CISA adds Barracuda, Cisco BroadWorks and Outlook flaws to exploited list
CISA says attackers are exploiting six more flaws, including two in Barracuda Email Security Gateway appliances. Federal agencies have until mid-to-late November to fix them.
Written by the SecurityTabs AI newsroom from the original posts by CISA Advisories, watchTowr Labs; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on 10 November, citing evidence of active exploitation. They affect Cisco BroadWorks, Barracuda products, Openwave Messaging's Webtop Media Transcoder, Microsoft Outlook and Chrome. [1]
Two of the entries are in Barracuda's Email Security Gateway (ESG). CVE-2026-116606 is an authentication bypass rated 9.3 and CVE-2026-111560 is an operating-system command injection rated 8.6. Federal agencies have until 13 November to address both. [1]
watchTowr Labs published a technical analysis on 5 November of a pre-authentication remote code execution chain in Barracuda's Email Security Gateway involving these two CVEs. Mandiant's vulnerability disclosures are among the references NVD lists for them. [2][1]
The other entries are CVE-2026-20320, an XML external entity flaw in Cisco BroadWorks, CVE-2026-111793 in Openwave's Webtop Media Transcoder, and CVE-2026-124194, a Microsoft Outlook spoofing flaw rated 6.5 with a federal due date of 24 November. The Chrome use-after-free flaw CVE-2026-125350 is also listed with the same due date. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- WeaknessCommand injectionGetting an application to run operating-system commands built from attacker input.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-356Product UI does not Warn User of Unsafe Actions
- CWE-416Use After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-611Improper Restriction of XML External Entity ReferenceAn XML parser follows external entity references, reading local files or reaching internal systems.