at a time. But some things only become visible when you line them up across vendors. Attackers do not pick targets by brand name. They simply work through every "entry point where authentication can be bypassed" and every "device left unpatched after support ended" in turn. That is exactly why it is worth checking, all at once, how many holes opened up in the products you use at work or at home, and which of them are still not closed.

New vulnerabilities disclosed on JVN in late July 2026

Here we line up the new vulnerabilities posted to JVN (Japan Vulnerability Notes) through late July 2026, ordered by general name recognition and how widely they are used in Japan. Some, like home Wi-Fi routers and robot vacuums, directly affect individual daily life, not just companies. The full details of each case are on the relevant JVN page.

Multiple ELECOM wireless LAN routers and access points (JVN#56870912 / CVE-2026-59764, CVE-2026-61376, CVE-2026-44387)

The most familiar item in this update is the wireless LAN products from ELECOM, a major network equipment maker. JVN#56870912 discloses multiple vulnerabilities in both home Wi-Fi routers and business-use access points (APs). The highest severity is CVSS 8.6, for OS command injection that lets arbitrary commands be sent to the device.

On the home side, the popular Wi-Fi routers "WRC-X3000GS3-B" and "WRC-X3000GS3A-B" (both firmware v1.06 and earlier), sold even at electronics retailers, are affected by a flaw that allows arbitrary OS commands to be run on the device through the settings screen (CVE-2026-59764, CVSS 8.6). A router is the very entry point of a home network, so if it is hijacked, home traffic could be eavesdropped on, or the device could be used as a foothold to reach other equipment.

On the business-use AP side, the affected models are "WAB-M1775-PS" and "WAB-S1775" (v2.1.9 and earlier), and "WAB-M2133," "WAB-I1750-PS" and "WAB-S1167-PS" (v2.0.5 and earlier). Disclosed here are OS command injection abusing the settings-backup restore feature (CVE-2026-61376, CVSS 8.6) and reflected cross-site scripting in the settings screen (CVE-2026-44387, CVSS 5.2, a technique that hijacks operations by getting a user to click a crafted link). Exploiting either requires access to the admin console, but that is a realistic risk on devices still running with default passwords.

The fix is to update to the latest firmware ELECOM provides. Because so many units are used on home lines for remote work and at small sites, watch out for lingering missed updates. Changing the admin console password from its default and configuring the device so the admin console cannot be reached from the internet side are also effective together.

A denial-of-service flaw in Apache Tomcat's WebSocket chat sample (JVNVU#99139115 / CVE-2026-66299)

Apache Tomcat, widely used as server software for running Java applications, has a denial-of-service (DoS) vulnerability, CVE-2026-66299 (CVSS 7.5). The gist is that a remote attacker can put load on the server and stop it from responding. Affected are versions prior to 11.0.25, 10.1.58, and 9.0.121, and these versions contain the fix.

The famous name tends to make people tense up, but the cause is the "WebSocket chat sample (examples)" bundled with Tomcat, which should be deleted in production. Except for cases running with the sample exposed, the impact is limited, and there is no need to panic. If you run an affected version, update to the fixed version, and if you have the examples app exposed, deleting it is the sure move. The past vulnerabilities and fixes for Tomcat are also organized in our Apache Tomcat vulnerability roundup.

Trend Micro Trend Vision One Service Gateway (JVNVU#98815601 / CVE-2025-71386, CVE-2025-71387)

A corporate security platform got a new vulnerability too. The relay appliance Service Gateway for Trend Micro's cloud-based security operations platform "Trend Vision One" has two vulnerabilities disclosed. CVE-2025-71386 is a flaw where a remote attacker could steal sensitive information, and CVE-2025-71387 is a privilege-escalation flaw where a user holding a specific role can improperly raise their own privileges.

According to Trend Micro, both have been fixed on the service (backend) side. If automatic updates are enabled, no action on the user's part is said to be required, but in environments with automatic updates turned off, a manual update or enabling automatic updates is needed. Because a product meant to protect you can become an entry point itself, organizations running the Service Gateway should confirm their update status.

