CISA Flags Six Exploited Flaws: Patch Outlook, Chrome and Barracuda Appliances

CISA's alert lists the six additions as follows:

CISA's announcement names all six entries. It says they were added based on evidence of active exploitation. The alert does not list affected versions, attack details, or per-CVE deadlines, so the vendor-specific details below come from vendor statements and security researchers, and each claim is credited to its source.

Bottom line: These are six separate bugs in six products, grouped together only because they meet CISA's KEV criteria.

The Outlook zero-day: a moderate score with confirmed attacks​

CVE-2026-124194 matters most to Windows shops. Microsoft's November 2026 Patch Tuesday updates fix 1,094 vulnerabilities across its products, including an Outlook bug that the company says has been exploited. The zero-day has been classified as a spoofing flaw and stems from Outlook not alerting users before a potentially dangerous action takes place.

The attack works like this. Tenable says an attacker has to convince a target to open a crafted Office file. If that succeeds, the attacker gets the victim's valid NTLMv2 hash, which can then be used to impersonate the user in follow-on attacks. Greek outlet SecNews describes what happens once the file is opened: Outlook can connect to an attacker-controlled network location without showing the usual warning about external content.

Cybersecurity News reports that Microsoft rates it Moderate, with a CVSS score of 6.5, and identifies the underlying weakness as missing warnings about unsafe actions, tracked as CWE-356.

That moderate score is exactly why this one could get missed. Trinetri's Patch Tuesday breakdown makes the point directly: a CVSS-sorted list would bury the one flaw attackers are already using. A credential leak doesn't need a 9.8 score to cause trouble. A stolen NTLMv2 hash can be enough to get an attacker started inside a network.

Tenable adds an unusual detail: Microsoft's advisory credits the discovery to a security researcher who used Anthropic's Claude model, though the advisory doesn't name a specific version.

Affected builds. A CVE aggregator, Strix, quotes the CNA record as listing Microsoft 365 Apps for Enterprise, plus Microsoft Office LTSC 2021 >= 16.0.1, < 16.0.14334.21048 and Microsoft Office LTSC 2024 >= 16.0.0, < 16.0.17932.21140. Treat those as a starting point and confirm the exact builds in Microsoft's Security Update Guide before you close any tickets.

About the "1,093 vs. 1,094 vs. 1,235" confusion. Outlets don't agree on the size of this month's release. Tenable says Microsoft patched 1093 CVEs in its November 2026 Patch Tuesday release, SecurityWeek counts 1,094, and BleepingComputer reports security updates addressing a record-breaking 1,235 flaws. Patch Tuesday totals often differ depending on whether third-party and non-Windows CVEs are counted. For your patching plan, the totals don't matter much. The point every source agrees on is that this Outlook bug is the one being exploited.

The Chrome zero-day: Google's eighth of 2026​

CVE-2026-125350 is a use-after-free in Chrome's XML component, according to BleepingComputer. The outlet quotes Google saying it is aware that an exploit "exists in the wild." Google hasn't released details of the attacks and is keeping bug details restricted until most users are updated.

The fixed Stable Desktop releases are 157.0.8103.50/.51 for Windows and macOS and 157.0.8103.50 for Linux. Google says the rollout may take days or weeks, but BleepingComputer found the update was available immediately when it checked. BleepingComputer also counts this as the eighth actively exploited Chrome zero-day Google has patched in 2026.

Because the bug is in Chromium, other Chromium-based browsers, including Microsoft Edge, deserve a look. We found no Edge-specific fix notice for this CVE, so check Microsoft's Edge security release notes rather than assume the Chrome version numbers carry over.

The Barracuda pair: risky when chained​

CISA added two Barracuda CVEs at once. The most detailed public analysis so far comes from UK security firm CybaVerse:

• CVE-2026-116606 (ESG only): CybaVerse says Barracuda changed the CVE's "Authentication Required" field to "No (Administrative UI Access Required)." No login is needed, but the attacker has to be able to reach the Admin UI. The CVE record reportedly describes abusing a configuration import function to restore a crafted backup.
• CVE-2026-111560 (several products): CybaVerse calls it OS command injection through the timezone configuration field, letting an administrator run commands as root. It sits in shared code, so it affects ESG, Load Balancer ADC, WAF, Web Security Gateway, Message Archiver and WAF Control Center.
• Chained on ESG: CybaVerse says the first bug gets past the login and the second runs commands as root, giving the attacker full control of the appliance.

