Six More Exploited Flaws, and the Barracuda Pair Gets Three Days: CISA KEV Additions for November 10

CISA alert and KEV additions November 10, 2026; Barracuda federal remediation due November 13, 2026, the other four due November 24, 2026 under Binding Operational Directive 26-04

Six More Exploited Flaws, and the Barracuda Pair Gets Three Days: CISA KEV Additions for November 10

Threats

CISA NIST and the NIST Cybersecurity Framework (CSF 2.0)MITRE ATT&CK

CISA added six vulnerabilities to the Known Exploited Vulnerabilities catalog on November 10, each on evidence of active exploitation. Two are already familiar from this report: the Outlook spoofing flaw CVE-2026-124194, fixed in the Patch Tuesday release covered above, and the Chrome use-after-free CVE-2026-125350, patched by Google on November 9. The sharpest deadline belongs to Barracuda. CVE-2026-116606, scored 9.3, is an authentication bypass in the Barracuda Email Security Gateway that lets an unauthenticated attacker restore a crafted backup to take global configuration control, fixed in 9.4.0.030; chained with it, CVE-2026-111560, scored 8.6, is an OS command injection across Barracuda appliances that runs as root. Barracuda confirmed attacks against a small number of organizations, exploit code is public, and both entries carry a federal deadline of Friday, November 13, three days out, where the rest of the batch gets November 24. Cisco BroadWorks carries CVE-2026-20320, scored 7.5, an XXE flaw in the OCI XML parser fixed in August that lets an unauthenticated attacker read sensitive configuration and files. Malbear Labs reports that a Chinese-speaking actor used it inside an autonomous agent campaign it calls Operation Snowball, run on a jailbroken DeepSeek Flash model against a European telecom provider and 13 hosted companies, recovering the BroadWorks system identity private key, SSL credential sets and subscriber billing and device records. The sixth entry, Openwave Messaging Webtop Media Transcoder CVE-2026-111793, scored 4.3 and fixed in October, lets an authenticated user process unintended document types. One more clock: tomorrow, November 12, is the federal deadline for the GPUStack, FreeSWITCH, OpenSSH and IBM Aspera batch added November 9, and no extension has been published.

Executives

Read the deadlines as the severity ranking. CISA rarely gives three days; the Barracuda pair earned Friday because the two flaws chain into root control of the appliance that filters your mail, exploit code is public, and the vendor confirms real victims. Ask whether any Barracuda appliance in your estate, including one a provider runs for you, is below 9.4.0.030 today. The BroadWorks item carries a second lesson: the reported campaign was run by an AI agent working without an operator present, which compresses the time between a patch existing and a flaw being worked at scale.

CIO / CISO

Work the batch in deadline order. Barracuda first: update ESG to 9.4.0.030 or later, apply the command injection fix across appliances, restrict admin interfaces, and run the forensic triage the directive requires, because a crafted-backup restore is exactly the artifact to hunt. BroadWorks estates should confirm the August fix level and rotate what the reported campaign reached for: system identity keys and SSL credentials. Then close the loop on tomorrow: the November 9 batch, GPUStack, FreeSWITCH, OpenSSH and Faspex, is due November 12 with triage attached, and a patch record without a triage answer is half the requirement.

Engineers

Verify versions on the devices themselves. ESG below 9.4.0.030 is in scope; Chrome below 157.0.8103.50 is in scope and needs a relaunch, not just a download. For BroadWorks, check the OCI-P service exposure and review file access and configuration exports across the period since the August fix was available. For the November 12 batch, preserve logs before patching where triage needs them, verify the Faspex fix pack build and the running OpenSSH daemon after restart, and record a found-or-not-found answer for each of the four products by name.

Everyone (non-IT)

Your part of this batch is the browser. Open Chrome, check the version under Help, About, update and relaunch if it offers one; other Chromium browsers such as Edge and Brave take the same fix on their own schedules. The Barracuda, Cisco and Openwave items belong to the teams that run mail gateways, phone platforms and messaging systems, and there is no link for individual staff to click. If a message claims your mailbox or phone system needs you to sign in urgently because of a patch, treat it as the attack using the headline.