A CSV injection flaw in the Japanese CMS "baserCMS" (JVNVU#94952030 / CVE-2026-65875)

The Japanese content management system (CMS, the software that forms the base for building websites) "baserCMS" has a CSV injection vulnerability, CVE-2026-65875, disclosed. Its CVSS is 7.1 on v3.1 and 5.1 on v4.0. The technique is that formulas or the like planted by an attacker get embedded into a CSV file an administrator exports from the site, and malicious processing runs when that file is opened in spreadsheet software.

baserCMS is a Japanese CMS also used to build sites for small and midsize businesses and government offices. Affected are versions prior to 5.3.0, and it is fixed in 5.3.0 and later. If you use it, update to the latest version.

Admin-console manipulation flaw in Nishishi Factory's "Tegalog" (JVN#99975039 / CVE-2026-64940)

"Tegalog," a Japanese tool popular for personal sites and fan sites (software for posting and logging short memos and one-liners on the web) made by Nishishi Factory, has a vulnerability, CVE-2026-64940, disclosed. It stems from improper input checking with regular expressions, and a third party with access to the product could log into the admin console they should not be able to reach and carry out unauthorized operations. The CVSS is on the high side, 8.6 on v3.1 and 8.8 on v4.0.

Affected is Ver 4.8.4 and earlier, and it is fixed in the latest version the developer provides. It is often used on sites run by individuals, where updates tend to be put off, so if it applies to you, swap it for the latest version early.

Multiple flaws in ECOVACS DEEBOT robot vacuums and more (JVNVU#92804348 / CVE-2026-66403 and others)

One item comes from a home IoT device too. The "DEEBOT" series robot vacuums from vacuum maker ECOVACS and its companion app have multiple vulnerabilities disclosed. Affected are the DEEBOT PRO M1 (before M1-1.7.27), the DEEBOT PRO K1VAC (before V1.7.821), and the ECOVACS PRO app (Android / iOS, before 1.3.82).

The issues include a debug web server left enabled (CVE-2026-66403, the maximum CVSS of 8.7), a Telnet server left enabled (CVE-2026-66405, CVSS 8.6), insufficient traffic encryption and certificate validation (CVE-2026-66404, 66406, 66407, 66410), and weak passwords for the root account and Wi-Fi hotspot (CVE-2026-66408, 66409) — flaws that could allow the device to be hijacked or its traffic to be eavesdropped on. Because vacuums hold camera and map information, a hijacked unit could leak what is going on inside the home.

According to ECOVACS, these have already been updated (fixed), and no additional action on the user's part is required. To be safe, it is reassuring to confirm that the app and the unit's firmware are up to date.

Here are the six items added in this update at a glance. Scroll horizontally to see the full table (advisory numbers and CVSS are the values posted on each JVN page).

For the exact affected versions, CVSS scores and fixed versions of each case, always check the relevant JVN pages above and each maker's official information.

Where to find Japanese vulnerability information (What is JVN)

The starting point for checking Japanese vulnerability information is JVN (Japan Vulnerability Notes). It is a Japanese-language vulnerability information portal jointly operated by the IPA (Information-technology Promotion Agency) and JPCERT/CC (the JPCERT Coordination Center, the organization that coordinates security incident response in Japan). Vulnerabilities reported by domestic vendors, and those disclosed overseas that are relevant to Japan, are published with explanations in Japanese. The content is split between JVN (jvn.jp) and the more comprehensive JVN iPedia (jvndb.jvn.jp). JPCERT/CC also issues alerts for the most urgent items, so subscribing to these sources is the basic first step.

According to IPA figures, of the vulnerabilities registered to JVN iPedia in the first quarter of 2026, the most severe "Critical" rating accounted for about 16% of the total (the latest quarterly statistics we could confirm as of this update on July 23, 2026). Because the sheer number keeps growing, following all of them is not realistic. You need a way to pick out only those tied to the products you actually use.

