Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-69836] Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c…

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-65801] Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to e…

Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63509] Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over…

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 3 días

CVE-2026-33824 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-33824 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73296] Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_t…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

rce Microsoft MSRC

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-47705] TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result ex…

TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result export functionality. The application does not sanitize or escape user-supplied input when generating CSV files. An attacker can inject spreadsheet formulas into input fields, which are later executed when an administrator opens the exported CSV in spreadsheet software such as Microsoft Excel or Libre…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-70306] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-62815] Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-59124] Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unaut…

Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

G Crítico vulnerabilidad

11/08/2026

CVE-2026-70339 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70339 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

edgerce Microsoft MSRC

M Crítico vulnerabilidad

11/08/2026

CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

10/08/2026

CVE-2021-34474 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2021-34474 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

rce Microsoft MSRC

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de SSRF en Microsoft Office SharePoint permite acceso no autorizado

Una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en Microsoft Office SharePoint con puntuación CVSS 9.6 permite a atacantes no autorizados ejecutar solicitudes maliciosas y realizar suplantación de identidad en la red. Esta falla afecta directamente a infraestructuras colaborativas en empresas de México y LATAM que dependen de SharePoint para gestión de contenido y portal corporativo.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de escalada de privilegios en Microsoft Teams (CVE-2026-65667)

Microsoft Teams presenta una falla de autorización que permite a atacantes no autorizados escalar privilegios sobre la red con puntuación CVSS 10.0. Esta vulnerabilidad afecta directamente a organizaciones en México y Latinoamérica que dependen de Teams para comunicaciones empresariales y colaboración. El impacto potencial incluye acceso no autorizado a datos sensibles, comunicaciones y recursos compartidos dentro del ecosistema corporativo.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62873] Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorize…

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62896] Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over …

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-63508] Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthori…

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-59115] '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to el…

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD