CISA's November 2026 KEV Update: Six Actively Exploited CVEs Across Cisco, Barracuda, Microsoft, and Google Chrome
Executive Summary
Executive Summary In November 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning products from Cisco, Barracuda Networks, Openwave, Microsoft, and Google. The affected CVEs include an XML External Entity flaw in Cisco BroadWorks (CVE-2026-20320), two Barracuda vulnerabilities covering OS command injection and authentication bypass in Email Security Gateway (CVE-2026-111560, CVE-2026-116606), a media transcoder resource mishandling flaw in Openwave (CVE-2026-111793), a missing user-interaction protection in Microsoft Outlook (CVE-2026-124194), and a use-after-free vulnerability in Google Chromium (CVE-2026-125350). These vulnerabilities span initial access, privilege escalation, and remote code execution across email, browser, and network infrastructure attack surfaces, posing acute risk to federal and enterprise environments.
This catalog addition reflects an accelerating trend of threat actors weaponizing known vulnerabilities in widely deployed enterprise software—particularly email gateways, communication platforms, and browsers—before patches are broadly applied. With BOD 26-04 now mandating risk-prioritized remediation for federal agencies, organizations across all sectors face mounting pressure to close these gaps quickly or risk catastrophic compromise.
Why This Matters Now
Why This Matters NowSix vulnerabilities across critical enterprise platforms—Cisco, Barracuda, Microsoft Outlook, and Google Chrome—are being actively exploited in the wild right now. CISA's BOD 26-04 compels federal agencies to remediate high-risk KEV entries immediately, and unpatched systems remain open doors for ransomware operators, state-sponsored actors, and opportunistic attackers targeting email, browsing, and network infrastructure simultaneously.
Attack Path Analysis
Attack Path AnalysisThreat actors exploited a multi-vector portfolio of six actively weaponized CVEs spanning Cisco BroadWorks XML injection, Barracuda OS command injection and authentication bypass, Openwave resource mishandling, Microsoft Outlook unsafe action execution, and Google Chromium memory corruption to achieve initial footholds across federal and enterprise perimeters. From those footholds, attackers escalated privileges, moved laterally across hybrid cloud workloads, established covert command-and-control channels, and exfiltrated sensitive data before delivering destructive or ransomware-class impact payloads.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers leveraged CVE-2026-20320 (Cisco BroadWorks XXE) to extract internal file content and credentials from exposed XML-parsing endpoints; CVE-2026-111560 and CVE-2026-111793 (Barracuda and Openwave) for OS command injection on internet-facing appliances; CVE-2026-116606 (Barracuda ESG) for authentication bypass granting unauthenticated gateway access; CVE-2026-124194 (Outlook) for phishing-triggered unsafe action execution without user confirmation; and CVE-2026-125350 (Chromium use-after-free) via malicious web content for browser-based code execution. Cloud Firewall (ACF) with URL and FQDN filtering could have blocked malicious inbound exploit payloads and malvertising delivery vectors at the perimeter. Inline IPS (Suricata) signature-based detection would have identified known CVE exploit patterns in unencrypted traffic before reaching vulnerable services.
Related CVEs
Related CVEsCVE-2026-20320
CVSS 7.5An Improper Restriction of XML External Entity Reference (XXE) vulnerability in Cisco BroadWorks allows a remote attacker to read arbitrary files or perform server-side request forgery, potentially leading to full system compromise.
Affected Products:
Cisco BroadWorks – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wildCVE-2026-111560
CVSS 8.6An OS Command Injection vulnerability in multiple Barracuda Networks products allows a remote attacker to execute arbitrary operating system commands with elevated privileges.
Affected Products:
Barracuda Networks Multiple Products – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wildCVE-2026-111793
CVSS 4.3An Incorrect Resource Transfer Between Spheres vulnerability in Openwave Messaging Limited Webtop Media Transcoder allows an attacker to access or manipulate resources outside of their intended security boundary, potentially exposing sensitive data.
Affected Products:
Openwave Messaging Limited Webtop Media Transcoder – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wildCVE-2026-116606
CVSS 9.3An Authentication Bypass Using an Alternate Path or Channel vulnerability in Barracuda Networks Email Security Gateway (ESG) allows an unauthenticated remote attacker to bypass authentication controls and gain unauthorized access to the management interface.
Affected Products:
Barracuda Networks Email Security Gateway (ESG) – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wildCVE-2026-124194
CVSS 6.5A Missing User Interaction for Potentially Unsafe Action vulnerability in Microsoft Office Outlook allows an attacker to trigger unsafe actions without requiring user confirmation, potentially enabling remote code execution or credential theft via crafted emails.
Affected Products:
Microsoft Office Outlook – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wildCVE-2026-125350
CVSS 8.8A Use-After-Free vulnerability in Google Chromium allows a remote attacker to execute arbitrary code or cause a denial of service by exploiting memory management errors in the browser engine via a crafted web page.
Affected Products:
Google Chromium – unspecified versions prior to vendor patch
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploit Public-Facing Application
Command and Scripting Interpreter
Exploitation for Client Execution
Access Token Manipulation
Unsecured Credentials
Authentication Bypass via Alternate Path
Template Injection
Data Encrypted for Impact
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Vulnerability Management
Control ID: Section 500.7
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Continuous Monitoring and Threat Visibility
Control ID: Application and Workload Pillar — Visibility and Analytics
NIS2 Directive – Vulnerability Handling and Disclosure
Control ID: Article 21 — Security of Network and Information Systems
DORA (Digital Operational Resilience Act) – ICT Risk Management and Vulnerability Remediation
Control ID: Article 9 — ICT Security Policies and Patch Management
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities
Control ID: Annex A 8.8
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
CISA's KEV Catalog additions under BOD 26-04 directly mandate FCEB agencies to remediate six actively exploited CVEs, with lateral movement and exfiltration risks requiring urgent zero trust segmentation and egress controls.