JVN is often contrasted with the list published by the US government agency CISA of "vulnerabilities actually being used in attacks" (KEV, Known Exploited Vulnerabilities). While JVN is discovery-based information that "a dangerous flaw has been found," KEV is impact-based, meaning "it is already being exploited in attacks," and US federal agencies are given deadlines to fix the listed items. In other words, the way priority is set differs. Cross-referencing the two surfaces the highest-priority cases that are both dangerous and actively under attack. For KEV, we provide a separate dashboard that lets you search the entire catalog in Japanese.

• → CISA KEV Dashboard in Japanese | Search the entire catalog of actively exploited vulnerabilities

Serious vulnerabilities found in major domestic products

Let us start with products made by domestic vendors that are almost guaranteed to be present inside any Japanese company. Server management software, business Wi-Fi routers, and antivirus software protecting in-house PCs all appeared on the list, the kind of products that affect the entire business when they stop working.

Fujitsu's server management software "ServerView" has holes that let a person with only an ordinary user account seize the server's administrator privileges (CVE-2026-27788 and CVE-2026-32325). Since this is software used to monitor and manage servers, losing control here means the whole foundation is taken with it. As of July 23, 2026 no real-world exploitation (KEV listing) has been confirmed, but if you run an affected version, check Fujitsu's official advisory for the remediation status.

NEC's "Aterm" Wi-Fi routers for homes and small offices have holes in nine popular models that could let the device be hijacked (advisory IDs NV26-002 / NV26-003, covering screen tampering and OS command injection). Fixed firmware is already available (for example, Ver. 3.4.0 for the MR51FN and Ver. 1.2.0 for the CM51FD), so if you have updated, no further action is needed. Because these are widely used on home lines for remote work and at small branch offices, the large number of units makes missed updates likely to linger.

Trend Micro's enterprise antivirus software "Apex One" is the one case here that needs particular attention. CVE-2026-34926, a flaw in the management server, was confirmed to have been exploited in real attacks before a fix existed, and was added to CISA's KEV on May 21, 2026. Server and agent builds below 17079 are affected, and the patch released the same day closes the hole. If you have updated to build 17079 or later, no action is needed; if not, the very product meant to protect your PCs remains an open entry point.

The details of each case, the affected models, fixed versions and mitigations are covered in dedicated articles.

• → Privilege escalation in Fujitsu's ServerView server management software, CVE-2026-27788
• → New vulnerabilities in 9 popular NEC Aterm Wi-Fi router models
• → Serious Apex One flaw CVE-2026-34926, exploitation confirmed, update to build 17079 or later

Serious vulnerabilities found in core systems (IBM and Oracle)

Next are the IBM and Oracle products that underpin the core operations of large enterprises. These cover areas where processes that cannot be stopped are running, such as accounting, order management, and file transfer for broadcasting and finance.

Oracle moved to monthly patch delivery in 2026, and its very first round disclosed 35 issues, including CVE-2026-46840, a worst-class takeover flaw (its CVSS severity score is the maximum of 10.0). Because Oracle products are deeply embedded in core systems, the deployment plan itself becomes a major undertaking. Note that in July Oracle released its largest quarterly patch batch ever; we cover it in "Developments since the first-half roundup" below.

IBM disclosed vulnerabilities across multiple products in May. Among them, CVE-2026-8633 in "WebSphere," the application execution platform that forms the foundation of corporate systems, was a serious flaw that could let a server be hijacked. In addition, "Aspera," used by broadcasters and large enterprises to transfer large files, had two memory-corruption (buffer overflow) vulnerabilities disclosed, CVE-2026-8175 and CVE-2026-8179.

