KEV catalogue: six vulnerabilities added on 10 November

On 10 November 2026, the US agency CISA (1) adds six vulnerabilities to its KEV (2) catalogue, on the basis of evidence of active exploitation. The catalogue feed, in version 2026.11.10 published the same day, gives for each CVE (3) the date added, the remediation deadline imposed on US federal civilian agencies, known as FCEB (4), whether a forensic triage is required, and known use by ransomware. The latter field reads “Unknown” for all six CVEs.

Two CVEs concern Barracuda Networks and share a three-day deadline, 13 November 2026, with a forensic triage requirement: CVE-2026-116606, specific to the Email Security Gateway mail gateway, known as ESG (5), and CVE-2026-111560, present in the ESG and in five other products from the vendor. The other four CVEs are due on 24 November 2026, without forensic triage.

Fig. 1. The six CVEs added on 10 November 2026, taken from the JSON feed of the KEV catalogue, version 2026.11.10.

Four of these CVEs have been fixed since 2 November: the Barracuda ones on 2 November, the Chromium one on 9 November, and the Outlook one on 10 November in Microsoft’s Patch Tuesday. The last two are older: the Cisco BroadWorks CVE dates from 19 August 2026, and the fix for the Openwave CVE has existed since 6 December 2021, the CVE only having been published in October 2026.

Binding Operational Directive BOD (8) 26-04, published by CISA on 10 June 2026, replaces directives BOD 22-01 and BOD 19-02. It no longer sets a single deadline per catalogue CVE: the remediation deadline depends, for each asset, on four variables. Is the asset publicly exposed; is the CVE in the KEV catalogue; can an attacker automate exploitation; is the technical impact partial or total control of the asset. CISA publishes the last two values in the record of each CVE, under its Vulnrichment programme, using the SSVC (9) method.

The “forensic triage” requirement means that, in addition to remediation within three days, the agency must determine whether the asset was compromised before the fix was applied.

Fig. 2. Remediation deadlines derived from Table 1 of BOD 26-04, using the SSVC values published by CISA as an ADP (10) in the records of the six CVEs on 10 November 2026.

The catalogue carries only one deadline per CVE. For CVE-2026-20320, that deadline, 24 November, corresponds to a non-exposed asset: a publicly exposed BroadWorks server falls, under Table 1, within a three-day deadline. The catalogue’s required action field leaves each organisation to assess the exposure of its own assets.

On 2 November 2026, Barracuda Networks publishes a security advisory covering two vulnerabilities. Both CVEs are assigned by Mandiant, acting as a CNA (11), which publishes its advisories MNDT-2026-0042 and MNDT-2026-0041 the same day. According to these advisories, Barracuda reported CVE-2026-111560 on 15 October and CVE-2026-116606 on 22 October.

Mechanism

• CVE-2026-116606, ESG only: an unauthenticated attacker invokes a configuration import function and restores a crafted, compatible backup archive, which changes the appliance’s global configuration; CWE-288
• CVE-2026-111560, six products: shell metacharacters are not neutralised in the timezone configuration field, found in code shared by several Barracuda products; an authenticated administrator injects OS commands, which run with root privileges when the value is processed; CWE-78
• on the ESG, the only product affected by both CVEs, chaining removes the authentication requirement of the second: Barracuda states that the two vulnerabilities combined allow authorisation controls to be bypassed and root access to the appliance to be obtained

On 5 November, Sina Kheirkhah of watchTowr Labs publishes an analysis of the chain based on a comparison of ESG versions 9.4.0.027, vulnerable, and 9.4.0.029, together with a tool published on GitHub that checks for the two CVEs by having a command chosen by the tool’s user executed. The chain restores, through the configuration import, a timezone value containing a shell command. watchTowr also notes a CVSS (12) score of 9.8 in a comment within Barracuda’s patch, which it attributes to both vulnerabilities being scored together.

Timeline

Fig. 3. Timeline drawn from the Barracuda advisory, Mandiant advisories MNDT-2026-0041 and MNDT-2026-0042, the watchTowr Labs analysis and the KEV catalogue.

Scores

Fig. 4. Scores taken from the Mandiant advisories and the CVE records; severity taken from the Barracuda advisory.

Affected products and fixes

Fig. 5. Fixes taken from the Barracuda advisory updated on 9 November 2026, versions taken from the Mandiant advisories and the CVE records; notation reproduced as published.

Barracuda publishes patch identifiers rather than fixed version numbers. Publications differ on which ESG version marks the fix: Mandiant states that versions earlier than 9.4.0.030 are vulnerable to CVE-2026-116606, watchTowr Labs gives the fix as 9.4.0.029, the version used in its comparison, and eSecurity Planet reports that Barracuda’s update documentation gives 9.4.0.029. The safest check is therefore for the presence of patch BNSF-40425 or BNSF-40430 on the appliance, rather than the version number alone.

Exploitation status

• Barracuda states, in the 9 November update to its advisory, that it has identified exploitation activity affecting a small number of organisations
• the advisory names no actor, victim or indicator of compromise, and does not specify which of the two CVEs, or their chaining, was used
• asked by The Register, Barracuda declines to give the number of organisations affected and says it worked directly with them
• CISA adds both CVEs to the catalogue with the forensic triage requirement

Measures

Barracuda recommends applying the patch manually if it has not been applied automatically, re-enabling automatic patch delivery if it has been turned off, checking that the appliance runs the latest firmware, as several successive updates may be needed on old firmware, and restricting access to administrative interfaces to trusted internal networks. Multi-factor authentication does not protect against CVE-2026-116606, which bypasses authentication itself.

Barracuda publishes no compromise assessment guidance. The mechanism described points the forensic triage towards the history of configuration imports and restores, the configured timezone value, access to the administrative interface from unexpected addresses, and outbound connections from the appliance. These leads are derived from the CVE descriptions; they are not indicators published by the vendor.

On 9 November 2026, Google publishes a Chrome update that fixes nine vulnerabilities, including CVE-2026-125350, a use-after-free, that is, the reuse of a memory area that has already been freed, in the XML component. Google rates it High, credits it to an anonymous report of 6 November 2026, and states that it is aware that an exploit exists in the wild. Details of bug 582442907 remain restricted.

According to the CVE record published by Google, the vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML (18) page. Compromising the workstation beyond the renderer process therefore requires a second vulnerability to escape the sandbox; Google does not say whether the observed exploitation includes one. CISA assigns a CVSS 3.1 score of 8.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Fig. 6. Fixed versions taken from the Chrome Releases blog, posts of 9 November 2026, and from the Microsoft Edge security release notes consulted on 11 November 2026.

• the same update fixes CVE-2026-125346, another use-after-free in the XML component, reported on 12 October by Arni Hardarson of Neonix Security and not reported as exploited
• the KEV catalogue states that the vulnerability may affect other Chromium-based browsers, including Microsoft Edge and Opera
• in its security release notes, Microsoft states on 9 November that it is aware of exploits in the wild and is preparing a fix for Edge
• BleepingComputer and SecurityWeek count CVE-2026-125350 as the eighth Chrome vulnerability exploited as a zero-day and fixed in 2026

CVE-2026-124194 is the only exploited vulnerability in Microsoft’s Patch Tuesday of 10 November 2026, covered on this blog the same day. An unauthenticated attacker sends a crafted message file and convinces the user to open it; Outlook then connects to a network location controlled by the attacker without displaying the external content warning, which discloses the user’s NTLM (19) hash in its NTLMv2 form.

Fig. 7. CVE-2026-124194 fact sheet, taken from Microsoft’s Security Update Guide and cross-checked against the CVE record and the KEV catalogue.

Alongside the Office update, the usual measures against NTLM hash leakage remain useful: blocking outbound SMB (21) traffic to the Internet, restricting outbound NTLM traffic through Group Policy, and adding privileged accounts to the Protected Users group.

Cisco BroadWorks is a telephony and unified communications platform for service providers. On 19 August 2026, Cisco publishes advisory cisco-sa-bworks-xxe-uwUd7CEt, which describes an “out-of-band blind” XXE (22) vulnerability: the XML parser of the Open Client Interface, known as OCI (23), allows external entity resolution by default. An unauthenticated remote attacker sends a crafted XML message to the Open Client Interface Provisioning service, known as OCI-P (24), and can read files on the system with the privileges of the BroadWorks user. The content read is not returned in the service’s response but exfiltrated through a secondary channel controlled by the attacker.

Fig. 8. CVE-2026-20320 fact sheet, taken from the Cisco advisory, version 1.0, and its CSAF (26) document, then cross-checked against the CVE record. The Application Delivery Platform footnote was read on the rendered page.

