Six Exploited CVEs Added to CISA KEV on Nov 10: Barracuda, Chrome, Outlook, Cisco BroadWorks, Openwave

CISA added six actively exploited flaws to the Known Exploited Vulnerabilities (KEV) catalog on Tuesday, November 10, 2026. Two Barracuda flaws, CVE-2026-116606 and CVE-2026-111560, are due on November 13. The other four are due on November 24: Google Chrome CVE-2026-125350, Microsoft Outlook CVE-2026-124194, Cisco BroadWorks CVE-2026-20320 and Openwave Webtop Media Transcoder CVE-2026-111793. Scores run from 4.3 to 9.3, and every one has a vendor fix.

Barracuda: CVE-2026-116606 and CVE-2026-111560

Barracuda's advisory, published November 2, 2026, covers two flaws. CVE-2026-116606 is a pre-authentication authorization bypass. Mandiant's disclosure says it lets an unauthenticated remote attacker invoke a configuration-import function and restore a crafted, compatible backup archive, which modifies the appliance's global configuration. It is rated 9.3 Critical (CVSS 4.0, CWE-288) and affects Email Security Gateway (ESG) earlier than 9.4.0.030. Barracuda corrected its own entry on November 5: no login is needed, but the administrative interface must be reachable by the attacker.

CVE-2026-111560 is rated 8.6 High (CVSS 4.0, CWE-78). Mandiant describes shell metacharacters left unneutralized in the timezone configuration field, so an authenticated administrator can inject operating-system commands that run as root when the value is processed. Six products are listed: ESG up to 9.4.0.27, Load Balancer ADC up to 6.4.0, Web Application Firewall up to 11.0.1, Web Security Gateway up to 16.1.100.100, Message Archiver up to 5.5.4.0 and WAF Control Center up to 2.2.1.

Barracuda says that used together, the two let an attacker bypass authorization and obtain root, and only ESG is affected by both. Mandiant's pages describe each flaw on its own, and no source we read explains how the restored configuration reaches the timezone injection. Treat the chain as the vendor's statement, not a published technique.

On exploitation, Barracuda added a note on November 9 saying it has identified exploitation activity affecting a small number of organizations. It does not say which CVE, since when, by whom, or give indicators of compromise. Version numbers also do not line up: Mandiant's ESG thresholds are 9.4.0.030 and 9.4.0.27, while Barracuda splits its ESG patches at 9.4.017. We could not reconcile them, so go by Barracuda's patch IDs below. SSVC reads Active and Total impact for both, Automatable for CVE-2026-116606 and Not automatable for CVE-2026-111560. VulnTracker shows EPSS at 1.6% and 1.1%.

Google Chrome: CVE-2026-125350

Google's stable channel update of Monday, November 9, 2026 fixes a High severity use after free in the XML component and says Google is aware that an exploit for it exists in the wild. The post credits an anonymous reporter on November 6. The CVE record describes a remote attacker executing arbitrary code inside the browser sandbox through a crafted HTML page (CWE-416). CISA's CVSS 3.1 score is 8.8 High, with user interaction required.

The fixed builds are 157.0.8103.50 and .51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out over days to weeks. The release carries nine security fixes. It also fixes a second XML use after free, CVE-2026-125346, reported by Arni Hardarson of Neonix Security on October 12, and Google does not tie that one to the exploit. Google has not said how the bug is abused or by whom. KrebsOnSecurity notes the fix also reaches Chromium-based browsers such as Edge. Press reports disagree on where this sits in the year's Chrome zero-day count (sixth in one, eighth in another), and Google's post gives no count, so we give none. SSVC reads Active, Not automatable, Total impact.

Microsoft Outlook: CVE-2026-124194

This is the one flaw Microsoft marked as exploited in its November 10 Patch Tuesday release, according to Cisco Talos and KrebsOnSecurity. The record describes a spoofing flaw in Outlook where the product user interface does not warn the user of unsafe actions, letting an unauthorized attacker spoof content over a network (CWE-356). Microsoft scores it 6.5 Medium on CVSS 3.1. Krebs lists Microsoft 365 Apps for Enterprise and editions of Office as affected, and VulnTracker's affected list covers 365 Apps, Office 2021 and Office 2024.

