CISA adds Microsoft Outlook spoofing flaw to exploited list

CISA placed Microsoft Office Outlook CVE-2026-124194 on the Known Exploited Vulnerabilities Catalog on Nov. 10, according to CISA's catalog. The entry describes a vulnerability that does not require user interaction for an unsafe action and lets an unauthorized attacker perform spoofing over a network. CISA lists the vulnerability's use in ransomware campaigns as unknown and does not require forensic triage under BOD 26-04.

Federal agencies must apply mitigations in line with vendor instructions by Nov. 24, or discontinue use if mitigations are unavailable, the catalog says. The entry does not list a CVSS score or affected and fixed versions. CISA's standard action text tells organizations to check each asset's exposure to the internet and follow BOD 26-04 patching guidelines.

The agency added several other vulnerabilities the same day. Google Chromium CVE-2026-125350 is a use-after-free flaw in the XML component that could let a remote attacker run code within the sandbox by way of a crafted webpage, affecting browsers that use Chromium. CISA set a due date of Nov. 24 and does not require forensic triage. Barracuda Email Security Gateway CVE-2026-116606 allows an unauthenticated remote attacker to bypass authentication through a different path. The attacker can call the configuration-import function and restore a crafted, compatible backup archive, changing the device's global configuration without authorization. Barracuda Multiple Products CVE-2026-111560 is an OS command injection vulnerability that lets an authenticated administrator inject OS commands that run with root privileges when a crafted timezone value is processed. Both Barracuda vulnerabilities have due dates of Nov. 13 and require forensic triage. Cisco BroadWorks CVE-2026-20320 does not properly limit XML external entity references, and an unauthenticated remote attacker can read sensitive configuration information as a result. CISA set a due date of Nov. 24. Openwave Messaging Webtop Media Transcoder CVE-2026-111793 is an incorrect resource transfer between spheres. It may let an authenticated user convert document types that were not intended when they go around the Webmail interface, with a due date of Nov. 24. None of these entries lists whether they are used in ransomware campaigns, and only the Barracuda flaws require forensic triage.

Five Nines reported on Nov. 7 that SonicWall's SonicOS SSL VPN flaw CVE-2026-19868 was added to the catalog, and Five Nines reported on Nov. 3 that WordPress Core's TOCTOU flaw CVE-2026-119977 was added.