Exploitation status

Cisco’s advisory is still at version 1.0 of 19 August 2026 and states that the Cisco PSIRT (27) is not aware of any public announcement or malicious use. CISA recorded the exploitation as “active” in the CVE record on 10 November. As of the date of this article, no publication by Cisco, a researcher or the press documents the exploitation that led to the catalogue entry.

Measures

Upgrading to RI.2026.07 is the only fix recognised by Cisco. Limiting network access to the OCI-P service to provisioning clients only reduces exposure, without being a workaround in the sense of the advisory. XML messages sent to the OCI-P service that contain a DOCTYPE or ENTITY declaration, and unexpected outbound DNS (28) or HTTP (29) connections from BroadWorks servers, are the traces consistent with this type of exploitation.

Webtop Media Transcoder is the document conversion component of Webtop, Openwave Messaging’s webmail for service providers. Openwave advisory CAN-2026-2032674, dated 7 October 2026, states that the component does not enforce the file type restrictions defined by the administrator: an authenticated user can have unintended document types processed and converted by bypassing the webmail interface. The CVE, assigned by MITRE, is published on 16 October 2026.

Fig. 9. CVE-2026-111793 fact sheet, taken from the Openwave advisory and the CVE record.

JVN (30) note JVNVU#93403064, published on 9 November 2026 by JPCERT/CC (31) and IPA (32) following notification by Openwave, states that the developer has observed attacks exploiting the vulnerability. It describes the impact as follows: an authenticated attacker who uploads a crafted file by following a specific sequence of steps may obtain sensitive information. The note carries the label “Critical”.

The order below combines exploitation status, availability of a public tool, network exposure and impact. A product absent from the estate drops off the list.

Fig. 10. Proposed handling order based on the KEV catalogue, CISA’s SSVC values and the vendor advisories.

The dates, deadlines and catalogue fields come from the JSON feed of the KEV catalogue, version 2026.11.10, consulted directly. Scores, vectors, versions and SSVC values were taken from the vendor advisories and the CVE records, then cross-checked against each other. The press is used to cross-check exploitation status and for context.

1. CISA (1) : Cybersecurity and Infrastructure Security Agency, the US cybersecurity and infrastructure security agency.
2. KEV (2) : Known Exploited Vulnerabilities, CISA’s catalogue of vulnerabilities whose exploitation has been observed.
3. CVE (3) : Common Vulnerabilities and Exposures, public identifier assigned to a vulnerability.
4. FCEB (4) : Federal Civilian Executive Branch, the set of US federal civilian agencies subject to CISA directives.
5. ESG (5) : Email Security Gateway, Barracuda Networks’ mail filtering gateway.
6. CWE (6) : Common Weakness Enumeration, classification of software weaknesses.
7. XML (7) : Extensible Markup Language, markup language for structured data.
8. BOD (8) : Binding Operational Directive, CISA directive binding on US federal civilian agencies.
9. SSVC (9) : Stakeholder-Specific Vulnerability Categorization, decision-tree method for prioritising vulnerabilities, used by CISA.
10. ADP (10) : Authorized Data Publisher, body authorised to enrich CVE records; CISA publishes its Vulnrichment data in this capacity.
11. CNA (11) : CVE Numbering Authority, body authorised to assign CVEs and publish their records.
12. CVSS (12) : Common Vulnerability Scoring System, system for rating the severity of vulnerabilities.
13. ADC (13) : Application Delivery Controller, application load balancer; at Barracuda, Load Balancer ADC.
14. BMA (14) : Barracuda Message Archiver, Barracuda Networks’ mail archiving appliance.
15. WAF (15) : Web Application Firewall, firewall for web applications.
16. WCC (16) : WAF Control Center, Barracuda Networks’ centralised management console for its web application firewalls.
17. WSG (17) : Web Security Gateway, Barracuda Networks’ web filtering gateway.
18. HTML (18) : HyperText Markup Language, the language used to describe web pages.
19. NTLM (19) : NT LAN Manager, Windows challenge-response authentication protocol; NTLMv2 is its second version.
20. LTSC (20) : Long-Term Servicing Channel, long-term servicing channel for perpetual versions of Office.
21. SMB (21) : Server Message Block, Windows file and printer sharing protocol.
22. XXE (22) : XML External Entity, vulnerability that causes an XML parser to resolve an external entity chosen by the attacker, such as a local file.
23. OCI (23) : Open Client Interface, Cisco BroadWorks interface for client applications and service provider management systems.
24. OCI-P (24) : Open Client Interface Provisioning, provisioning service of the Cisco BroadWorks OCI interface.
25. OCS (25) : Open Client Server, Cisco BroadWorks component that exposes the OCI interface.
26. CSAF (26) : Common Security Advisory Framework, machine-readable format for security advisories.
27. PSIRT (27) : Product Security Incident Response Team, a vendor’s product security incident response team.
28. DNS (28) : Domain Name System, domain name resolution system.
29. HTTP (29) : HyperText Transfer Protocol, the web’s transfer protocol.
30. JVN (30) : Japan Vulnerability Notes, Japanese vulnerability publication portal, operated by JPCERT/CC and IPA.
31. JPCERT/CC (31) : Japan Computer Emergency Response Team Coordination Center, Japanese computer security incident response coordination centre.
32. IPA (32) : Information-technology Promotion Agency, Japanese agency for the promotion of information technology.

