Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: Mail Gateways, Voice Infrastructure, and AI Control Planes Under Fire
Date: November 11, 2026
Eight entries landed in KEV on November 9 and 10. Four have deadlines of November 12–13, which is today or the next two days. Under BOD 26-04, those are emergency timelines, so treat them as active incident response rather than routine patch cycles.
Immediate Action: Three-Day Deadlines on Edge and Control-Plane Systems
The tightest deadlines cluster around systems that sit at the network boundary and hold privileged access to everything behind them.
Barracuda: a two-bug chain (due Nov 13). CVE-2026-116606 is an authentication bypass in the Barracuda Email Security Gateway (ESG). An unauthenticated remote attacker can invoke the configuration-import function and restore a crafted backup archive, which rewrites the appliance's global configuration. CVE-2026-111560 is an OS command injection affecting a wide product family: ESG, Load Balancer, ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway. It executes as root when a crafted timezone value is processed. CISA says the two can be chained. On ESG, that plausibly turns an unauthenticated network request into root code execution: plant a malicious config through the bypass, then let the timezone value trigger the injection. The command injection alone requires admin access, so on non-ESG products the exposure depends on how well administrative credentials and management interfaces are protected.
Barracuda ESG appliances have been a repeated target for persistent, hard-to-detect implants. Do not treat patching as the end of the job:
- Apply vendor mitigations, then follow CISA's Forensics Triage Requirements. Review configuration-import events, unexpected backup restores, and changes to timezone settings.
- Rotate all credentials and secrets stored on or reachable from the appliances, including LDAP/AD bind accounts, SMTP relay credentials, and API keys.
- Restrict management interfaces to dedicated admin networks. If an appliance can't be mitigated, BOD 26-04 requires discontinuing use of it.
GPUStack (due Nov 12). CVE-2026-102895 is an improper authentication flaw in GPUStack that gives unauthenticated administrative access. An attacker can alter users and models, create persistent administrator API keys, extract worker and cloud-provider secrets, and execute code through POST /v2/inference-backends/from-yaml. This is a full takeover of the control plane for GPU clusters, and the stolen cloud credentials extend the damage beyond the host. Patch, but also:
- Revoke and reissue any API keys created since exposure, because attacker-created admin keys survive the patch.
- Rotate cloud-provider and worker secrets.
- Audit model definitions and inference-backend YAML for tampering.
- Pull these services off the internet. AI infrastructure is often stood up quickly with permissive exposure, so check for shadow deployments too.
FreeSWITCH (due Nov 12). CVE-2026-116779 is a code injection flaw in SignalWire FreeSWITCH that allows configuration and credential disclosure, arbitrary call control, and command execution. Besides host compromise, the risks include toll fraud, call interception, and exposure of SIP credentials and trunk details. Rotate SIP and trunk credentials, review call detail records for anomalous routing, and confirm that event socket and management interfaces are not reachable from untrusted networks.
Client-Side and Messaging Exposure: Chromium and Outlook (due Nov 24)
Two entries target the user's endpoint rather than the server, and both have two-week deadlines.
CVE-2026-125350 is a use-after-free in Chromium's XML component. A crafted webpage gives a remote attacker code execution inside the sandbox. The sandbox limits the impact, but exploitation like this is typically paired with a sandbox escape. Because it sits in the shared engine, the exposure covers Chrome, Edge, Opera, and any other Chromium derivative. That includes Electron applications and embedded webviews, which update on their own schedules. Inventory those, since they are the usual stragglers. Force browser restarts so that updates actually take effect.
CVE-2026-124194 is a Microsoft Office Outlook flaw: missing user interaction for a potentially unsafe action, enabling network-based spoofing. The details are sparse, but spoofing bugs in a mail client feed phishing and credential-theft campaigns, particularly when they remove a warning prompt users would otherwise see. Deploy the patch, and consider whether your mail gateway filtering and user-reporting workflows are tuned to catch lures that no longer trigger client warnings.
There is a notable overlap with the Barracuda items. If your ESG is compromised, attackers sit in the path of inbound mail and can shape what reaches endpoints that are themselves awaiting Outlook and browser patches. Prioritize the gateway first.
Lower-Profile Entries: Unauthenticated Disclosure and Authenticated Abuse (due Nov 24)
CVE-2026-20320 affects Cisco BroadWorks and is an XML external entity (XXE) flaw. An unauthenticated remote attacker can read sensitive configuration information. Don't dismiss this as "just" information disclosure. Configuration files on carrier-grade voice platforms often contain credentials and topology details that enable follow-on attacks. Patch, then rotate any secrets stored in readable configuration. This pairs naturally with the FreeSWITCH item: audit your whole voice stack together.
CVE-2026-111793 affects Openwave Messaging Limited Webtop Media Transcoder. It is an incorrect resource transfer between spheres flaw that lets an authenticated user convert unintended document types by bypassing the Webmail experience. The authentication requirement lowers the urgency, but KEV listing means exploitation has been observed, likely with stolen or low-privilege mailbox credentials. Restrict direct access to the transcoder service to the webmail front end only, and monitor for conversion requests that don't originate from it.
