Skip to content
Dark Web Intelligence on X: " UPDATE: CISA ADDS 6 EXPLOITED FLAWS TO KEV ...

Dark Web Intelligence on X: " UPDATE: CISA ADDS 6 EXPLOITED FLAWS TO KEV ...

X • November 10, 2026

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on November 10, 2026, based on evidence of active exploitation. Covered US federal civilian agencies have binding due dates under BOD 26-04.

• CVE-2026-125350 (Google Chromium): use-after-free in the XML component that could allow a remote attacker to execute code inside the sandbox via a crafted webpage; CISA notes it can also affect other Chromium-based browsers, including Edge and Opera. We covered Google's in-the-wild zero-day advisory on Nov 9; it is now in KEV. Due: Nov 24

• CVE-2026-124194 (Microsoft Office Outlook): missing user interaction for a potentially unsafe action, allowing an unauthorized attacker to perform spoofing over a network. Due: Nov 24

• CVE-2026-20320 (Cisco BroadWorks): XML external entity (XXE) issue that could allow an unauthenticated remote attacker to read sensitive configuration information. Due: Nov 24

• CVE-2026-116606 and CVE-2026-111560 (Barracuda): Email Security Gateway authentication bypass, chained with OS command injection on multiple Barracuda products (ESG, Load Balancer, ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway). We covered confirmed exploitation earlier today; CISA now lists both in KEV, flags forensic triage, and sets a shorter due date of Nov 13

• CVE-2026-111793 (Openwave Messaging Webtop Media Transcoder): incorrect resource transfer between spheres that may allow an authenticated user to process unintended document types. Due: Nov 24

• Ransomware campaign use is listed as Unknown for all six

The new information in this item is the KEV listing and the federal deadlines, not newly disclosed bugs. The Barracuda pair is the most time-sensitive of the batch: a 3-day due date plus a forensic-triage flag. Chromium and Outlook updates belong on an emergency browser/Office patch cycle; BroadWorks and Openwave Webtop need a targeted inventory because they are less widely deployed.