Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Priority Command Strip
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. Vendors: GitHub, Linux. DORA relevance: high.
Por qué importa
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Explotación activa confirmada. Riesgo material para entornos expuestos.
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Avisa a los owners de los stacks GitHub, Linux.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20181. CVEs: CVE-2026-20181. Vendors: Cisco. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-20181 en el inventario de activos y las herramientas de vulnerabilidades.
The vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-20190. CVEs: CVE-2026-20190. Vendors: Cisco. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-20190 en el inventario de activos y las herramientas de vulnerabilidades.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-20147. CVEs: CVE-2026-20147. Vendors: Cisco. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-20147 en el inventario de activos y las herramientas de vulnerabilidades.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-20148. CVEs: CVE-2026-20148. Vendors: Cisco. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-20148 en el inventario de activos y las herramientas de vulnerabilidades.
Researchers at XM Cyber found that a standard domain user with no Microsoft SCCM privileges can chain multiple flaws to reach remote code execution, although the attack does require network access to the SCCM environment. Enterprises use Microsoft System Center Configuration Manager (SCCM) to deploy operating systems, manage patches, distribute software, and monitor compliance across large Windows fleets. XM Cyber’s attack can move from an ordinary domain account to code execution as “NT AUTHORITY\SYSTEM” on the primary site server. “After the Site Server is compromised, all of its managed clients are compromised as well, which usually means taking over all the company assets,” XM Cyber’s Omri Baso told CSO. The revealed attack chain combines four weaknesses, including a broken authorization in the AdminService upload functionality, a path-traversal flaw dubbed “CabSlip,” weak code-signing validation that could be tricked with a $58 commercial certificate, and an unsigned DLL-loading path in the SMS Executive service. Microsoft fixed the initial authorization flaw, tracked as CVE-2026-47301, in July, but Baso said the remaining links in the chain are not expected to be fully addressed until ConfigMgr 2609, planned for October. The patch did not patch The initial foothold comes from SCCM’s AdminService API. Its normal extension-upload endpoint checks whether a user has the required permission, but its “chunked-upload” counterpart does not. That allows an authenticated Active Directory user to submit a malicious CAB archive without SCCM administrative privileges. Microsoft’s July fix blocks that route for standard domain users. However, the downstream chain remains reachable through another path. Users assigned the built-in Operations Administrator role, or a custom role with Create permission on “SMS_ConsoleExtensionData,” can still trigger the same sequence. But there is an important qualification here. XM Cyber said it believes organizations are unlikely to be expo CVEs: CVE-2026-47301. Vendors: Microsoft, Google, Oracle, Atlassian, GitHub. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-47301 en el inventario de activos y las herramientas de vulnerabilidades.
An update on the Microsoft SharePoint vulnerability that previously allowed remote code execution; now fixed. CVEs: CVE-2026-63520, CVE-2026-55040. Vendors: Microsoft, AWS, Rapid7. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-63520, CVE-2026-55040 en el inventario de activos y las herramientas de vulnerabilidades.
This post analyzes a vulnerability in Microsoft SharePoint that allows an attacker to bypass authentication mechanisms. CVEs: CVE-2026-55040. Vendors: Microsoft, AWS, Rapid7. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-55040 en el inventario de activos y las herramientas de vulnerabilidades.