Information Technology/IT
Cisco BroadWorks XXE, Barracuda OS injection, and Google Chromium use-after-free CVEs expose IT infrastructure to multi-vector exploitation, demanding inline IPS, east-west traffic security, and multicloud visibility enforcement.
Telecommunications
Cisco BroadWorks and Barracuda ESG authentication bypass vulnerabilities directly threaten telecom platforms, enabling command injection and credential abuse that compromises encrypted transit and unified communications infrastructure.
Financial Services
Microsoft Outlook and Barracuda ESG vulnerabilities create high-risk exfiltration pathways in financial environments with strict PCI and NIST compliance obligations, necessitating egress policy enforcement and anomaly detection controls.
Sources
Sources- CISA Adds Six Known Exploited Vulnerabilities to Cataloghttps://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalogVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Binding Operational Directive 26-04: Prioritizing Security Updates Based on Riskhttps://www.cisa.gov/binding-operational-directive-26-04Verified
- Cisco Security Advisories - BroadWorkshttps://sec.cloudapps.cisco.com/security/center/publicationListing.xVerified
- Barracuda Networks Security Advisorieshttps://www.barracuda.com/support/glossary/security-advisoriesVerified
- Microsoft Security Response Center - Update Guidehttps://msrc.microsoft.com/update-guide/Verified
- Google Chrome Releases Bloghttps://chromereleases.googleblog.com/Verified
- NVD - National Vulnerability Databasehttps://nvd.nist.gov/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this multi-vector campaign because attackers relied on unrestricted east-west paths, unfiltered egress, and uncontrolled lateral reachability across hybrid cloud workloads to amplify their initial footholds. Enforcing segmentation, identity-scoped access, and controlled outbound routing would likely have reduced the attacker's ability to pivot, escalate, and exfiltrate at the scale observed across federal and enterprise perimeters.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Perimeter-layer URL and FQDN filtering would likely have reduced the reachability of malicious inbound exploit payloads and browser-based malvertising delivery vectors before they reached vulnerable services, while inline traffic inspection may have flagged known CVE exploit patterns in unencrypted flows, constraining the initial attack surface available to threat actors.
Control: Zero Trust Segmentation
Mitigation: Identity-based segmentation policies would likely have constrained the reuse of harvested credentials across namespace and workload boundaries, reducing the scope of privilege inheritance available to attackers moving from compromised gateway appliances into adjacent cloud IAM roles and provisioning systems.
Control: East-West Traffic Security
Mitigation: East-west workload segmentation controls would likely have reduced the attacker's lateral reachability by enforcing policy-based boundaries between namespaces and workload tiers, constraining the ability to pivot freely from compromised email gateway environments into containerized services and backend data stores.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across multicloud environments would likely have surfaced anomalous outbound beaconing patterns and repeated non-standard protocol flows from compromised appliances, reducing the time window in which covert C2 channels could operate undetected and constraining the attacker's ability to maintain reliable persistent communications.
Control: Egress Security & Policy Enforcement
Mitigation: FQDN-based outbound filtering and controlled egress policies would likely have reduced the reachability of attacker-controlled external destinations used for data staging and exfiltration, constraining the volume and variety of outbound transfer paths available to threat actors operating from compromised email gateways and cloud workloads.
Had prior CNSF controls reduced lateral reachability and constrained egress paths across earlier stages, the attacker's foothold would likely have been narrower in scope, reducing the number of workloads and communication services available for ransomware deployment, data destruction, or sustained espionage collection at the time of impact.
Impact at a Glance
Affected Business Functions
- Federal Agency IT Operations and Patch Management
- Enterprise Email Security and Communications
- Web Browser-Based Productivity and SaaS Access
- Unified Communications and Collaboration Platforms
Estimated downtime: 14 days
Estimated loss: N/A
Exploitation of these vulnerabilities across federal and enterprise environments places at risk: personally identifiable information (PII) of federal employees and citizens, sensitive government communications and email content transiting Barracuda ESG appliances, authentication credentials and session tokens accessible via Outlook and Chromium exploitation, unified communications metadata and call records from Cisco BroadWorks deployments, and proprietary organizational data accessible through compromised media transcoding infrastructure. The multi-vector nature of this KEV catalog addition means attackers can chain vulnerabilities for lateral movement and persistence across heterogeneous enterprise environments.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with current KEV-aligned signatures on all internet-facing ingress paths to detect and block exploit attempts targeting CVE-2026-20320, CVE-2026-111560, CVE-2026-116606, CVE-2026-125350, and related vulnerability classes before payloads reach vulnerable services.
- • Enforce Zero Trust Segmentation with identity-based microsegmentation policies and least-privilege SmartGroups across all cloud workloads and Kubernetes namespaces to prevent privilege escalation blast radius and block unauthorized east-west lateral movement following initial compromise.
- • Activate Egress Security & Policy Enforcement with FQDN filtering, application-to-internet controls, and data loss prevention to block C2 callback channels and unauthorized outbound data transfers to attacker-controlled infrastructure.
- • Enable Encrypted Traffic (HPE) using MACsec or IPsec line-rate encryption on all private circuits, VPN paths, and hybrid connectivity segments to protect sensitive data in transit from interception consistent with Salt Typhoon-class collection operations.
- • Leverage Multicloud Visibility & Control with centralized traffic observability and anomaly detection to baseline normal inter-workload communication patterns and generate high-fidelity alerts on suspicious automation, repeated malformed requests, and covert C2 beaconing across hybrid cloud environments.
