Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Studio para abrir el feed completo, histórico ampliado y el catálogo KEV.
Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. [...] CVEs: CVE-2026-92370, CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92371. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Oracle, Apple, Citrix, Atlassian, GitLab, ServiceNow, Zimbra, MikroTik, Cloudflare. DORA relevance: medium.
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
TeamViewer ha advertido de vulnerabilidades de severidad alta con señal de explotación y presencia en CISA KEV, por lo que los activos afectados requieren remediación inmediata.
Acción recomendada
Identifica inmediatamente las instalaciones afectadas de TeamViewer, aplica las actualizaciones disponibles sin esperar al ciclo mensual y valida la exposición o explotación de los activos vulnerables.
Cisco released security updates to address a critical zero-day in the Catalyst SD-WAN Manager (tracked as CVE-2026-76504) that attackers are actively exploiting to escalate to admin privileges. [...] CVEs: CVE-2026-76504, CVE-2026-20127, CVE-2026-20182, CVE-2026-20245, CVE-2026-20262. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Oracle, Apple, Citrix, Atlassian, MikroTik, Cloudflare. DORA relevance: medium.
Por qué importa
Cisco confirma la explotación activa de una vulnerabilidad crítica de día cero en Catalyst SD-WAN Manager que permite elevar privilegios hasta administrador, con señal de explotación y presencia en CISA KEV.
Acción recomendada
Comprueba de inmediato la exposición de los activos afectados, aplica las actualizaciones oficiales de Cisco sin esperar al ciclo mensual, busca indicios de explotación y escala el resultado al CISO.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. [...] CVEs: CVE-2026-84411, CVE-2026-67276, CVE-2026-86060. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Oracle, Adobe, Apple, Citrix, SonicWall, Atlassian, Linux, Zimbra, MikroTik, Cloudflare. DORA relevance: medium.
Por qué importa
CISA ha señalado vulnerabilidades críticas en MikroTik RouterOS con posible ejecución remota de código o denegación de servicio y explotación activa.
Acción recomendada
Identifica inmediatamente los activos MikroTik RouterOS afectados, aplica las actualizaciones disponibles, restringe la exposición y realiza una revisión de compromiso el mismo día.
[CISA KEV actively exploited] Vendor: MikroTik | Product: RouterOS | Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-28 | Ransomware use: Unknown | Added: 2026-09-25 CVEs: CVE-2026-67279, CVE-2026-86060. CISA KEV/exploitation signal detected. Vendors: MikroTik. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
[CISA KEV actively exploited] Vendor: MikroTik | Product: RouterOS | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacked to change the trusted RouterOS policy mask, leading to privilege escalation. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-13 | Ransomware use: Unknown | Added: 2026-09-10 CVEs: CVE-2026-86060. CISA KEV/exploitation signal detected. Vendors: MikroTik. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
[CISA KEV actively exploited] Vendor: MikroTik | Product: RouterOS | MikroTik RouterOS contains a missing authenticaion for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-13 | Ransomware use: Unknown | Added: 2026-09-10 CVEs: CVE-2026-67277. CISA KEV/exploitation signal detected. Vendors: MikroTik. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
HTML source discovery from thehackernews.com CVEs: CVE-2026-104286, CVE-2026-85102, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Google, Fortinet, Citrix, F5, Zyxel, GitLab, Linux, WordPress, Veeam, MikroTik, Cloudflare, Check Point. DORA relevance: medium.
Por qué importa
La vulnerabilidad CVE-2026-104286 en FortiMail está siendo explotada activamente in-the-wild y ha sido incluida en el catálogo KEV de CISA, permitiendo ejecución de escritura de archivos no autenticada.
Acción recomendada
Identificar y parchear inmediatamente los dispositivos FortiMail afectados; no esperar al ciclo de mantenimiento regular y realizar triage de seguridad hoy mismo.
HTML source discovery from thehackernews.com CVEs: CVE-2026-1581. CISA KEV/exploitation signal detected. Vendors: Microsoft, Google, F5, Zyxel, GitLab, Linux, WordPress, Veeam, PHP, MikroTik, Cloudflare, Check Point. DORA relevance: medium.
Por qué importa
El CVE-2026-1581 está siendo explotado activamente para desplegar backdoors persistentes en WordPress que se autorreparan, dificultando la limpieza estándar.
Acción recomendada
Identifique y aísle los servidores WordPress afectados, realice una limpieza profunda de base de datos y memoria compartida, y aplique el parche de seguridad de forma inmediata.