CybaVerse also reports that Barracuda updated its Trust Center advisory late on November 9 (US Eastern time) to say it had found exploitation activity affecting a small number of organizations. Barracuda didn't say which CVE was used or whether the two were chained, and it hasn't published indicators of compromise.

Fix guidance, with a discrepancy. Barracuda advises updating ESG to 9.4.0.029 or later. The CVE record, however, lists versions earlier than 9.4.0.030 as affected, one build later. CybaVerse's advice is to check what version each appliance actually reports after updating.

On the other products, the security patch doesn't change the firmware number. Checking the version alone can't confirm you're protected, so verify in each appliance's web interface that the patch is applied. Barracuda also recommends keeping admin interfaces on trusted internal networks.

One more caution from CybaVerse: patching stops new exploitation but doesn't remove an attacker who is already in. Anyone who remembers the 2023 Barracuda ESG incident knows that problem well.

Cisco BroadWorks and Openwave: little public detail​

For CVE-2026-20320 (Cisco BroadWorks XXE) and CVE-2026-111793 (Openwave Webtop Media Transcoder), our research turned up nothing beyond CISA's descriptions. If you run BroadWorks or Openwave messaging, check the vendor advisories directly for affected versions and fixes. We won't guess at them.

BOD 26-04: what applies to whom​

CISA's alert ties these additions to Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk." That directive applies only to Federal Civilian Executive Branch (FCEB) agencies.

According to CISA's directive page, issued June 10, 2026:

• It replaces BOD 19-02 and BOD 22-01 (the 2021 directive that created the KEV catalog).
• Deadlines aren't one-size-fits-all. They depend on whether the asset is publicly exposed, whether exploitation can be automated, and whether the attacker gains partial or total control.
• In certain high-risk cases, agencies have three days to remediate and must carry out a forensic triage to check whether the system was already compromised.
• Deadlines change when the facts change. For example, taking a system off the internet pushes the deadline back.

Strix reports a federal remediation date of Nov 24, 2026 for the Outlook entry. That date is not in CISA's alert, and under BOD 26-04 an agency's actual deadline depends on how exposed the asset is.

Everyone else is not legally bound by BOD 26-04. CISA does strongly recommend that all organizations, from state and local governments to private companies, monitor the KEV catalog and prioritize fixing its entries.

What Windows admins should do now​

1. Deploy the November Office/Outlook updates and check that installed builds are newer than the fixed versions in Microsoft's Security Update Guide. Prioritize this based on the active exploitation, not the 6.5 score.
2. Update Chrome to 157.0.8103.50/.51 or later (Help > About Google Chrome triggers the check), and check your managed fleet for machines that haven't restarted the browser to apply it. Separately confirm the status of Edge and other Chromium-based browsers.
3. List every Barracuda appliance you run, update ESG, confirm the patch is applied in the web interface on the other products, and take admin interfaces off the internet.
4. Hunt as well as patch on any Barracuda appliance whose admin UI was exposed to the internet. Patching won't evict an attacker who is already inside.
5. Check whether you run BroadWorks or Openwave, and if so, go straight to those vendors' advisories.
6. Use KEV status in your prioritization. CISA's KEV guidance recommends plugging the catalog into your vulnerability management framework and using patch tools that flag KEV entries automatically.

Analysis: the moderate-severity problem​

This batch shows a pattern defenders keep running into. The headline-grabbing critical RCE bugs in this month's Patch Tuesday, in Active Directory, Exchange, and Schannel, are rated "Exploitation More Likely." The one Microsoft bug that is actually being exploited is a moderate-rated Outlook spoofing flaw. Teams that sort patches by CVSS score alone are putting their effort in the wrong place.

The Barracuda pair shows the opposite trap. Each bug looks limited on its own: one needs admin UI access, the other needs admin rights. Chained together on an internet-facing ESG, they give an attacker root.

To sum up: patch Outlook, update your browsers, lock down your edge appliances, and use the KEV catalog to decide what comes first.