The US Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, saying it has evidence that attackers are already exploiting each one. The additions, published on 10 November 2026, cover Microsoft Outlook, Google Chrome, Barracuda appliances, Cisco BroadWorks and Openwave Messaging software. A KEV listing is not a theoretical warning: CISA adds a flaw only when it has evidence of real-world attacks, and US federal civilian agencies must fix listed flaws by the deadline CISA sets. [CISA](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog) ## The six flaws added on 10 November The six additions are CVE-2026-116606, an authentication bypass in the Barracuda Email Security Gateway rated 9.3; CVE-2026-111560, an operating system command injection flaw affecting several Barracuda products, rated 8.6; CVE-2026-125350, a use-after-free flaw in Google Chromium, rated 8.8; CVE-2026-20320, an XML external entity flaw in Cisco BroadWorks, rated 7.5; CVE-2026-124194, a spoofing flaw in Microsoft Outlook, rated 6.5; and CVE-2026-111793, a flaw in the Openwave Messaging Webtop Media Transcoder, rated 4.3. CISA lists known ransomware use as unknown for all six. [SecurityOnline.info](https://securityonline.info/cisa-kev-six-vulnerabilities-november-2026/) ## Barracuda flaws carry a three-day deadline The two Barracuda flaws carry the shortest deadline in the batch: US federal civilian agencies must patch them by 13 November 2026, three days after they were added. The pair is dangerous because the flaws chain together. CVE-2026-116606 is a pre-authentication authorisation bypass in the Email Security Gateway that lets an unauthenticated attacker restore a crafted configuration backup, and CVE-2026-111560 is a command injection flaw in the timezone setting that then runs commands with root privileges. Barracuda released patches on 2 November, and on 9 November it updated its advisory to say it had found exploitation activity affecting a small number of organisations. Security researchers at watchTowr had already published technical details and proof-of-concept code. CVE-2026-116606 affects the Email Security Gateway only, while CVE-2026-111560 also affects the Load Balancer ADC, Message Archiver, Web Application Firewall, WAF Control Center and Web Security Gateway. [SecurityOnline.info](https://securityonline.info/cisa-kev-six-vulnerabilities-november-2026/) ## Outlook and Chrome flaws affect everyday users The Outlook flaw, CVE-2026-124194, is the only flaw in Microsoft's November Patch Tuesday release that Microsoft says is already being exploited. An attacker sends a specially crafted message file and persuades the user to open it, and Outlook then connects to an attacker-controlled network location without showing the usual external-content warning. That connection can disclose the user's NTLMv2 hash, which an attacker can use to impersonate the user. Microsoft says the flaw cannot be triggered through the Preview Pane, and it affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The Chrome flaw, CVE-2026-125350, is a use-after-free bug in Chrome's XML component. Google fixed it in Chrome 157.0.8103.50 and said it was aware that an exploit for the flaw exists in the wild. [The Hacker News](https://thehackernews.com/2026/11/microsoft-patches-1259-flaws-including.html) ## Cisco and Openwave flaws were patched months ago The Cisco and Openwave flaws show why old patches still matter. CVE-2026-20320 is an unauthenticated XML external entity flaw in the Open Client Interface XML parser of Cisco BroadWorks that lets a remote attacker read sensitive configuration information. Cisco fixed it in August 2026, when it knew of no attacks. Researchers at Malbear Labs have since linked exploitation of the flaw to an AI-driven campaign against a European telecoms provider and 13 organisations using its infrastructure. CVE-2026-111793 affects the Openwave Messaging Webtop Media Transcoder and lets an authenticated user process unintended document types by bypassing the webmail experience. Japan Vulnerability Notes reported that the developer had observed attacks exploiting it, and the fix shipped in October 2026. [The Hacker News](https://thehackernews.com/2026/11/cisco-broadworks-and-openwave-flaws.html) ## What organisations should do Under Binding Operational Directive 26-04, US federal civilian agencies must patch the two Barracuda flaws by 13 November and the other four by 24 November. CISA encourages all organisations, not only federal agencies, to treat KEV entries as patch-now priorities. That means applying each vendor's update, restarting Chrome after it installs, restricting Barracuda admin interfaces to trusted networks, and checking systems for signs of compromise before patching, as CISA's forensics triage requirements set out. A flaw reaches the KEV catalog because attackers are using it now, so the window for patching is measured in days, not months. [CISA](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog)