Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

CISA adds six exploited flaws to its KEV catalogue

Part of the CVE-2026-116606 story · since 2 Nov

Developinglatest 14 hours ago9 articles5 outlets
2 Nov · SecurityOnline first7 Nov9 NovNowThis article8th of 9
  • Mon 2 Nov, 17:00 UTC. SecurityOnline, first report. Barracuda fixes flaws that could give attackers appliance root access. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 18:00 UTC. The Hacker News, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:01 UTC. SecurityWeek, its first report on the story. Barracuda patches ESG flaws that can enable root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 22:30 UTC. Security Affairs, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 08:00 UTC. The Hacker News. Researchers chain Barracuda flaws for unauthenticated root access. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 04:00 UTC. SecurityOnline. Attackers exploit Barracuda ESG flaws after PoC release. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:32 UTC. CISA, its first report on the story. CISA flags actively exploited Barracuda email gateway flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 8th of 9.
  • Wed 11 Nov, 08:30 UTC. SecurityWeek. Barracuda flaws exploited to gain root access to devices. Cites a CVE in CISA KEV.

CISA has added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, with the moves announced on 10 November 2026. The flaws affect Microsoft Outlook, Google Chrome, Barracuda Email Security Gateway (ESG) and Barracuda appliances, Cisco BroadWorks, and Openwave Webtop. The KEV listing signals verified real‑world exploitation; CISA notes that the six flaws span email gateways, browsers, mail clients and VoIP platforms, underscoring urgent patching priority.

The vulnerabilities are CVE-2026-116606 (Barracuda ESG), CVE-2026-125350 (Chrome), CVE-2026-111560 (Barracuda appliances), CVE-2026-20320 (Cisco BroadWorks OCI‑P), CVE-2026-124194 (Microsoft Outlook), and CVE-2026-111793 (Openwave Webtop). The highest CVSS score among them is 9.3 for CVE-2026-116606. Notably, the Barracuda flaws carry a particularly tight remediation deadline.

In terms of impact and remediation, the Barracuda ESG chain (CVE-2026-116606 followed by CVE-2026-111560) has been demonstrated to enable an unauthenticated attacker to restore a crafted backup and then execute OS commands as root, with predicates observed in the wild.

Google Chrome (CVE-2026-125350) features a use‑after‑free in the XML component; Microsoft Outlook (CVE-2026-124194) can leak NTLMv2 hashes via a crafted message, bypassing external-content warnings; Cisco BroadWorks (CVE-2026-20320) presents a blind XXE flaw allowing access to filesystem files; Openwave Webtop (CVE-2026-111793) allows an authenticated user to bypass file‑type restrictions in the Media Transcoder.

Affected versions include Barracuda ESG before 9.4.0.030 (and related ESG‑family components for CVE-2026-111560), Google Chrome before 157.0.8103.50, Microsoft 365 Apps and Office LTSC 2021/2024, Cisco BroadWorks RI.2026.07 and Openwave Webtop Media Transcoder before 1.1.22.0.

Patching guidance emphasises applying vendor updates and restarting affected Chrome instances; for Barracuda ESG, organisations should also restrict admin interfaces and scan for signs of compromise, in line with CISA’s Forensics Triage guidance. The six patches require prioritisation, with Barracuda deadlines by 13 November and the remaining four by 24 November 2026.

How the story developed

All 9 articles
Developinglatest 14 hours ago9 articles5 outlets

9 articles from 5 outlets since 2 Nov. Picked up again on 10 Nov after 4 days quiet. This was the 8th report, 8 days after the first.

Now2 Nov45611First reportSecurityOnline · 2 Nov, 17:00This article8th of 9 · day 9CISA alert10 Nov, 20:32 · official
  • Mon 2 Nov, 17:00 UTC. SecurityOnline, first report. Barracuda fixes flaws that could give attackers appliance root access. Cites a CVE in CISA KEV.
  • Tue 3 Nov, 18:00 UTC. The Hacker News, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 15:01 UTC. SecurityWeek, its first report on the story. Barracuda patches ESG flaws that can enable root access. Cites a CVE in CISA KEV.
  • Wed 4 Nov, 22:30 UTC. Security Affairs, its first report on the story. Barracuda flaws can be chained to gain root access. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 08:00 UTC. The Hacker News. Researchers chain Barracuda flaws for unauthenticated root access. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 04:00 UTC. SecurityOnline. Attackers exploit Barracuda ESG flaws after PoC release. Cites a CVE in CISA KEV.
  • Tue 10 Nov, 20:32 UTC. CISA, its first report on the story. CISA flags actively exploited Barracuda email gateway flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 11 Nov, 01:30 UTC. SecurityOnline. CISA adds six exploited flaws to its KEV catalogue. Cites a CVE in CISA KEV. This article, 8th of 9.
  • Wed 11 Nov, 08:30 UTC. SecurityWeek. Barracuda flaws exploited to gain root access to devices. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Mon 2 NovDay 01
    1. Barracuda fixes flaws that could give attackers appliance root access17:00 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
  2. Tue 3 NovDay 11
    1. Barracuda flaws can be chained to gain root access18:00 · The Hacker News · Known exploited CVE
  3. Wed 4 NovDay 22
    1. Barracuda patches ESG flaws that can enable root access15:01 · SecurityWeek · Known exploited CVE
    2. Barracuda flaws can be chained to gain root access22:30 · Security Affairs · Known exploited CVE
  4. Fri 6 NovDay 41
    1. Researchers chain Barracuda flaws for unauthenticated root access08:00 · The Hacker News · Known exploited CVE

  5. Quiet for 4 days

    Tue 10 NovDay 82
    1. Attackers exploit Barracuda ESG flaws after PoC release04:00 · SecurityOnline · Picked up again · Known exploited CVE
    2. CISA flags actively exploited Barracuda email gateway flaw in KEV20:32 · CISA · official · CISA alert · Known exploited CVE
  6. Wed 11 NovDay 92
    1. CISA adds six exploited flaws to its KEV catalogue01:30 · SecurityOnline · Known exploited CVE · This article, 8th of 9
    2. Barracuda flaws exploited to gain root access to devices08:30 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in