Una señal es cualquier evento operacional detectado en las últimas 24h–30d: CVEs en KEV explotados activamente, advisories de vendor, exposición cloud, ransomware y avisos regulatorios. Cada señal se prioriza por severidad, freshness y match con tu Digital Twin.
Para análisis editorial y noticias generales visita Noticias.
Discover muestra 8 señales operativas recientes. Sube a Consultant Pro o Professional Studio para abrir el feed completo, histórico ampliado y el catálogo KEV.
Unit 42 is aware of possible 0-day activity against NetScaler devices. Citrix reports CVE-2026-88771, CVE-2026-88772 have been exploited in the wild. The post Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30) appeared first on Unit 42. CVEs: CVE-2026-88771, CVE-2026-88772. CISA KEV/exploitation signal detected. Vendors: Palo Alto Networks, Citrix, Apache, PHP, Cloudflare. DORA relevance: medium.
Por qué importa
Dos vulnerabilidades zero-day críticas en NetScaler han sido explotadas in-the-wild y cuentan con señal de CISA KEV, lo que requiere triage y remediación inmediata.
Filtered for operational relevance. Powered by a curated catalog of vulnerability, CERT, vendor and threat-intelligence sources.View methodology →
La explotación activa de dos zero-days críticos en NetScaler exige detección, gestión y clasificación inmediata de la amenaza conforme a DORA, aunque no se ha confirmado impacto en la entidad.
DORA · Art. 10 Detection (direct) · Art. 13 Learning and evolving (direct) · Art. 17 ICT-related incident management process (direct)
[CISA KEV actively exploited] Vendor: Apache | Product: Tomcat | Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-08-07 | Ransomware use: Unknown | Added: 2026-08-04 CVEs: CVE-2026-34486. CISA KEV/exploitation signal detected. Vendors: Apache. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
[CISA KEV actively exploited] Vendor: Apache | Product: ActiveMQ | Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-04-30 | Ransomware use: Unknown | Added: 2026-04-16 CVEs: CVE-2026-34197. CISA KEV/exploitation signal detected. Vendors: Apache. DORA relevance: medium.
Por qué importa
Explotación activa confirmada. Riesgo material para entornos expuestos.
Acción recomendada
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
“Advanced and suspected state-sponsored threat actors” are likely to be behind the initial targeted intrusions that leveraged CVE-2026-88772, one of the two recently disclosed NetScaler vulnerabilities that have been exploited as zero-days, says Mandiant CTO Charles Carmakal. Mandiant and Google Threat Intelligence Group (GTIG) know of dozens of impacted organizations across North America and Europe, he added, “including in the government, financial services, education, telecommunications, and legal and professional services sectors.” Two NetScaler zero-days exploited … More → The post Suspected state-sponsored hackers exploited NetScaler zero-day since early September (CVE-2026-88772) appeared first on Help Net Security. CVEs: CVE-2026-88772, CVE-2026-88771. Vendors: Google, Citrix, GitHub, Apache, Kubernetes, PHP. DORA relevance: medium.
Por qué importa
Actores sospechosos respaldados por un Estado han explotado como zero-day vulnerabilidades críticas de NetScaler desde principios de septiembre, afectando a decenas de organizaciones.
Acción recomendada
Investiga inmediatamente la exposición a ambas CVE, aplica las mitigaciones o parches del fabricante y realiza búsqueda de compromiso en los dispositivos NetScaler.
La explotación activa de un zero-day crítico en NetScaler requiere evaluar y activar las obligaciones de reporte aplicables al fabricante, aunque no hay evidencia de afectación de datos personales.
CRA · Art. 14 Reporting obligations of manufacturers (direct)
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to the database, execute arbitrary code on the host with the highest level of privilege, or gain control of the physical access-control system. The following versions of Armatura LLC Armatura One are affected: Armatura One <4.7.2 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) Armatura One (USA) <4.6.1 (CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594) CVSS Vendor Equipment Vulnerabilities v3 9.8 Armatura LLC Armatura LLC Armatura One Deserialization of Untrusted Data, Use of Hard-coded Cryptographic Key, Use of Hard-coded Credentials, Insertion of Sensitive Information into Log File Background Critical Infrastructure Sectors: Communications, Critical Manufacturing, Energy, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2023-46604 Armatura One embeds Apache ActiveMQ, exposing its OpenWire protocol listener on the network by default. This embedded version is affected by CVE-2023-46604, a deserialization flaw in the OpenWire marshaller that allows an unauthenticated network attacker to trigger deserialization of an arbitrary object graph before authentication is checked. This can result in arbitrary code execution with the highest level of privilege on the host operating system. View CVE Details Affected Products Armatura LLC Armatura One Vendor: Armatura LLC Product Version: Armatura LLC Armatura One: <4.7.2, Armatura LLC Armatura One (USA): <4.6.1 Product Status: known_affected Remediations Vendor fix Armatura LLC Armatura One vers:all/<4.7.2: Armatura LLC has released Armatura One V4.7.2, which resolves this issue. Users should upgrade from V4.7.1 or earlier to V4.7.2. Vendor fix Armatura LLC Armatura One (USA) vers:all/<4.6.1: Armatura LLC has released Armatura One V4.6.1_USA, which resolves this CVEs: CVE-2023-46604, CVE-2026-94591, CVE-2026-94592, CVE-2026-94593, CVE-2026-94594. Vendors: Armatura LLC Product Version: Armatura LLC Armatura One: <4, GitHub, Apache.
