CISA ADDS SIX ACTIVELY EXPLOITED VULNERABILITIES TO KEV CATALOG

THREAT SUMMARY

Category: Known Exploited Vulnerabilities / Enterprise Security / Email Security / Browser Security / Communications Infrastructure
Affected Product(s): Cisco BroadWorks; Barracuda Networks Multiple Products; Openwave Messaging Limited Webtop Media Transcoder; Barracuda Networks Email Security Gateway; Microsoft Office Outlook; Google Chromium
CVE(s): CVE-2026-20320; CVE-2026-111560; CVE-2026-111793; CVE-2026-116606; CVE-2026-124194; CVE-2026-125350
Primary Risks: XML external entity processing weakness, OS command injection, incorrect resource transfer, authentication bypass, unsafe action without required user interaction, and use-after-free exploitation
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Organizations operating affected Cisco, Barracuda, Openwave, Microsoft, and Google products
Attack Vector(s): Not specified in the CISA alert
CVSS: Not listed in the CISA alert
CWE: Not listed in the CISA alert
CISA Action: Added all six vulnerabilities to the Known Exploited Vulnerabilities Catalog on November 10, 2026
Required Response: Federal Civilian Executive Branch agencies must prioritize remediation in accordance with Binding Operational Directive 26-04. CISA urges all organizations to prioritize remediation of KEV-listed vulnerabilities.

---

The Cybersecurity and Infrastructure Security Agency added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 10, 2026, based on evidence of active exploitation.

The additions affect Cisco BroadWorks, multiple Barracuda Networks products, Openwave Messaging Limited Webtop Media Transcoder, Barracuda Networks Email Security Gateway, Microsoft Office Outlook, and Google Chromium.

CISA identifies vulnerabilities of these types as frequent attack vectors for malicious cyber actors and warns that they pose significant risks to the federal enterprise.

Their placement in the KEV Catalog confirms that each vulnerability has crossed from disclosed security weakness into active exploitation and should receive immediate attention from affected organizations.

---

Vulnerability Details

CVE-2026-20320 — Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

CVE-2026-20320 affects Cisco BroadWorks and is identified by CISA as an Improper Restriction of XML External Entity Reference Vulnerability.

The vulnerability is now included in the KEV Catalog based on confirmed evidence of active exploitation.

Organizations operating affected Cisco BroadWorks environments should identify exposed systems, review applicable Cisco remediation guidance, and prioritize corrective action.

---

CVE-2026-111560 — Barracuda Networks Multiple Products OS Command Injection Vulnerability

CVE-2026-111560 affects multiple Barracuda Networks products and is identified by CISA as an OS Command Injection Vulnerability.

Its inclusion in the KEV Catalog confirms active exploitation and elevates the vulnerability to a high-priority remediation issue for organizations using affected Barracuda products.

Security teams should identify impacted systems, apply applicable vendor remediation, and review exposed systems for evidence of unauthorized activity.

---

CVE-2026-111793 — Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability

CVE-2026-111793 affects Openwave Messaging Limited Webtop Media Transcoder and is identified by CISA as an Incorrect Resource Transfer Between Spheres Vulnerability.

CISA added the vulnerability to the KEV Catalog based on evidence of active exploitation.

Organizations operating the affected product should determine exposure, follow applicable vendor guidance, and prioritize remediation.

---

CVE-2026-116606 — Barracuda Networks Email Security Gateway Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-116606 affects Barracuda Networks Email Security Gateway and is identified by CISA as an Authentication Bypass Using an Alternate Path or Channel Vulnerability.

The vulnerability is particularly significant because it affects an email-security platform responsible for protecting organizational messaging infrastructure.

CISA’s confirmed active-exploitation status places CVE-2026-116606 among the vulnerabilities organizations should address without delay.

Affected organizations should identify vulnerable ESG deployments, apply applicable remediation, and review relevant authentication and administrative activity for evidence of unauthorized access.

---

CVE-2026-124194 — Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

CVE-2026-124194 affects Microsoft Office Outlook and is identified by CISA as a Missing User Interaction for Potentially Unsafe Action Vulnerability.

CISA added the vulnerability to the KEV Catalog after confirming active exploitation.

Organizations using affected Outlook environments should prioritize applicable Microsoft remediation and ensure affected systems are included in enterprise vulnerability-management and compromise-assessment efforts.

---

CVE-2026-125350 — Google Chromium Use-After-Free Vulnerability

CVE-2026-125350 affects Google Chromium and is identified by CISA as a Use-After-Free Vulnerability.

The vulnerability has been added to the KEV Catalog based on evidence of active exploitation.

Organizations using Chromium-based environments should identify affected deployments, apply applicable security updates, and ensure browser patching reaches managed and remote systems.

---

Affected Products and Environments

The November 10 KEV additions span several major areas of enterprise technology:

• Cisco BroadWorks
• Barracuda Networks products
• Openwave Messaging Limited Webtop Media Transcoder
• Barracuda Networks Email Security Gateway
• Microsoft Office Outlook
• Google Chromium

The affected technologies include communications infrastructure, email security, messaging platforms, productivity software, and browser technology.

Organizations should verify whether any of these products exist within their environments and determine whether vulnerable systems were exposed before remediation.

Internet-facing infrastructure, security appliances, email systems, remote-user endpoints, and widely deployed browser environments should receive priority during asset identification and remediation.