Prioritization Summary
| Priority | Item | Deadline | |---|---|---| | 1 | GPUStack CVE-2026-102895; FreeSWITCH CVE-2026-116779 | Nov 12 | | 1 | Barracuda CVE-2026-116606 and CVE-2026-111560 | Nov 13 | | 2 | Chromium CVE-2026-125350; Outlook CVE-2026-124194 | Nov 24 | | 3 | Cisco BroadWorks CVE-2026-20320; Openwave CVE-2026-111793 | Nov 24 |
If you can't patch within the window, isolate the system from untrusted networks as a stopgap and document the exception. BOD 26-04 makes you responsible for assessing each asset's internet exposure, so keep that evidence current.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · Barracuda Campus Security Advisories · Cisco Security Advisories · Microsoft Security Response Center · Chrome Releases Blog · GPUStack GitHub Security Advisories · SignalWire FreeSWITCH Security
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 11, 2026
Microsoft Patches Actively Exploited Outlook Zero-Day Among 1,093 November Vulnerabilities
Microsoft released November 2026 Patch Tuesday updates addressing 1,093 newly disclosed security flaws, including CVE-2026-124194, an Outlook spoofing zero-day actively exploited in attacks, according to Cyberpress. Microsoft has not disclosed exploitation scale, targeted sectors, or attacker identity. Separately, CISA added CVE-2026-20320, a high-severity Cisco BroadWorks vulnerability, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within two weeks, though the agency did not specify victim organizations or campaign scope. Security researchers also report active exploitation of two Barracuda Email Security Gateway flaws—CVE-2026-116606 and CVE-2026-111560—that can be chained to bypass authorization and gain root access, though exploitation timelines and affected customer counts remain unconfirmed. Additionally, researchers observed hackers actively exploiting CVE-2026-123158, the SSHole vulnerability in OpenSSH, to execute commands, steal credentials, and establish persistent access on Linux systems.
Russian State-Linked Hackers Compromised Government Email Servers in Romania and Kazakhstan for NATO, EU Espionage
Russian state-linked hackers compromised government email servers in Romania and Kazakhstan to intercept messages exchanged with NATO and European Union entities, according to The Record. Researchers have not disclosed the compromise timeline, data exfiltration volume, or specific government agencies affected. The campaign represents continued targeting of Eastern European government communications infrastructure, though attribution confidence levels and specific Russian intelligence service involvement were not detailed in available reporting. Separately, a threat actor used compromised AWS IAM credentials for Qubole's data platform to access and exfiltrate data from multiple customers' AWS environments between October 14-26, according to Bleeping Computer. The company has not disclosed the number of affected customers or data types accessed.
Additional Reported Activity: France continues to attribute October's supermarket refrigeration attacks affecting approximately 700 stores to Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, with Tehran denying involvement. The FBI warned companies of growing threats to operational technology systems following the UK grocery store refrigeration attacks. Google researchers warned of Remus Stealer malware targeting email credentials, offered to hackers for $1,000 monthly subscriptions. Federal prosecutors in Seattle filed charges against a Florida man in a cryptocurrency theft case involving compromised video game accounts that allegedly facilitated theft of over $220,000. Google's Threat Analysis Group reported that the Artex AI penetration testing tool has been weaponized by threat actors to automate attack chains with reduced technical skill requirements.
Sources: Cyberpress · The Record · Bleeping Computer · Security Week · Bleeping Computer · Bleeping Computer
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
CopperDragon Malware Ecosystem Links Three China-Nexus Espionage Campaigns
Check Point Research reveals three China-linked espionage clusters targeting telecommunications, government, military, and critical infrastructure acr...
Microsoft Patches Over 1,093 Security Flaws, Including Outlook Zero-Day Exploited in Attacks
Microsoft released November 2026 Patch Tuesday updates addressing 1,093 newly disclosed security flaws including an actively exploited Outlook spoofin...
Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with ...
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
CISA added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilitie...
N-able Takes N-central Servers Offline Worldwide After 33 0-Day Vulnerabilities and Able2Shell Exploits
N-able took its hosted N-central environments offline on November 9, 2026, after an independent researcher published details of 33 alleged zero-day vu...
GhostAction Supply Chain Attack Hits Tens of Thousands of GitHub Repositories
The GhostAction supply chain campaign pushed credential-stealing GitHub Actions workflows into tens of thousands of repositories to steal cloud and AI...
Chinese-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach
Chinese-linked hackers breached ConnectWise and used the ARTEX AI framework to compromise over 2,250 Microsoft 365 tenants globally.
Russian State Statistics Agency Rosstat Suffers Major Data Breach
Rosstat, Russia's state statistics agency, was breached by Belarusian CyberPartisans and Silent Crow, who exfiltrated 23TB of data including military ...
Updated daily