Six Actively Exploited Flaws Land on CISA's Must-Patch List — Including an Outlook Zero-Day and a Chrome Bug

CISA adds six actively exploited flaws to its KEV catalog: Barracuda, Cisco BroadWorks, Outlook and Chromium. What K-12 IT should patch first.

On 10 November CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, each backed by evidence of active exploitation: Cisco BroadWorks, two Barracuda flaws, Openwave Webtop, Microsoft Outlook and Google Chromium.
Affected: internet-facing email gateways, load balancers and UC telephony, plus every Chromium-based browser and Outlook client on staff endpoints — effectively most district workstations.
Impact: unauthenticated command execution, authentication bypass and configuration disclosure on edge appliances. Treat as an emergency change, not part of a routine patch cycle.

What to do now

1. Inventory and assign: open one ticket per asset owner for all six CVEs, and flag internet-facing Barracuda ESG/WSG/WAF/WCC, Cisco BroadWorks and Openwave Webtop as tier one.
2. Patch the mail and edge path first: apply vendor updates for the Barracuda appliances and BroadWorks; where no patch exists, apply the vendor's documented mitigation exactly and restrict admin interfaces to a management VLAN or VPN.
3. Force endpoint updates: push the fixed Chromium build and confirm the browser actually restarted (a deployed-but-unrestarted Chrome is still vulnerable), and deploy the Outlook update for CVE-2026-124194 as a separate emergency change outside the monthly cycle.
4. Hunt before and after patching: review logs for XXE-shaped requests to BroadWorks, configuration-import and backup-restore events on the ESG, new or anomalous admin accounts, mailbox rule changes, and unexpected child processes spawned by Outlook or Chrome. Isolate and preserve evidence if found.
5. Verify and document: re-scan to confirm version numbers rather than trusting deployment success messages, rotate credentials and API tokens on affected appliances, and confirm remediation deadlines directly with CISA and the vendor advisories.