Six Exploited Flaws Across Cisco, Barracuda, Openwave, Microsoft, Google Added to KEV

En bref

• Six CVEs were added to the KEV catalog on 2026-11-10.
• Affected products include Cisco BroadWorks, Barracuda Email Security Gateway, Openwave Webtop Media Transcoder, Microsoft Outlook, and Google Chromium.
• Threat actors are already exploiting the flaws, raising risk for federal and enterprise networks.
• Administrators should patch or mitigate immediately, prioritizing internet-facing systems.

On Nov. 10, 2026, six security defects were placed in the Known Exploited Vulnerabilities catalog: CVE-2026-20320, CVE-2026-111560, CVE-2026-111793, CVE-2026-116606, CVE-2026-124194, and CVE-2026-125350. The listing signals that adversaries have been observed using at least some of these issues in real intrusions, not just that proof-of-concept code exists.

Coverage spans major collaboration and infrastructure platforms: Cisco BroadWorks, Barracuda Networks' Email Security Gateway, Openwave Messaging's Webtop Media Transcoder, Microsoft Outlook, and Google Chromium, plus a multi-product entry. That mix puts both messaging and web-facing services in scope, including systems that often sit at the edge of federal and enterprise environments.

The risk is elevated because KEV inclusion is a strong indicator of confirmed exploitation. For federal agencies and their contractors, the clock for remediation is typically compressed, and downstream state and local organizations—including K-12 districts—should treat the same products as urgent. A compromised email gateway or web component can become an initial access path, while client software flaws can spread through user browsing.

Security teams should inventory exposed instances, apply vendor updates or documented mitigations, and verify that compensating controls are in place where patching is delayed. Watch for follow-on activity such as unusual authentication attempts, new administrative accounts, or outbound connections from affected appliances. The key date to track is the KEV-mandated remediation deadline, and the key question is whether any of the six flaws are present in internet-facing services.

À faire maintenant

1. Identify all instances of Cisco BroadWorks, Barracuda Email Security Gateway, Openwave Webtop Media Transcoder, Microsoft Outlook, and Google Chromium in your estate; prioritize internet-facing and email-path systems.
2. Apply vendor security updates for the six CVEs immediately; where a patch is unavailable, deploy the vendor's documented mitigation and restrict access.
3. Check KEV catalog remediation deadlines and track completion through a ticketed, owner-assigned process.
4. Hunt for exploitation signs: anomalous admin logins, new accounts, unexpected outbound traffic, and unusual process behavior on affected appliances.
5. Enforce MFA and least privilege on email and collaboration admin accounts; isolate affected systems if compromise is suspected.
6. Report confirmed incidents to your security operations and information-sharing partners; preserve logs for forensics.
7. Re-scan after patching and validate that exposed services no longer match vulnerable versions.

Références CVE

• CVE-2026-20320
• CVE-2026-111560
• CVE-2026-111793
• CVE-2026-116606
• CVE-2026-124194
• CVE-2026-125350

Source originale

CISA Advisories