Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Priority Command Strip
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Studio para abrir el feed completo, histórico ampliado y el catálogo KEV.
Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...] CVEs: CVE-2026-104286. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Fortinet, Citrix, F5, Atlassian, GitHub, Check Point. DORA relevance: medium.
Por qué importa
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Sin CVEs críticas frescas en la ventana actual.
Sin nuevos advisories PSIRT de vendor en la ventana.
Explotación activa confirmada. Riesgo material para entornos expuestos.
La vulnerabilidad CVE-2026-104286 está siendo explotada activamente en ataques zero-day, permitiendo la ejecución remota de código en dispositivos FortiMail críticos.
Acción recomendada
Identifique y parche inmediatamente todos los dispositivos FortiMail expuestos; no posponga la remediación al ciclo mensual.
In this week’s edition, Amy reflects on the importance of prioritizing family and personal well-being over the pressure to remain constantly productive. CISA KEV/exploitation signal detected. Vendors: Microsoft, Cisco, Citrix. DORA relevance: medium.
Por qué importa
Se ha confirmado la explotación activa (in-the-wild) de vulnerabilidades en stacks críticos de Microsoft, Cisco y Citrix, lo que requiere acción inmediata para evitar brechas de seguridad.
Acción recomendada
Prioriza la remediación inmediata de los sistemas afectados por las vulnerabilidades KEV identificadas; no esperes al ciclo de parcheo mensual y notifica a los propietarios de los stacks.
Police took control of KillSec’s leak site and secured at least 110 terabytes of data stolen from victims. The post Police Shut Down KillSec Ransomware, Identify Alleged Teen Leader appeared first on SecurityWeek. CISA KEV/exploitation signal detected. Vendors: Google, Citrix, GitHub, OpenSSL, Zimbra. DORA relevance: medium.
Por qué importa
La desarticulación de KillSec confirma una campaña de ransomware activa con impacto masivo en exfiltración de datos, requiriendo validación de exposición en stacks críticos.
Acción recomendada
Ejecuta un triage inmediato sobre los activos que utilizan Citrix y Zimbra, y verifica la integridad de los repositorios en GitHub ante posibles credenciales comprometidas.
A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice (Source: Eurojust) According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage. “Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen … More → The post 16-year-old suspected leader of KillSec ransomware group arrested appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. Vendors: Cisco, Google, Citrix. DORA relevance: high.
Por qué importa
El grupo KillSec ha ejecutado cerca de 1,000 ataques globales explotando accesos inseguros y vulnerabilidades en infraestructura crítica, representando un riesgo alto de exfiltración de datos y cumplimiento normativo (DORA/GDPR).
Acción recomendada
Audita inmediatamente la configuración de acceso a almacenamiento en la nube y aplica parches para las CVEs identificadas en los entornos Cisco, Google y Citrix.
For the fifth time this year, Cisco revealed attackers have exploited a vulnerability (CVE-2026-76504) in its SD-WAN solution in zero-day attacks. The vendor’s incident responders became aware of active exploitation of this vulnerability in September 2026, after getting pinged and resolving a Cisco Technical Assistance Center (TAC) support case. Cisco has yet to share any details about the attacks, but it has provided indicators of compromise defenders should look for to check whether they have … More → The post New Cisco SD-WAN zero-day exploited in-the-wild (CVE-2026-76504) appeared first on Help Net Security. CVEs: CVE-2026-76504, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Cisco, Google, Citrix, GitHub. DORA relevance: medium.
Por qué importa
Se ha confirmado la explotación activa (zero-day) de una vulnerabilidad crítica en Cisco SD-WAN, lo que representa un riesgo inminente de compromiso de red.
Acción recomendada
Identificar y parchear inmediatamente los dispositivos Cisco SD-WAN afectados y revisar los indicadores de compromiso (IoCs) proporcionados por el fabricante.
[CISA KEV actively exploited] Vendor: Citrix | Product: NetScaler | Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-30 | Ransomware use: Unknown | Added: 2026-09-27 CVEs: CVE-2026-88772, CVE-2026-88771, CVE-2026-88778. CISA KEV/exploitation signal detected. Vendors: Citrix. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
[CISA KEV actively exploited] Vendor: Citrix | Product: NetScaler | Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-09-30 | Ransomware use: Unknown | Added: 2026-09-27 CVEs: CVE-2026-88771, CVE-2026-88778, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Citrix. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-88771 Citrix NetScaler Improper Input Validation Vulnerability CVE-2026-88772 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance. CVEs: CVE-2026-88771, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Citrix, GitHub. DORA relevance: medium.
Por qué importa
CISA ha añadido dos vulnerabilidades críticas de Citrix NetScaler a su catálogo KEV con evidencia de explotación activa, lo que exige priorización inmediata y evaluación de posible compromiso.
Acción recomendada
Comprueba de inmediato la exposición de CVE-2026-88771 y CVE-2026-88772, aplica las mitigaciones o parches disponibles, revisa indicios de compromiso y notifica el estado al CISO.
La explotación activa de vulnerabilidades críticas exige priorización inmediata de parches, evaluación de compromiso y medidas de gestión del riesgo conforme a NIS2, sin evidencia de un incidente significativo atribuible a la entidad.