• → Worst-class takeover flaw in Oracle CVE-2026-46840, 35 issues in the first monthly patch
• → CVE-2026-8633, a serious flaw that lets IBM WebSphere be hijacked, update now
• → Two buffer overflow flaws in IBM Aspera CVE-2026-8175/8179, hitting file-transfer infrastructure for broadcasters and large firms

Serious vulnerabilities found in network gear and in-house infrastructure

Network devices placed at the boundary between outside and inside are the first entry point attackers aim for. They face the internet and, once breached, give reach into the entire internal network, so vulnerabilities here need to be treated with extra weight.

In F5's "BIG-IP," used for load balancing and VPN, CVE-2025-53521 was initially treated as a denial-of-service (service outage) issue, but based on new information obtained in March it was reclassified as a takeover that allows remote code execution, and added to KEV. The fix deadline imposed on US federal agencies (March 30) has long passed; any exposed device still unpatched should be treated as already compromised until proven otherwise.

The vulnerabilities in Ubiquiti's in-house network gear "UniFi" (the five items of bulletin 064) are a case whose assessment changed sharply after disclosure. Three of them (CVE-2026-34908/34909/34910, each rated CVSS 10.0) can be chained into unauthenticated remote code execution with administrator (root) privileges, and after exploitation was demonstrated they were added to KEV on June 23, 2026. What was initially read as "eavesdropping on traffic" turned out to reach full device takeover. Fixed versions are available, so count your unpatched UniFi units if you must, but close them. For document sharing, the enterprise file-sharing product "Gladinet Triofox" has three serious holes that allow remote code execution without authentication (CVE-2026-8362/8363/8364; not on KEV as of July 23, 2026).

Also, in "Drupal," a CMS widely used to build government and large-enterprise websites, the SQL injection vulnerability CVE-2026-9082 (an attack that injects malicious commands to manipulate the database) was added to KEV as already being exploited. The fix deadline for US federal agencies (May 27) has also passed. Microsoft's in-house portal "SharePoint" and Cisco's firewall management software "FMC" also had urgent vulnerabilities disclosed in the first half that allow takeover without authentication. SharePoint has remained under fire since: four more of its flaws entered KEV in July alone (covered below).

• → F5 BIG-IP takeover flaw, post-deadline attack cases and permanent fix [CVE-2025-53521]
• → Top-class vulnerabilities in UniFi gear, exploitation confirmed, unauthenticated takeover risk
• → Three serious vulnerabilities in Gladinet Triofox, enterprise file sharing at risk
• → Unauthenticated takeover flaw in Drupal CVE-2026-9082, on KEV as actively exploited
• → SharePoint and Cisco FMC urgent vulnerabilities, takeover possible without authentication

Serious vulnerabilities found in business web apps (recruiting, help desk, login infrastructure)

Finally, the business web apps that HR and IT teams use daily. They are behind-the-scenes systems that rarely show up in the spotlight, yet they handle data with large impact when leaked, such as job applicants' personal information and employees' login credentials.

In the help-desk product "OTRS," the SQL injection vulnerability CVE-2026-48188 was disclosed, which under certain configurations could allow intrusion without authentication. In the recruiting product "OpenCATS," CVE-2026-49489 was flagged as risking the leak of applicant data. Since this system holds large volumes of applicants' personal information, the impact of a leak is far from small.

"Casdoor," a single sign-on platform (a mechanism that lets you use multiple services with one login) that consolidates logins to various in-house services, has nine authentication-bypass holes (CVE-2026-9090 and others). If the foundation of logins is breached, the impact reaches every connected business system. The troubling part is that no fixed version has been released as of July 23, 2026 (the GitHub advisory was last updated July 2 with no fix). If you keep running it, the only defense is workarounds: keep the admin console off the public internet and put another layer of authentication in front.

