CISA has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, the US government's running list of bugs it has evidence attackers are using. The most pressing pair sits in Barracuda's Email Security Gateway (ESG), the appliance many organizations place in front of their mail, and researchers showed only last week that the two can be chained into root access without a password.
The November 10 additions also cover Cisco BroadWorks, Openwave Messaging's Webtop Media Transcoder, Microsoft Outlook and Google Chromium. US federal civilian agencies must prioritise them under Binding Operational Directive 26-04, and CISA urges every other organization to treat the catalog as a patching priority list.
Barracuda's gateway moves from research to real attacks
The two Barracuda entries are the highest-rated of the six:
- CVE-2026-116606 (CVSS 9.3, critical): an authentication bypass in Barracuda ESG versions earlier than 9.4.0.030. Its NVD record says an unauthenticated remote attacker can invoke a configuration-import function and restore a crafted backup archive, changing the appliance's global configuration.
- CVE-2026-111560 (CVSS 8.6, high): an OS command injection in the timezone configuration field of Barracuda appliance products that share common code. An authenticated administrator can inject commands that run with root privileges.
On its own, the second bug needs an administrator account. Paired with the first, it does not: watchTowr Labs published exactly that chain on November 5, and we covered the research in Barracuda email gateway bugs chain into root takeover. At the time nobody had reported exploitation. CISA's listing says that has now changed, although its notice does not say who is behind the attacks or whether the two bugs are being used together.
The ESG has been a prize before. It is the appliance a China-nexus group exploited so thoroughly in 2023 that Barracuda told customers to physically replace affected units.
Four more products, with little public detail
For the remaining entries CISA's alert gives only a CVE identifier and a short vulnerability title, and publishes no severity scores. CISA lists them as:
- CVE-2026-20320: Cisco BroadWorks improper restriction of XML external entity reference.
- CVE-2026-111793: Openwave Messaging Webtop Media Transcoder incorrect resource transfer between spheres.
- CVE-2026-124194: Microsoft Office Outlook missing user interaction for a potentially unsafe action.
- CVE-2026-125350: a Google Chromium use-after-free, the Chrome zero-day Google patched this week (see Google fixes Chrome zero-day already exploited in attacks).
Affected versions and technical detail for these are in each vendor's own advisory. Cisco BroadWorks is a calling and messaging platform sold to service providers, so its owners are mostly telecoms and hosting companies rather than ordinary businesses. The Outlook entry is the one with the widest reach, since almost every organization runs the client somewhere.
Patch Barracuda ESG to 9.4.0.030 or later, then look back
- Confirm every Barracuda ESG is on 9.4.0.030 or later, which fixes CVE-2026-116606, and check Barracuda's advisory for the fixed build of CVE-2026-111560 on other appliance lines.
- Because the first bug works without a password, patching is not the end of it. Review appliances for configuration restores or changes nobody on your team made, especially since the watchTowr write-up went public.
- Apply Cisco's, Openwave's and Microsoft's fixes for the other three products, and make sure Chrome and other Chromium browsers have restarted onto the patched build.
The Barracuda pair is a familiar pattern: patched flaws, a detailed public write-up, and within days a KEV listing. For an edge appliance that reads every inbound email, the window between disclosure and attack is now measured in days, and the patch is the cheap part of the response.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.