4088
Noticias y alertas de seguridad informática. Chat y contacto: t.me/sysadmin24x7chat
Múltiples vulnerabilidades en EPMM de Ivanti
Fecha 30/01/2026
Importancia 5 - Crítica
Recursos Afectados
Ivanti Endpoint Manager Mobile:
12. 5 . 0 .0 y anteriores;
12. 6 . 0 .0 y anteriores;
12. 7 .0.0 y anteriores;
12. 5.1 .0 y anteriores;
12.6.1.0 y anteriores.
Descripción
Ivanti ha publicado dos vulnerabilidades de severidad crítica que, de ser explotadas, podrían permitir ejecución de código remoto no autenticado.
El fabricante ha identificado explotación activa en uno de sus usuarios.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-epmm-de-ivanti-0
AISLE Discovered 12 out of 12 OpenSSL Vulnerabilities
Author Stanislav Fort
Date Published January 26, 2026
Autonomous zero-day discovery in one of the most scrutinized codebases in the world
https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities
Oracle Critical Patch Update Advisory - January 2026
https://www.oracle.com/security-alerts/cpujan2026.html
[Actualización 22/01/2026] Omisión de autenticación en el inicio de sesión SSO en productos de Fortinet
Fecha 10/12/2025
Importancia 5 - Crítica
Recursos Afectados
Las versiones de los siguientes productos están afectados:
FortiOS:
De 7.6.0 a 7.6.3;
De 7.4.0 a 7.4.8;
De 7.2.0 a 7.2.11;
De 7.0.0 a 7.0.17.
FortiProxy:
De 7.4.0 a 7.4.10;
De 7.2.0 a 7.2.14;
De 7.0.0 a 7.0.21.
FortiSwitchManager:
De 7.2.0 a 7.2.6
De 7.0.0 a 7.0.5.
FortiWeb:
8.0.0;
De 7.6.0 a 7.6.4;
De 7.4.0 a 7.4.9.
Descripción
Yonghui Han y Theo Leleu, del equipo de Seguridad de Productos de Fortinet, han reportado 1 vulnerabilidad de severidad crítica que de ser explotada, podría permitir a un atacante, no autenticado, evitar la autenticación de inicio de sesión SSO de FortiCloud a través de un mensaje SAML diseñado.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/omision-de-autenticacion-en-el-inicio-de-sesion-sso-en-productos-de-fortinet
Ejecución remota de código en productos de Cisco
Fecha 22/01/2026
Importancia 5 - Crítica
Recursos Afectados
La vulnerabilidad afecta a los siguientes productos, independientemente de la configuración que tengan. Las versiones comprometidas en estos productos son: 12.5, 14.0 y 15.0.
Unified CM (CSCwr21851);
Unified CM SME (CSCwr21851);
Unified CM IM&P (CSCwr29216);
Webex Calling Dedicated Instance (CSCwr21851);
Unity Connection (CSCwr29208).
Descripción
Un investigador externo junto con la colaboración de Cisco han reportado 1 vulnerabilidad de severidad crítica que, en caso de ser explotada exitosamente, podría permitir a un atacante remoto no autenticado previamente, ejecutar comandos arbitrarios en el sistema operativo subyacente y obtener acceso de usuario para, posteriormente, elevar privilegios como root.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/ejecucion-remota-de-codigo-en-productos-de-cisco-0
CVE-2026-23745
Description
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97
https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e
IR Number FG-IR-25-084
Published Date Jan 13, 2026
Component OTHERS
Severity High
CVSSv3 Score 7.4
Impact Execute unauthorized code or commands
CVE ID CVE-2025-25249
https://www.fortiguard.com/psirt/FG-IR-25-084
Microsoft - January 2025 Security Updates
https://msrc.microsoft.com/update-guide/releaseNote/2026-Jan
Parche urgente para Apex Central: Trend Micro resuelve vulnerabilidad crítica de ejecución remota
https://unaaldia.hispasec.com/2026/01/parche-urgente-para-apex-central-trend-micro-resuelve-vulnerabilidad-critica-de-ejecucion-remota.html?utm_source=rss&utm_medium=rss&utm_campaign=parche-urgente-para-apex-central-trend-micro-resuelve-vulnerabilidad-critica-de-ejecucion-remota
n8n Vulnerable to RCE via Arbitrary File Write
Impact
n8n is affected by an authenticated Remote Code Execution (RCE) vulnerability.