• → Intrusion flaw in OTRS help desk CVE-2026-48188, no authentication under certain configurations
• → Vulnerability in OpenCATS recruiting software, risk of applicant data leak CVE-2026-49489
• → Nine authentication-bypass holes in Casdoor login platform CVE-2026-9090 and others, no fix available

Serious vulnerabilities found in manufacturing design and production backbones (CATIA, DELMIA)

At the end of the first half, serious vulnerabilities were also disclosed in the backbone software that manufacturers in automotive, aerospace, and defense use for design and production. They are overseas products, but they are deeply embedded in domestic manufacturing floors, so the impact is far from small.

Dassault Systèmes, the French company known for the 3D design software "CATIA," disclosed two flaws in June. The most serious is CVE-2026-7858 in "Teamwork Cloud (Magic Collaboration Studio)," the server that lets multiple engineers share and version-control design data: a worst-class flaw (a CVSS severity score of 9.8) that allows takeover of the server without a login. Drawings and in-development product specifications could be siphoned out wholesale. Alongside it, a screen-tampering flaw, CVE-2026-9024 (CVSS 8.7), was disclosed in "DELMIA Service Process Engineer," which handles shop-floor work instructions.

In Dassault products, the same type of flaw (deserialization of untrusted data) was actually exploited in attacks in 2025 and added to CISA's KEV list. These two are still not on KEV as of July 23, 2026, about a month and a half after disclosure, but organizations on an affected version need to close the hole before attacks spread.

• → CATIA design-data server hijacked without login CVE-2026-7858

First-half 2026 key cases at a glance

Here is a list of the cases covered above. The "Exploited" column indicates whether the item is on CISA's list of vulnerabilities actually being used in attacks (KEV), as of July 23, 2026. Scroll horizontally to see the full table.

For the exact CVSS scores, affected versions and fixed-version numbers of each case, always check the individual articles above, each vendor's official advisory, and JVN.

Developments since the first-half roundup (as of July 23, 2026)

The first version of this page was published on June 1, 2026. In the roughly two months since, the status of the first-half cases themselves has moved. As covered above, the three UniFi flaws entered KEV on June 23, and this revision also reflects that Apex One's CVE-2026-34926 had been on KEV since May 21 (the old version of the quick-reference table said "not confirmed"; we apologize and correct it). Beyond that, two major developments outside the roundup's original scope deserve attention.

The first is Oracle. The quarterly patch batch released around July 21 (the July CPU) is the largest ever, with 1,449 patches covering roughly 1,235 CVEs, of which 261 are rated Critical. Fusion Middleware alone carries ten CVSS 10.0 flaws, Database Server (19.3 through 23.26.2) has a 9.9, and the batch includes fixes responding to real attacks on the PeopleSoft HR and finance suite (over 100 compromises reported). On top of that, Oracle-related flaws kept entering KEV: WebLogic (CVE-2024-21182, June 1), PeopleSoft PeopleTools (CVE-2026-35273, June 12) and E-Business Suite (CVE-2026-46817, July 15). The assumption that "with Oracle you can just wait for the quarterly patch" is wearing thin.

The second is SharePoint. Patching the first-half emergency was not the end of it: four more SharePoint flaws were added to KEV in July alone (CVE-2026-45659, CVE-2026-56164, CVE-2026-58644 and CVE-2026-50522), and CVE-2026-56155 in ADFS, the Windows login-federation platform, entered KEV on July 14 as well. If you run your own SharePoint servers, do not stop at the first-half patches; confirm that the July updates are applied too.

Trends seen across the first half of 2026 (the author's view)

From here on, this is not a recap of facts but what the author felt after lining up the cases of the first half. Please read it as a personal opinion.

In the author's view, what stood out most this half-year was the sheer number of vulnerabilities of the "authentication can be bypassed" or "no authentication needed at all" type. F5 BIG-IP, Drupal, SharePoint, Cisco FMC, Gladinet Triofox, Casdoor, OTRS. The categories are all over the place, yet they share the trait that the authentication meant to stop attackers at the door simply does not work. From an attacker's point of view, there were that many entry points where the first step can be taken without any ID or password.