What we cannot tell you is the mechanism. Microsoft's advisory page needs JavaScript to render, so the description above comes from Talos, Krebs and VulnTracker's copy of the record, and nothing public explains which unsafe action goes unwarned or how attackers use it. SSVC reads Active, Not automatable, Partial impact, and VulnTracker shows no EPSS value for this entry yet. A Medium score on a flaw that is already exploited is the reason KEV exists, so rank it by the listing, not the number.

Cisco BroadWorks: CVE-2026-20320

Cisco's advisory, published August 19, 2026, describes an out-of-band blind XML external entity injection (CWE-611). The OCI-P provisioning service resolves external entities by default, so a crafted XML message from an unauthenticated remote attacker can read sensitive files with the privileges of the BroadWorks user. Cisco rates it 7.5 High (CVSS 3.1, AV:N/AC:L/PR:N/UI:N, confidentiality only). Four products are affected whatever their configuration: Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform. The first fixed release is RI.2026.07, and Cisco says there are no workarounds. One table row for the Application Delivery Platform reads RI.2026.071, which looks like a typo, so confirm it in the advisory.

At publication, Cisco said it was not aware of malicious use, and the advisory has no later revision. A Malbear Labs report dated November 8 describes a more than two-week intrusion into a European telecommunications provider and lists the BroadWorks XXE among the flaws used. That is the authors' own account of an AI-directed campaign and we could not verify it. THN says no public reports describe how CVE-2026-20320 is being exploited. SSVC reads Active, Automatable, Partial impact, and VulnTracker shows EPSS at 0.4%.

Openwave Webtop Media Transcoder: CVE-2026-111793

Openwave's public advisory, dated October 7, 2026, says Webtop Media Transcoder does not enforce administrator-defined file type restrictions, so an authenticated user who bypasses the Webmail interface may convert document types that were meant to be blocked. Versions before 1.1.22.0 are affected. The CVE record scores it 4.3 Medium (CVSS 3.1, AV:N/PR:L, availability impact low, CWE-669).

The sources do not line up. The advisory says 1.1.22.0 was released on December 6, 2021, while THN says the fix arrived in October 2026. The advisory's remediation line says to upgrade to the latest supported Media Server 2.0 release, not to 1.1.22.0. JVN labels the flaw Critical and says an authenticated attacker uploading a crafted file may obtain sensitive information, while the vector scores no confidentiality impact. The exploitation statement appears only on JVN, which relays that the developer states attacks have been observed, and the vendor advisory itself is silent. We treat it as reported by the developer. SSVC reads Active, Not automatable, Partial impact, and VulnTracker shows EPSS at 0.3%.

Every fix was public by listing day, from 83 days earlier to the same day

The Openwave row uses the advisory date because its fix date is contested, as covered above. The BroadWorks row is the instructive one. Cisco shipped RI.2026.07 on August 19 and said it knew of no malicious use. A team that patched on advisory day was covered 83 days before the listing, and a team that waited for a headline was not. For Chrome and Outlook the fix and the exploitation notice arrived together, so there was no quiet window at all.

The due dates split in two: November 13 for the Barracuda pair, November 24 for the rest. The SSVC labels on VulnTracker do not explain the split by themselves. CVE-2026-125350 and CVE-2026-111560 both read Active, Not automatable, Total impact, yet one is due November 24 and the other November 13, so we do not infer a rule from the labels. The practical reading is simpler: use your own exposure to rank these, starting with whatever sits on an internet-facing appliance.

Reading it on VulnTracker

A few things stand out as of November 11. The scores come from different parties: Barracuda's pair use CVSS 4.0 from Mandiant, Chrome's 8.8 is CISA's, and the rest are CVSS 3.1 from Microsoft, Cisco and MITRE, so compare them with care. EPSS is low wherever it appears and the top two Barracuda entries are the only ones at 1% or more, which again points to the KEV flag over the percentage. Every remediation guide field reads "No guide yet", and only the Outlook and BroadWorks pages carry a vendor advisory, so the fixes in this post come from the vendor pages in References.