Under certain conditions, an authenticated user may be able to cause untrusted code to be executed by the n8n service. This could result in full compromise of the affected instance.
Both self-hosted and n8n Cloud instances are impacted.
Patches
The issue has been resolved in n8n version 1.121.3.
Workarounds
If upgrading is not immediately possible, administrators can reduce exposure by disabling the Git node and limiting access for untrusted users.
https://github.com/advisories/GHSA-v364-rw7m-3263
Múltiples vulnerabilidades en routers de D-Link
Fecha 30/12/2025
Importancia 4 - Alta
Recursos Afectados
D-Link DIR-600, hasta 2.15WWb02;
D-Link DSL-124 ME_1.00, todas las versiones.
Descripción
D-Link ha reportado 2 vulnerabilidades de severidad alta que afectan a diversos routers de la marca D-Link y que pueden hacer que un atacante obtenga información de la configuración del router y/o controle las acciones que pueda realizar el dispositivo.
https://www.incibe.es/empresas/avisos/multiples-vulnerabilidades-en-routers-de-d-link
CVE-2025-14847
CNA: MongoDB, Inc.
CVSS-B 8.7 HIGH
Description
Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.
https://nvd.nist.gov/vuln/detail/CVE-2025-14847
https://jira.mongodb.org/plugins/servlet/mobile#issue/SERVER-115508
https://www.bleepingcomputer.com/news/security/mongodb-warns-admins-to-patch-severe-rce-flaw-immediately/
Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager
Advisory ID: cisco-sa-sma-attack-N9bf4
First Published: 2025 December 17 16:00 GMT
Version 1.0: Interim
Workarounds: No workarounds available
Cisco Bug IDs: CSCws36549
Vulnerable Products
This attack campaign affects Cisco Secure Email Gateway, both physical and virtual, and Cisco Secure Email and Web Manager appliances, both physical and virtual, when both of the following conditions are met:
The appliance is configured with the Spam Quarantine feature.
The Spam Quarantine feature is exposed to and reachable from the internet.
The Spam Quarantine feature is not enabled by default. Deployment guides for these products do not require this port to be directly exposed to the Internet.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
Boletín de seguridad de Android: diciembre de 2025
Publicado el 1 de diciembre de 2025 | Actualizado el 17 de diciembre de 2025
https://source.android.com/docs/security/bulletin/2025-12-01
Multiple India-based CCTV Cameras
Release DateDecember 09, 2025
Alert CodeICSA-25-343-03
Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems
EXECUTIVE SUMMARY
CVSS v4 9.3
ATTENTION: Exploitable remotely/Low attack complexity
Vendor: D-Link (India Limited), Sparsh Securitech, Securus CCTV
Equipment: DCS-F5614-L1
Vulnerability: Missing Authentication for Critical Function
RISK EVALUATION
Successful exploitation of this vulnerability could result in information disclosure including capture of camera account credentials.
https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-03
Two High-Severity n8n Flaws Allow Authenticated Remote Code Execution
CVE-2026-1470 (CVSS score: 9.9) - An eval injection vulnerability that could allow an authenticated user to bypass the Expression sandbox mechanism and achieve full remote code execution on n8n's main node by passing specially crafted JavaScript code
CVE-2026-0863 (CVSS score: 8.5) - An eval injection vulnerability that could allow an authenticated user to bypass n8n's python-task-executor sandbox restrictions and run arbitrary Python code on the underlying operating system.
https://thehackernews.com/2026/01/two-high-severity-n8n-flaws-allow.html
Administrative FortiCloud SSO authentication bypass
IR Number FG-IR-26-060
Published Date Jan 27, 2026
Component GUI
Severity Critical
CVSSv3 Score 9.4
Impact Improper access control
CVE ID CVE-2026-24858
Summary
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS, FortiManager, FortiAnalyzer may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Please note that the FortiCloud SSO login feature is not enabled in default factory settings. However, when an administrator registers the device to FortiCare from the device's GUI, unless the administrator disables the toggle switch "Allow administrative login using FortiCloud SSO" in the registration page, FortiCloud SSO login is enabled upon registration.
