CISA adds Chromium, Barracuda and BroadWorks flaws to KEV catalog

The Cybersecurity and Infrastructure Security Agency added six vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, according to CISA's catalog page. The batch includes a Google Chromium use-after-free, two chained Barracuda flaws and a Cisco BroadWorks XML external entity issue, along with problems in Openwave Webtop Media Transcoder and Microsoft Office Outlook.

CISA says the Chromium flaw, CVE-2026-125350, is a use-after-free in the XML component that could let a remote attacker execute arbitrary code inside the sandbox through a specially crafted webpage, potentially affecting Chrome, Edge and Opera. Federal civilian agencies have until November 24 to apply mitigations, and CISA does not require forensic triage for this entry.

The Barracuda entries are CVE-2026-116606 in Email Security Gateway and CVE-2026-111560 across multiple products. The first is an authentication bypass that lets an unauthenticated attacker restore a crafted backup and change the appliance’s global configuration; the second is an OS command injection that an authenticated administrator can abuse to run commands as root via a crafted timezone value. CISA says the two can be chained and requires forensic triage; the due date for both is November 13.

Cisco BroadWorks CVE-2026-20320 allows an unauthenticated remote attacker to read sensitive configuration information, with a due date of November 24 and no forensic triage requirement. CISA also added CVE-2026-111793 in Openwave Webtop Media Transcoder and CVE-2026-124194 in Microsoft Office Outlook, both due November 24. The catalog marks every entry’s ransomware campaign status as “Unknown” and directs organizations to apply vendor mitigations, comply with BOD 26-04, and discontinue use if mitigations are unavailable. CISA also added IBM Aspera Faspex CVE-2026-123218, SignalWire FreeSwitch CVE-2026-116779, OpenSSH CVE-2026-123158 and GPUStack CVE-2026-102895 on November 9, all requiring forensic triage with a due date of November 12.

The November 10 batch follows other recent additions. CISA added SonicWall SonicOS CVE-2026-19868 on November 6, and Five Nines reported on November 7 that SonicWall patched the authentication enforcement flaw, which has a CVSS score of 7.1 and affects SSL VPN deployments with SAML login, and that the vendor suspected potential exploitation. Three days earlier, CISA added WordPress Core CVE-2026-119977, a TOCTOU race condition that can allow unauthenticated code execution during upgrades; Five Nines reported that Wordfence said it blocked 13,095 attacks targeting the flaw in a 24-hour period.