Two data notes. On the Barracuda page, VulnTracker's confidence for Message Archiver, Web Application Firewall and Load Balancer ADC is 60%, 44% and 41%, because product naming varies, so use Barracuda's own product table. On the Outlook page, the 365 Apps range shows a link where a build number should be, so take build numbers from Microsoft's release notes. The Outlook page also carries a "Vendor: exploited" tag on Microsoft's advisory, which agrees with Talos and Krebs.

What to do

Work in due-date order, and within each date start with whatever faces the internet.

Barracuda (due November 13)

1. Apply Barracuda's patch for each product you run: ESG BNSF-40425 (9.4.017 and later) or BNSF-40430 (earlier than 9.4.017), Load Balancer ADC and Web Application Firewall BNADC-16586, Message Archiver BNMA-32468, WAF Control Center BNWF-60060, Web Security Gateway BNYF-24789.
2. If a patch was not applied automatically, apply it manually. Barracuda warns that devices several versions behind may need more than one update and points to Barracuda Support.
3. Restrict the administrative interface to trusted internal networks. Barracuda says this leaves you less exposed, not protected.
4. Barracuda published no indicators of compromise. As a suggestion of our own, review administrative interface access and configuration change history for restores or timezone changes you did not make.

Google Chrome (due November 24)

1. Update to 157.0.8103.50 or .51 on Windows and Mac, or .50 on Linux, then relaunch the browser.
2. Update Edge and other Chromium-based browsers as their fixes ship.

Microsoft Outlook (due November 24)

1. Install the November 10 security updates for Microsoft 365 Apps, Office 2021 and Office 2024. VulnTracker lists fixed builds 16.0.14334.21048 for Office 2021 and 16.0.17932.21140 for Office 2024, but check Microsoft's advisory because we could not read it.

Cisco BroadWorks (due November 24)

1. Upgrade to RI.2026.07 or later on Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform. Cisco lists no workaround, and customers without a service contract should contact Cisco TAC with the serial number and advisory link.
2. As our own guidance, if OCI-P was reachable from untrusted networks before you patched, treat configuration files and credentials readable by the BroadWorks user as exposed and rotate them.

Openwave Webtop Media Transcoder (due November 24)

1. Upgrade as Openwave directs, to the latest supported Media Server 2.0 release, and contact Openwave to confirm that your build is past the 1.1.22.0 threshold, since the sources conflict on the fix details.

Federal civilian agencies follow the required action in each KEV entry. Everyone else can adopt the same dates.

Takeaway

Six flaws, six fixes, two deadlines. The Cisco fix has been available since August and the Outlook and Chrome fixes since this week, so the work is applying them, not waiting for more detail. The public record is thin where it matters most: Barracuda has not said which of its two CVEs was exploited, Microsoft's mechanism is unpublished, and the Openwave details conflict. Patch first and read the post-mortems later. To follow these six and every other CISA addition, add them to your Track List on VulnTracker.

References

• Barracuda security advisory
• Mandiant disclosures: MNDT-2026-0042 and MNDT-2026-0041
• Cyber Security News report on the Barracuda flaws
• Google Chrome stable channel update, November 9, 2026
• Microsoft advisory for CVE-2026-124194
• Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt
• Malbear Labs, Operation Snowball
• Openwave public security advisory
• JVN VU#93403064
• CVE.org records: CVE-2026-116606, CVE-2026-111560, CVE-2026-125350, CVE-2026-124194, CVE-2026-20320, CVE-2026-111793
• NVD entries: CVE-2026-116606, CVE-2026-111560, CVE-2026-125350, CVE-2026-124194, CVE-2026-20320, CVE-2026-111793
• CISA KEV entries: CVE-2026-116606, CVE-2026-111560, CVE-2026-125350, CVE-2026-124194, CVE-2026-20320, CVE-2026-111793