The next thing I felt is that, regardless of whether a product is domestic or overseas, the closer it is to the core, the more it gets targeted. Fujitsu's server management, IBM's application platform and file transfer, Oracle's core systems, and Casdoor that consolidates logins. All of these are places where "if you take this, it is easy to spread sideways." If you are hardening your defenses, I believe you should prioritize starting from these foundational parts.

One more thing that caught my attention is that products with no fix available at disclosure time, or with thinning support, tend to be left unpatched. Some cases, like Casdoor, still have no fixed version two months on, and others, like Aterm, have so many units that updates do not reach everywhere. Devices placed in ordinary homes carry the same weakness, like the ELECOM home routers and the ECOVACS robot vacuums added at the end of July. The troubling part is that attackers precisely target this gap of "want to fix it but cannot" and "forgot to fix it."

And what updating this page drove home for me is that the phrase "no exploitation confirmed" starts going stale the moment it is written. UniFi entered KEV about a month after disclosure, and with Apex One, I myself had missed a KEV entry that was already there. Exploitation status keeps changing; you need a routine of rechecking KEV on the assumption that it will.

The threats this half-year were concentrated less in flashy new techniques and more in long-standing weak points: "entry-point authentication," "the core foundation," and "neglected, unpatched devices." That is the author's read. Conversely, it means the direction of defense can be narrowed down to exactly those.

What IT teams should check right now

Given the trends of the first half, what to check comes down to four things. Rather than bracing yourself comprehensively, it is more practical to start where it has the most effect.

The first is taking inventory of assets. Of the products in the quick-reference table, which ones does your company use? It is essential first to know where your internet-facing devices are (VPN, file sharing, CMS, in-house portals) and where the platform that consolidates logins sits. If you do not know what you have, you cannot know what to fix.

The second is subscribing to information sources. Subscribe to JVN and JPCERT/CC alerts, and set up a way to catch items relevant to your own products as they come in. Together with that, checking what is already being used in attacks via CISA's KEV makes it easier to set priorities.

The third is identifying end-of-support products. Devices and software whose support has ended get no fixed version even when a new vulnerability appears. Even this half-year, the trend of neglected products being targeted was visible. If you keep using them, additional measures such as isolating them from the network are required.

The fourth is how you set priorities. You cannot fix everything at once. The basic approach is to start with items where all three apply: "is it directly reachable from the internet," "can it be exploited without authentication," and "is it already being attacked (on KEV)." As of July 23, 2026, the KEV-listed cases are Apex One, UniFi, F5 BIG-IP, Drupal, and SharePoint / Cisco FMC, and these take top priority.

We also provide a helper tool to make daily checks routine. It is a scanner that lets you check vulnerabilities just by pasting the dependencies of the open-source software (OSS) you use in-house.

• → [Free] OSS vulnerability scanner | Paste your npm/Python dependencies for an instant check
• → Check actively exploited vulnerabilities on the CISA KEV dashboard

Frequently asked questions

References

• ・JVN (Japan Vulnerability Notes)
• ・JVN iPedia (vulnerability countermeasure database)
• ・JPCERT/CC Alerts
• ・JVN#56870912 - Multiple vulnerabilities in ELECOM wireless LAN routers and more
• ・JVNVU#99139115 - Apache Tomcat denial of service (CVE-2026-66299)
• ・JVNVU#98815601 - Trend Vision One Service Gateway vulnerabilities (CVE-2025-71386/71387)
• ・JVNVU#94952030 - CSV injection in baserCMS (CVE-2026-65875)
• ・JVN#99975039 - Vulnerability in Tegalog (CVE-2026-64940)
• ・JVNVU#92804348 - Multiple vulnerabilities in ECOVACS robot vacuums and more
• ・CISA Known Exploited Vulnerabilities Catalog (KEV)
• ・NVD (US vulnerability database, per-CVE details)
• ・Help Net Security - Actively exploited Trend Micro Apex One flaw (CVE-2026-34926)
• ・Oracle Critical Patch Update Advisory - July 2026