Patch Now: Cisco BroadWorks, Outlook and Chrome Flaws Are Being Exploited in the Wild

CISA KEV adds six exploited flaws: Cisco BroadWorks XXE, Barracuda, Outlook zero-day and Chrome XML. Patch and hunt guidance for K-12 and government IT.

  • CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including an XML external entity flaw in Cisco BroadWorks (CVE-2026-20320), a Barracuda OS command injection issue (CVE-2026-111560), an Outlook zero-day (CVE-2026-124194) and a Chrome XML use-after-free (CVE-2026-125350).
  • Affected: anyone running BroadWorks or Openwave Webtop media/voice platforms, Barracuda email gateways, Microsoft Outlook and Exchange, and Chrome/Chromium browsers on staff and student devices — all common in K-12 and government estates.
  • Impact: exploitation is confirmed, not theoretical. Email and voice systems sit on the trust boundary, so a single unpatched appliance can expose mailboxes, credentials and lateral movement paths into district networks.

What to do now

  1. Today: inventory every instance of Cisco BroadWorks (including provider-managed and telecom-hosted deployments), Openwave Webtop Media Transcoder, Barracuda Email Security Gateway, Outlook/Exchange and Chrome/Chromium. Flag anything internet-facing or on the mail path, assign an owner per asset, and record the current version.
  2. Patch the four actively exploited items as emergency changes ahead of the normal cycle: CVE-2026-20320 (BroadWorks), CVE-2026-124194 (Outlook), CVE-2026-125350 (Chrome) and CVE-2026-111560 (Barracuda). For Chrome, force a browser relaunch — the patched build only activates after restart — and re-scan in 48 hours to confirm versions.
  3. Where a patch cannot be applied immediately, apply vendor mitigations: disable XML external entity processing and restrict outbound traffic on BroadWorks/Webtop hosts, limit admin interfaces to trusted management networks or VPN, and tighten attachment/link handling and Safe Browsing for unpatched mail and browser clients.
  4. Hunt for evidence of prior exploitation before you close the ticket: malformed XML and unusual entity references in web/app logs, outbound connections from voice or media servers, Outlook crash events or abnormal child processes, unexpected mailbox rules, anomalous admin logins, and new privileged accounts. Preserve logs and rotate credentials where compromise is suspected.
  5. Track the CISA KEV remediation deadlines in a ticketed process, document any accepted exceptions with a firm date, and brief the service desk so staff report suspicious email or unexpected Outlook/Chrome behaviour instead of opening or forwarding it.

Related items