Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Sin señales activamente explotadas ni parches de emergencia.
No priority signals demanding immediate attention.
La cola operativa está limpia en esta ventana. El scouter sigue monitorizando.
The first exploitation attempts targeting CVE-2026-71362 were observed shortly after Adobe released patches. The post Adobe Commerce Bug Targeted Immediately After Disclosure appeared first on SecurityWeek. CVEs: CVE-2026-71362. Vendors: Microsoft, Fortinet, VMware, Adobe, Ivanti, SonicWall, WordPress, Zoom. DORA relevance: medium.
Por qué importa
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
Sin CVEs críticas frescas en la ventana actual.
Sin nuevos advisories PSIRT de vendor en la ventana.
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-71362 en el inventario de activos y las herramientas de vulnerabilidades.
Tracked as CVE-2026–59310, the directory traversal bug allows remote attackers to execute arbitrary code. The post Critical VMware vCenter Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek. CVEs: CVE-2026-59310. Vendors: Microsoft, Fortinet, VMware, Adobe, Ivanti, SonicWall, Siemens, Salesforce, ServiceNow, WordPress, Zoom. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-59310 en el inventario de activos y las herramientas de vulnerabilidades.
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files. The post WordPress 7.0.4 Patches Remote Code Execution Vulnerability appeared first on SecurityWeek. CVEs: CVE-2026-65640. Vendors: Microsoft, Fortinet, VMware, SAP, Adobe, Ivanti, SonicWall, Salesforce, ServiceNow, WordPress, Zoom. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-65640 en el inventario de activos y las herramientas de vulnerabilidades.
CISA has also published several advisories describing vulnerabilities in ICS and other OT products. The post ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact appeared first on SecurityWeek. Vendors: Microsoft, Cisco, Google, Adobe, Ivanti, SonicWall, Mozilla, Siemens, Schneider Electric, Rockwell Automation, ServiceNow, Zoom. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Cisco, Google, Adobe.
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users. The post Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack appeared first on SecurityWeek. Vendors: Microsoft, Cisco, AWS, SAP, Adobe, Apple, Ivanti, SonicWall, GitHub, Siemens, Salesforce, ServiceNow, Zoom, Node.js, Python, NGINX. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Avisa a los owners de los stacks Microsoft, Cisco, AWS, SAP.
Zoom has fixed four vulnerabilities across its applications, including two that could allow attackers who join a meeting to execute malicious code on the systems of all other meeting participants with no interaction required from them. Three of the vulnerabilities affect all Zoom client applications for all platforms before versions 7.1.5 and 7.0.6, while the fourth impacts Zoom Workplace VDI Client for Windows and VDI Plugins on all supported platforms before versions 7.0.11 and 6.6.15. Products such as Zoom Rooms and Zoom Meeting SDK before versions 7.1.0 are also affected. The three client vulnerabilities are memory corruption issues in the text annotation function and were found by a researcher from A Security by using an AI agent. “The entire operation, from finding the flaw to building a working exploit, was carried out by A [Security] using fewer than 20 prompts on publicly available AI models in under 24 hours,” the company said in its report. “This class of capability would previously have only been available to nation-state threat actors, but the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed. Today, a single researcher was able to develop a nation-state-level exploit in less than a day.” The researchers point out the massive potential blast radius of such an exploit, with Zoom being used by 70% of the Fortune 100 companies, most of the Fortune 500 ones, and federal agencies. In addition, this exploit doesn’t need meeting participants to perform any type of action such as clicking or downloading anything. It all happens silently with no indication that the attacker has executed malicious code on their computer. How the vulnerability works When a participant draws, writes, or highlights text on a shared screen or whiteboard in Zoom, their client doesn’t send pixels. Instead, it builds a typed in-memory object that describes the action, then serializes this object into a byte stream and sends it to Zoom’s Multimedia Ro CVEs: CVE-2026-53413, CVE-2026-53415, CVE-2026-53414, CVE-2026-53416. Vendors: Microsoft, Google, VMware, Citrix, GitHub, Zoom, Node.js, Zimbra. DORA relevance: high.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-53413, CVE-2026-53415, CVE-2026-53414 en el inventario de activos y las herramientas de vulnerabilidades.
Impacting Zoom annotation, the bug could be exploited by a meeting participant to execute code on another participant’s machine. The post Zoom Patches Zero-Click Code Execution Vulnerability appeared first on SecurityWeek. CVEs: CVE-2026-53413, CVE-2026-53414, CVE-2026-53415, CVE-2026-53416. Vendors: Microsoft, Cisco, Google, SAP, Adobe, Apple, ServiceNow, Zoom, Splunk. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-53413, CVE-2026-53414, CVE-2026-53415 en el inventario de activos y las herramientas de vulnerabilidades.
The security defects could be exploited for arbitrary code execution and denial-of-service. The post Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws appeared first on SecurityWeek. CVEs: CVE-2026-48362, CVE-2026-48273, CVE-2026-71384, CVE-2026-71398, CVE-2026-27302. Vendors: Microsoft, Cisco, Google, SAP, Adobe, Apple, ServiceNow, Zoom. DORA relevance: medium.
Por qué importa
Postura cloud / identity comprometida o reforzada. Revisar configuración y baseline.
Acción recomendada
Comprueba la exposición a CVE-2026-48362, CVE-2026-48273, CVE-2026-71384 en el inventario de activos y las herramientas de vulnerabilidades.