Japan breach wave: JPCERT/CC adds AI-driven pen-test tool attacks
Original title：注意喚起: 直近で相次いでいる国内組織における不正アクセスに関する注意喚起 (更新)
What happened
Since around September 2026, unauthorized access has caused repeated personal data leaks at Japanese organizations. The Oct 23 update adds attempts using AI-driven pen-test platforms (including against WSUS servers) and more suspicious source IPs.
Who is affected
- Operators of public apps or APIs
- Organizations running Metabase or BI tools
- Organizations exposing WSUS servers
What to do
Check logs for access from the listed suspicious IPs, and update Metabase if you use it. Review API rate limits, access control and token expiry, and stop exposing unneeded admin functions.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Metabase(CVE-2026-72898、ケースC) | 要確認(JPCERT/CC AT-2026-0023 を参照) | 要確認(JPCERT/CC AT-2026-0023 を参照) |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：JPCERT/CC ↗
- CVE：CVE-2026-72898 ↗
Revision history（2）
- RED FLAG2026-10-23 更新で「ケースE：AI を用いたペネトレーションテスト基盤を悪用した攻撃試行」(WSUS サーバー狙いを含む) を追加し、ケースB に不審な送信元 IP を追加。攻撃範囲と確認用の痕跡情報が拡大した。
- RED FLAGFirst report
Change notes are currently available in Japanese only.