This vulnerability was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out on 2026-01-22. In order to protect its customers from further exploit, Fortinet disabled FortiCloud SSO on FortiCloud side on 2026-01-26. It was re-enabled on 2026-01-27 and no longer supports login from devices running vulnerable versions. Consequently, customers must upgrade to the latest versions listed below for the FortiCloud SSO authentication to function.
https://fortiguard.fortinet.com/psirt/FG-IR-26-060
VMSA-2024-0012:VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-37079, CVE-2024-37080, CVE-2024-37081)
Advisory ID: VMSA-2024-0012.1
Severity: Critical
CVSSv3 Range: 7.8-9.8
Synopsis: VMware vCenter Server updates address heap-overflow and privilege escalation vulnerabilities (CVE-2024-37079, CVE-2024-37080, CVE-2024-37081)
Issue date: 2024-06-17
CVE(s) CVE-2024-37079, CVE-2024-37080, CVE-2024-37081
Impacted Products
VMware vCenter Server
VMware Cloud Foundation
Introduction
Multiple heap-overflow and privilege escalation vulnerabilities in vCenter Server were responsibly reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453
Omisión de autenticación en telnetd
Fecha 22/01/2026
Importancia 5 - Crítica
Recursos Afectados
GNU InetUtils telnetd: versiones comprendidas entre la 1.9.3 y la 2.7 (ambas incluidas).
Descripción
Carlos Cortes Alvarez ha reportado una vulnerabilidad de severidad crítica, cuya explotación podría permitir a un atacante remoto eludir los mecanismos normales de autenticación y obtener acceso como root.
https://www.incibe.es/incibe-cert/alerta-temprana/avisos/omision-de-autenticacion-en-telnetd
Microsoft Releases Emergency Updates After Breaking Core Features
Microsoft has issued a series of emergency out-of-band updates to address serious problems introduced by the January 2026 Patch Tuesday updates.
https://www.ghacks.net/2026/01/20/microsoft-releases-emergency-updates-after-broking-core-features/
CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal
Description
A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.
https://security.paloaltonetworks.com/CVE-2026-0227
FG-IR-25-084 Heap-based buffer overflow in cw_acd daemon
CVE-2025-25249
Published: Jan 13, 2026
High Severity
FG-IR-25-783 SSRF in GUI console
CVE-2025-67685
Published: Jan 13, 2026
GUI
Low Severity
FG-IR-25-783 SSRF in GUI console
CVE-2025-67685
Published: Jan 13, 2026
GUI
Low Severity
https://www.fortiguard.com/psirt
Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/
Boletín de seguridad de Android, enero de 2026
https://source.android.com/docs/security/bulletin/2026/2026-01-01
Security Bulletin: Authentication bypass in IBM API Connect
Vulnerability Details
CVEID: CVE-2025-13915
DESCRIPTION: IBM API Connect could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.
CWE: CWE-305: Authentication Bypass by Primary Weakness
CVSS Source: IBM
CVSS Base score: 9.8
https://www.ibm.com/support/pages/node/7255149
CVE-2025-68613
Base Score: 9.9 CRITICAL
Description
n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system.
https://nvd.nist.gov/vuln/detail/CVE-2025-68613
WatchGuard Firebox iked Out of Bounds Write Vulnerability
Advisory ID WGSA-2025-00027
CVE CVE-2025-14733
Impact Critical Status Resolved
Product Family Firebox
Published Date 2025-12-18
Updated Date 2025-12-23
Workaround Available False
CVSS Score 9.3
Affected
This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.11.5 and 2025.1 up to and including 2025.1.3.
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027
SonicWall SMA1000 appliance local privilege escalation vulnerability
Advisory ID SNWLID-2025-0019
First Published 2025-12-17
Last Updated 2025-12-17
Workaround true
Status Applicable
CVE CVE-2025-40602
CWE CWE-862, CWE-250
CVSS v3 6.6
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019
Windows Admin Center Elevation of Privilege Vulnerability New Recently updated
CVE-2025-64669
Security Vulnerability
Released: Dec 9, 2025
Last updated: Dec 11, 2025
Assigning CNA Microsoft
CVE.org link CVE-2025-64669
Impact Elevation of Privilege
Max Severity Important
Weakness CWE-284: Improper Access Control
CVSS Source Microsoft
Metrics CVSS:3.1 7.8 / 6.8
https://msrc.microsoft.com/update-guide/es-es/vulnerability/CVE-2025-64669
Universal Boot Loader (U-Boot)
Release DateDecember 09, 2025
Alert CodeICSA-25-343-01
Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems
EXECUTIVE SUMMARY
CVSS v4 8.6
ATTENTION: Low attack complexity
Vendor: U-Boot
Equipment: U-Boot
Vulnerability: Improper Access Control for Volatile Memory Containing Boot Code
RISK EVALUATION
Successful exploitation of this vulnerability could result in arbitrary code execution.
https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-01