CISA Adds Six Exploited Flaws in Outlook, Chrome, Barracuda, Cisco and Openwave to KEV Catalog

TL;DR

CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, 2026. The CISA KEV additions span Microsoft Outlook, Google Chrome, Barracuda appliances, Cisco BroadWorks and Openwave Webtop. Federal agencies must patch the two Barracuda flaws by November 13 and the other four by November 24.

Attackers are exploiting six flaws, including a Chrome zero-day and a Barracuda ESG root RCE chain. The Barracuda bugs carry an unusually short three-day deadline. Every organization running these products should patch now, not only federal agencies.

Notable CVEs

Why It Matters

A KEV listing means CISA has evidence of real-world attacks. Moreover, these six flaws hit email gateways, browsers, mail clients and VoIP platforms, which are common entry points. The short Barracuda deadline signals how urgent CISA considers that chain. So far, CISA lists ransomware use as “Unknown” for all six.

How the Attacks Work

Barracuda ESG chain

CVE-2026-116606 (CVSS 9.3) lets an unauthenticated attacker restore a crafted backup on the Email Security Gateway. Then CVE-2026-111560 (CVSS 8.6) injects OS commands through the timezone field, which run as root. Barracuda confirmed attacks on “a small number of organizations,” and watchTowr has published exploit code.

Google Chrome

CVE-2026-125350 (CVSS 8.8) is a use-after-free in Chrome’s XML component. Google says it “is aware that an exploit for CVE-2026-125350 exists in the wild.”

Microsoft Outlook

CVE-2026-124194 (CVSS 6.5) lets a crafted message file make Outlook connect to an attacker’s server “without displaying the usual external-content warning.” As a result, the victim’s NTLMv2 hash leaks, which attackers can use to impersonate the user. Microsoft notes the Preview Pane is not an attack vector.

Cisco BroadWorks

CVE-2026-20320 (CVSS 7.5) is a blind XXE flaw in the OCI-P service. An unauthenticated attacker can “view sensitive files from the filesystem.” Notably, Cisco fixed it in August, when it knew of no attacks.

Openwave Webtop

Finally, CVE-2026-111793 (CVSS 4.3) lets an authenticated user bypass file-type limits in the Media Transcoder.

Affected Versions

• Barracuda ESG before 9.4.0.030, plus several other Barracuda appliances for CVE-2026-111560
• Google Chrome before 157.0.8103.50
• Microsoft 365 Apps and Office LTSC 2021 and 2024
• Cisco BroadWorks platforms before RI.2026.07
• Openwave Webtop Media Transcoder before 1.1.22.0

Patch and Mitigation

Apply each vendor’s update and restart Chrome after it installs. For Barracuda ESG, also restrict admin interfaces and check for signs of compromise. Under BOD 26-04, CISA also points agencies to its “Forensics Triage Requirements.” Tracking CISA KEV additions closely helps teams set patch priorities.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.