Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Priority Command Strip
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Studio para abrir el feed completo, histórico ampliado y el catálogo KEV.
Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...] CVEs: CVE-2026-104286. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Fortinet, Citrix, F5, Atlassian, GitHub, Check Point. DORA relevance: medium.
Por qué importa
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Sin CVEs críticas frescas en la ventana actual.
Sin nuevos advisories PSIRT de vendor en la ventana.
Explotación activa confirmada. Riesgo material para entornos expuestos.
La vulnerabilidad CVE-2026-104286 está siendo explotada activamente en ataques zero-day, permitiendo la ejecución remota de código en dispositivos FortiMail críticos.
Acción recomendada
Identifique y parche inmediatamente todos los dispositivos FortiMail expuestos; no posponga la remediación al ciclo mensual.
In this week’s edition, Amy reflects on the importance of prioritizing family and personal well-being over the pressure to remain constantly productive. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Citrix. DORA relevance: medium.
Por qué importa
Se ha confirmado la explotación activa (in-the-wild) de vulnerabilidades en stacks críticos de Microsoft, Cisco y Citrix, lo que requiere acción inmediata para evitar brechas de seguridad.
Acción recomendada
Prioriza la remediación inmediata de los sistemas afectados por las vulnerabilidades KEV identificadas; no esperes al ciclo de parcheo mensual y notifica a los propietarios de los stacks.
Under certain conditions, CVE-2026-73570 can be exploited via specially crafted emails without user interaction. The post Zimbra Vulnerability Exploited in the Wild Prior to Public Disclosure appeared first on SecurityWeek. CVEs: CVE-2026-73570. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Google, GitHub, Mozilla, Zimbra, WatchGuard. DORA relevance: medium.
Por qué importa
La vulnerabilidad CVE-2026-73570 permite la ejecución remota de código sin interacción del usuario y está siendo explotada activamente in-the-wild.
Acción recomendada
Identificar y parchear inmediatamente todos los servidores Zimbra expuestos; no esperar al ciclo de mantenimiento mensual.
La explotación activa de una vulnerabilidad crítica en Zimbra exige aplicar medidas técnicas y organizativas adecuadas para proteger los datos personales tratados.
A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice (Source: Eurojust) According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage. “Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen … More → The post 16-year-old suspected leader of KillSec ransomware group arrested appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix. DORA relevance: high.
Por qué importa
El grupo KillSec ha ejecutado cerca de 1,000 ataques globales explotando accesos inseguros y vulnerabilidades en infraestructura crítica, representando un riesgo alto de exfiltración de datos y cumplimiento normativo (DORA/GDPR).
Acción recomendada
Audita inmediatamente la configuración de acceso a almacenamiento en la nube y aplica parches para las CVEs identificadas en los entornos Cisco, Google y Citrix.
For the fifth time this year, Cisco revealed attackers have exploited a vulnerability (CVE-2026-76504) in its SD-WAN solution in zero-day attacks. The vendor’s incident responders became aware of active exploitation of this vulnerability in September 2026, after getting pinged and resolving a Cisco Technical Assistance Center (TAC) support case. Cisco has yet to share any details about the attacks, but it has provided indicators of compromise defenders should look for to check whether they have … More → The post New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504) appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Cisco, Google, Citrix, GitHub. DORA relevance: medium.
Por qué importa
Se ha confirmado la explotación activa (zero-day) de una vulnerabilidad crítica en Cisco SD-WAN, lo que representa un riesgo inminente de compromiso de red.
Acción recomendada
Identificar y parchear inmediatamente los dispositivos Cisco SD-WAN afectados y revisar los indicadores de compromiso (IoCs) proporcionados por el fabricante.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. CVEs: CVE-2026-76504. CISA KEV/exploitation signal detected. Vendors: Cisco, GitHub. DORA relevance: medium.
Por qué importa
CISA confirma explotación activa de CVE-2026-76504 y la ha incorporado al catálogo KEV; su severidad crítica exige evaluación y remediación inmediata.
Acción recomendada
Verifica hoy la exposición de Cisco Catalyst SD-WAN Manager, aplica la mitigación o actualización disponible, busca indicios de compromiso y escala el estado al CISO.
La explotación activa de una vulnerabilidad crítica exige verificar la exposición, aplicar mitigaciones y documentar medidas de gestión del riesgo de ciberseguridad conforme a NIS2.
[CISA KEV actively exploited] Vendor: Cisco | Product: Catalyst SD-WAN Manager | Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-10-03 | Ransomware use: Unknown | Added: 2026-09-30 CVEs: CVE-2026-76504. CISA KEV/exploitation signal detected. Vendors: Cisco. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
The flaw could allow remote, unauthenticated attackers to access vulnerable appliances with administrative privileges. The post Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability appeared first on SecurityWeek. CVEs: CVE-2026-76504. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Google, Citrix, GitHub, Mozilla, WatchGuard. DORA relevance: medium.
Por qué importa
Vulnerabilidad zero-day explotada activamente que permite acceso administrativo remoto no autenticado a dispositivos Cisco SD-WAN.
Acción recomendada
Identificar y parchear inmediatamente los dispositivos Cisco Catalyst SD-WAN afectados; no esperar al ciclo de mantenimiento regular.