Technology
CISA adds six actively exploited vulnerabilities to its KEV catalogue, including Barracuda, Chromium and Outlook
CISA added six actively exploited flaws to its Known Exploited Vulnerabilities catalogue on November 10; the two Barracuda entries have a three-day deadline of November 13 for U.S. federal civilian agencies.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six already-exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue on Tuesday, November 10, 2026. Two concern Barracuda Networks products and have a remediation deadline of just three days, until Friday, November 13. The other four, in Google’s Chromium, Microsoft’s Outlook, Cisco BroadWorks and Openwave’s Webtop Media Transcoder, are due by Tuesday, November 24.
The deadline binds only the non-military federal agencies of the U.S. executive branch (FCEB), under directive BOD 26-04 on prioritising security updates by risk. For the two Barracuda entries the catalogue also asks for forensic triage, that is, examining the devices for traces of compromise. For all six entries, use in ransomware attacks is recorded as unknown.
The Barracuda pair
The most urgent case is a pair of flaws that combine into one attack chain. CVE-2026-116606 concerns the Barracuda Email Security Gateway (ESG), the email protection appliance. It is an authentication bypass: an attacker without an account can call the configuration import function, restore a specially crafted backup file and change the appliance’s global settings without authorisation. Barracuda scores it 9.3 out of 10 and clarifies that the attack requires no authentication but does require access to the appliance’s management interface.
The second, CVE-2026-111560, is an operating-system command injection through the time zone field. An attacker with administrator rights can insert commands that run with root privileges when the malicious value is later processed. It is scored 8.6 and, besides the ESG, affects five more products of the company: Load Balancer ADC, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway. Exploited together, they give the attacker root access to the device.
The two flaws were disclosed on November 2 and Barracuda has released a separate fix package for each product. On Monday, November 9 the company added to its announcement that it had identified exploitation activity affecting a small number of organisations. It recommends restricting access to management interfaces to trusted internal networks.
Chromium, Outlook and the rest
In Chromium, the base of the Chrome, Edge and Opera browsers, CVE-2026-125350 is a use-after-free memory bug in the XML component. A specially crafted web page can lead to code execution inside the browser’s sandbox. Google said it is aware that an exploit is being used in real attacks. The fix is in version 157.0.8103.50 for Linux and 157.0.8103.50/.51 for Windows and Mac, released on Monday, November 9 together with eight other fixes.
In Outlook, CVE-2026-124194 is a spoofing vulnerability with a score of 6.5, which Microsoft recorded as already exploited in its November 10 bulletin. The attacker sends a crafted message file and persuades the user to open it. Outlook then connects to a network location controlled by the attacker without the usual warning about external content, with the risk of leaking the user’s NTLMv2 hash, with which the attacker can authenticate as that user.
The other two entries are lower profile. CVE-2026-20320 in Cisco BroadWorks, the communications platform for telephony providers, is an XXE (XML external entity) flaw in the OCI-P service: an unauthenticated remote attacker can use a crafted XML message to read files with sensitive configuration. Cisco disclosed it on August 19 and the fix comes with version RI.2026.07. CVE-2026-111793 in the Openwave Webtop Media Transcoder lets an authenticated user who bypasses the Webmail environment process and convert document types that were not intended. Its score is 4.3 and the remedy is to upgrade to the latest supported Media Server 2.0 version.
The six flaws follow the OpenSSH, GPUStack and FreeSWITCH additions of the previous day. Recent weeks also brought to the catalogue the Apple and SonicWall SonicOS SSLVPN flaws.