1. CISA, CISA Adds Six Known Exploited Vulnerabilities to Catalog, 10 November 2026. cisa.gov/news-events/alerts
2. CISA, Known Exploited Vulnerabilities Catalog, JSON feed, version 2026.11.10, 10 November 2026. cisa.gov/known-exploited-vulnerabilities-catalog
3. CISA, BOD 26-04: Prioritizing Security Updates Based on Risk, 10 June 2026. cisa.gov/news-events/directives
4. CVE Program, records of CVE-2026-116606, CVE-2026-111560, CVE-2026-125350, CVE-2026-124194, CVE-2026-20320 and CVE-2026-111793, with CISA ADP data, updated on 10 November 2026. cve.org
5. Barracuda Networks, Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products, 2 November 2026, updated on 5 and 9 November 2026. trust.barracuda.com/security
6. Mandiant, MNDT-2026-0042, CVE-2026-116606, 2 November 2026. github.com/mandiant/Vulnerability-Disclosures
7. Mandiant, MNDT-2026-0041, CVE-2026-111560, 2 November 2026. github.com/mandiant/Vulnerability-Disclosures
8. watchTowr Labs, Sina Kheirkhah, Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560), 5 November 2026. labs.watchtowr.com
9. watchTowr Labs, watchTowr-vs-Barracuda-RCE-CVE-2026-116606-CVE-2026-111560, GitHub repository, November 2026. github.com/watchtowrlabs
10. Google, Stable Channel Update for Desktop, Chrome Releases, 9 November 2026. chromereleases.googleblog.com
11. Google, Extended Stable Update for Desktop, Chrome Releases, 9 November 2026. chromereleases.googleblog.com
12. Google, Chrome for Android Update, Chrome Releases, 9 November 2026. chromereleases.googleblog.com
13. Microsoft, Release notes for Microsoft Edge Security Updates, page consulted on 11 November 2026. learn.microsoft.com/deployedge
14. Microsoft MSRC, CVE-2026-124194, Microsoft Outlook Spoofing Vulnerability, 10 November 2026. msrc.microsoft.com/update-guide
15. Cisco, Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability, cisco-sa-bworks-xxe-uwUd7CEt, version 1.0, 19 August 2026. sec.cloudapps.cisco.com
16. Openwave Messaging (Ireland) Ltd, Public Security Advisory CAN-2026-2032674, 7 October 2026. github.com/GISOpenwave
17. JPCERT/CC and IPA, JVNVU#93403064, Webtop Media Transcoder vulnerable to incorrect resource transfer between spheres, 9 November 2026. jvn.jp
18. BleepingComputer, Sergiu Gatlan, Hackers now exploit critical Barracuda ESG flaws to gain root access, 10 November 2026. bleepingcomputer.com
19. The Register, Barracuda’s email security gateways bitten by make-me-root vulns, 10 November 2026. theregister.com
20. SecurityWeek, Barracuda ESG Authentication Bypass Flaw Opens Path to Root, November 2026. securityweek.com
21. eSecurity Planet, Barracuda Patches Two Flaws That Could Give Hackers Root Access, 4 November 2026. esecurityplanet.com
22. BleepingComputer, Sergiu Gatlan, Google patches eighth Chrome zero-day exploited in attacks this year, 10 November 2026. bleepingcomputer.com
23. SecurityWeek, Chrome Update Patches Exploited XML Zero-Day, Eighth This Year, 10 November 2026. securityweek.com