On November 10, 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. They affect Google Chromium, Barracuda Networks appliances (two flaws that can be chained), Cisco BroadWorks, Openwave Messaging Limited Webtop Media Transcoder and Microsoft Office Outlook. The two Barracuda entries carry a federal deadline of November 13, 2026.
CISA’s remediation dates are binding only for US federal civilian agencies. For everyone else they are a useful benchmark for how quickly to act. The Barracuda deadline gives agencies three days. The other four entries are due November 24, 2026. For all six, CISA lists known use in ransomware campaigns as unknown.
| CVE | Vendor and product | Weakness | Added | US federal deadline | Known ransomware use |
|---|---|---|---|---|---|
| CVE-2026-125350 | Google Chromium | Use-After-Free | 2026-11-10 | 2026-11-24 | Unknown |
| CVE-2026-116606 | Barracuda Networks Barracuda Email Security Gateway (ESG) | Authentication Bypass Using an Alternate Path or Channel | 2026-11-10 | 2026-11-13 | Unknown |
| CVE-2026-111560 | Barracuda Networks Multiple Products | OS Command Injection | 2026-11-10 | 2026-11-13 | Unknown |
| CVE-2026-20320 | Cisco BroadWorks | Improper Restriction of XML External Entity Reference | 2026-11-10 | 2026-11-24 | Unknown |
| CVE-2026-111793 | Openwave Messaging Limited Webtop Media Transcoder | Incorrect Resource Transfer Between Spheres | 2026-11-10 | 2026-11-24 | Unknown |
| CVE-2026-124194 | Microsoft Office | Missing User Interaction for Potentially Unsafe Action | 2026-11-10 | 2026-11-24 | Unknown |
CISA’s required action is the same for every entry. Apply mitigations as the vendor instructs, in line with Binding Operational Directive 26-04 and CISA’s forensics triage requirements. For cloud services, follow the directive’s guidance. If no mitigation exists, stop using the product.
Barracuda Networks: Two Flaws That Work Together
CVE-2026-116606 lets an attacker skip authentication on the Email Security Gateway. The attacker does not need to log in and can work remotely. They can reach a configuration-import function and load a crafted backup archive, which changes the appliance’s global settings.
CVE-2026-111560 is a command injection flaw. An authenticated administrator can plant a malicious timezone value. When the device later processes that value, the injected commands run with root privileges. This flaw affects the ESG, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall and Web Security Gateway.
CISA notes that the two flaws can be chained. Anyone running these appliances should apply the vendor’s update or mitigation first, ahead of the other entries in this brief.
Google Chromium: Malicious Webpages
CVE-2026-125350 is a use-after-free bug in Chromium’s XML component. A remote attacker can use a specially crafted webpage to run arbitrary code inside the browser sandbox. The flaw can reach several Chromium-based browsers, including Google Chrome, Microsoft Edge and Opera. Update every Chromium-based browser in use, and confirm that each one restarts so the update takes effect.
Cisco BroadWorks: Configuration Exposure
CVE-2026-20320 is an XML external entity flaw in Cisco BroadWorks. An attacker does not need to log in and can work remotely. They can read sensitive configuration information from an affected system. Service providers and organizations that run BroadWorks should apply Cisco’s update or mitigation. They should also review whether any exposed configuration data needs to be rotated.
Openwave Webtop Media Transcoder: Unintended File Processing
CVE-2026-111793 affects Openwave Messaging Limited’s Webtop Media Transcoder. A logged-in user who goes around the normal Webmail interface may get the transcoder to process and convert document types it should not handle. Operators of Openwave webmail platforms should apply the vendor’s fix or mitigation.
Microsoft Outlook: Spoofing Without a Prompt
CVE-2026-124194 is a flaw in Microsoft Office Outlook. Outlook performs a potentially unsafe action without asking the user first. An attacker can use this to carry out spoofing over a network. Because Outlook is so widely used, small businesses should make sure Office updates are installed on every machine.
What to Do This Week
- Find every Barracuda ESG, Load Balancer, ADC, Message Archiver, WCC, WAF and WSG device. Apply the vendor’s fix or mitigation by November 13.
- Update Chrome, Edge, Opera and any other Chromium-based browsers, and confirm each one has restarted.
- Install the latest Microsoft Office updates on all systems that run Outlook.
- Check whether you run Cisco BroadWorks or Openwave Webtop Media Transcoder, and patch both before November 24.
- If a product has no available mitigation, follow CISA’s advice and take it out of service.
FAQ
– Are these flaws being used in ransomware attacks?
CISA lists ransomware use as unknown for all six entries. It has confirmed that each one is being exploited.
– Why is the Barracuda deadline so short?
CISA set November 13, 2026, three days after listing, for both Barracuda flaws. The two can be chained, and the first one requires no login.
Sources
- Known Exploited Vulnerabilities Catalog — CISA
- CVE-2026-125350 Detail — NVD
- CVE-2026-116606 Detail — NVD