Por qué importa
Las vulnerabilidades permiten la ejecución remota de código con privilegios de sistema y el control total de sistemas de acceso físico, afectando infraestructura crítica.
Acción recomendada
Actualice inmediatamente Armatura One a la versión 4.7.2 o superior y aísle los sistemas expuestos de redes públicas hasta completar el parcheo.
Vendors:Armatura LLCApacheSectores:CommunicationsCritical ManufacturingEnergyTransportation SystemsMITRE:T1190 Exploit Public-Facing ApplicationT1210 Exploitation of Remote ServicesCISO · Vulnerability Management · IT Ops
Mapeo regulatorio · riesgo 85
La vulnerabilidad crítica permite ejecución remota de código y control de sistemas de acceso físico, por lo que exige medidas inmediatas de gestión del riesgo y mitigación conforme a NIS2.
AI sovereignty is not a zero-sum game, but many governments now believe it is. Cloudflare's answer: more local open-source models, model-agnostic security tools, and a commitment to giving nations genuine choice. CVEs: CVE-2023-50387. Vendors: Microsoft, Google, AWS, CrowdStrike, Apple, Atlassian, GitHub, Apache, Mozilla, Kubernetes, Okta, WordPress, OpenSSL, PHP, Node.js, Python, IBM, Elastic, PostgreSQL, MySQL, NGINX, Grafana, HashiCorp, Cloudflare. DORA relevance: high.
Por qué importa
El informe aborda la soberanía de la IA y la seguridad en la cadena de suministro, destacando la necesidad de resiliencia operativa bajo marcos como DORA y NIS2 ante la dependencia de múltiples proveedores tecnológicos.
Acción recomendada
Audita el inventario de activos frente a la CVE-2023-50387 y revisa los controles de seguridad en la cadena de suministro de IA según las directrices de cumplimiento vigentes.
La presencia de la CVE-2023-50387 y la necesidad de revisar la gestión de vulnerabilidades hacen aplicable la divulgación coordinada de vulnerabilidades bajo NIS2, aunque no se evidencia explotación ni incidente.
NIS2 · Art. 12 Coordinated vulnerability disclosure and a European vulnerability database (direct)
Roughly a dozen vulnerabilities have been patched in each of the open source cryptographic libraries. The post High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL appeared first on SecurityWeek. CVEs: CVE-2026-84782, CVE-2026-84783, CVE-2026-93302, CVE-2026-89102, CVE-2026-89136. Vendors: Microsoft, Google, Apple, Citrix, Apache, OpenSSL, NGINX. DORA relevance: medium.
Por qué importa
Se han corregido aproximadamente una docena de vulnerabilidades de alta severidad en bibliotecas criptográficas ampliamente utilizadas, lo que puede afectar a múltiples productos y servicios dependientes.
Acción recomendada
Identifica las versiones afectadas de OpenSSL y WolfSSL en el inventario, valida la exposición de los activos y aplica las actualizaciones de seguridad disponibles con prioridad alta.
Cloudflare learns the structure of your HTTP requests and identifies deviations. You can add a positive security layer that helps reduce attack surface as AI makes it easier for attackers to generate and vary payloads. CVEs: CVE-2023-50387. Vendors: Microsoft, Google, AWS, CrowdStrike, Apple, Atlassian, GitHub, Apache, Mozilla, Kubernetes, Okta, WordPress, OpenSSL, PHP, Node.js, Python, IBM, Elastic, PostgreSQL, MySQL, NGINX, Grafana, HashiCorp, Cloudflare. DORA relevance: high.
Por qué importa
El reporte enfatiza la necesidad de implementar perfiles de seguridad positivos para mitigar el aumento de payloads generados por IA, destacando la importancia de la resiliencia operativa bajo el marco DORA.
Acción recomendada
Audita la exposición a CVE-2023-50387 en tu inventario de activos y evalúa la implementación de perfiles de seguridad positivos en Cloudflare para reducir la superficie de ataque.