---

Operational Impact

The six vulnerabilities represent multiple forms of security weakness across enterprise infrastructure.

CVE-2026-20320 involves improper restriction of XML external entity references. CVE-2026-111560 involves OS command injection. CVE-2026-111793 involves incorrect resource transfer between spheres. CVE-2026-116606 involves authentication bypass through an alternate path or channel. CVE-2026-124194 involves missing required user interaction for a potentially unsafe action. CVE-2026-125350 involves a use-after-free condition.

CISA has confirmed active exploitation of all six vulnerabilities.

That designation makes remediation an immediate operational priority rather than a routine maintenance issue.

Organizations should identify affected assets, prioritize exposed systems, apply available vendor fixes or mitigations, and assess whether vulnerable systems were accessed before remediation.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog identifies vulnerabilities that meet established criteria for real-world exploitation.

Potential additions must have:

• An assigned CVE identifier
• Evidence of exploitation
• Clear mitigation guidance

All six vulnerabilities added on November 10 meet those requirements.

For defenders, KEV status means:

• Active exploitation has been confirmed
• Affected systems should receive elevated remediation priority
• Publicly exposed assets require immediate attention
• Organizations should determine whether vulnerable systems were exposed before remediation
• Compromise assessment should be conducted where applicable
• Remediation decisions should reflect demonstrated attacker activity

---

Federal Response

Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies.

BOD 26-04 reinforces the role of the KEV Catalog in federal vulnerability prioritization and requires agencies to prioritize rapid remediation of high-risk vulnerabilities.

The directive specifically addresses KEV-listed CVEs affecting publicly exposed assets that grant total control of an asset after exploitation and establishes expectations for determining when agencies must assess whether threat actors compromised systems before patches were applied.

BOD 26-04 applies to FCEB agencies, while CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of vulnerabilities listed in the KEV Catalog.

The November 10 additions therefore represent immediate remediation priorities across affected federal environments and provide the same operational warning to private-sector organizations using the affected technologies.

---

Defensive Guidance

Organizations should identify affected systems and begin remediation according to applicable vendor guidance.

• Inventory Cisco BroadWorks deployments.
• Identify affected Barracuda Networks products.
• Review Barracuda Email Security Gateway systems.
• Identify Openwave Messaging Limited Webtop Media Transcoder deployments.
• Review Microsoft Office Outlook environments.
• Identify affected Google Chromium installations.
• Prioritize publicly exposed and externally accessible systems.
• Apply applicable security updates or vendor mitigations.
• Confirm remediation across production, branch, remote, and secondary environments.
• Review authentication and administrative activity where applicable.
• Examine system, application, security, and network logs for suspicious behavior.
• Preserve relevant evidence where compromise is suspected.
• Review connected systems if unauthorized access or execution activity is identified.
• Continue monitoring CISA and applicable vendor guidance.

Organizations should ensure that asset inventories include systems outside primary data centers, including remote endpoints, legacy systems, secondary sites, and externally hosted infrastructure.

---

Compromise Assessment

Remediation closes the known vulnerability, but organizations should also determine whether affected systems were accessed before corrective action was applied.

Because CISA has confirmed active exploitation of all six vulnerabilities, exposed systems should be reviewed for signs of compromise.

Security teams should examine available telemetry for:

• Unexpected authentication activity
• Unauthorized administrative access
• Unrecognized configuration changes
• Suspicious process execution
• Unexpected command activity
• Unusual application behavior
• Unauthorized access to email or messaging systems
• Unexpected network connections
• New or altered accounts
• Security-control modifications
• Suspicious browser or endpoint activity
• Evidence of lateral movement
• Activity occurring before remediation that cannot be attributed to authorized operations

Where suspicious activity is identified, organizations should preserve evidence, isolate affected assets where appropriate, revoke unauthorized sessions, rotate exposed credentials, and determine whether additional systems were affected.

---

30-Day Outlook

The six November 10 KEV additions affect technologies deployed across communications, email security, messaging, productivity, and browser environments.

Their confirmed exploitation status is expected to drive accelerated remediation across both government and private-sector networks.

Organizations with large or distributed environments should pay particular attention to systems that may fall outside centralized patch-management workflows.

Browser deployments, email infrastructure, communications platforms, security appliances, and remote endpoints can remain exposed if asset inventories are incomplete.

During the next 30 days, defenders should focus on identifying affected systems, applying applicable remediation, validating deployment, and reviewing systems that remained vulnerable during the exploitation period.

---

TRJ Verdict

CISA’s November 10 action places six actively exploited vulnerabilities across major enterprise technologies into the Known Exploited Vulnerabilities Catalog.

The affected products span Cisco BroadWorks, Barracuda Networks platforms, Openwave Messaging Limited Webtop Media Transcoder, Microsoft Office Outlook, and Google Chromium.

This is not a single-product security issue. The vulnerabilities reach communications infrastructure, email security, messaging systems, productivity software, and browser environments used throughout government and private-sector networks.

CISA has confirmed that these vulnerabilities are being actively exploited. That status establishes the operational priority.

Organizations should identify affected systems, apply applicable vendor remediation, review exposed assets for evidence of compromise, and verify that corrective action reaches every vulnerable deployment.

KEV status means the threat is active. Remediation and compromise assessment should follow accordingly.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---