Skip to content
ThreatCluster

CISA Adds Six Vulnerabilities to KEV Catalog

First seen 10 Nov 2026, 22:49 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 22:50 UTC
  • •CISA added six actively exploited vulnerabilities to the KEV Catalog on November 10, 2026.
  • •The vulnerabilities affect products from Cisco, Barracuda, Microsoft, and Google, with varying severity levels.
  • •Federal agencies must prioritize remediation, with some vulnerabilities requiring action by November 13, 2026.

On November 10, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. The vulnerabilities include CVE-2026-20320 (Cisco BroadWorks), CVE-2026-111560 (Barracuda Networks), CVE-2026-111793 (Openwave Messaging), CVE-2026-116606 (Barracuda Networks), CVE-2026-124194 (Microsoft Outlook), and CVE-2026-125350 (Google Chromium). These flaws pose significant risks to federal agencies and other organizations using affected products. The vulnerabilities allow for various attack methods, including remote code execution and authentication bypass. CISA has set remediation deadlines for federal agencies, with the most urgent due by November 13, 2026. Organizations are encouraged to adopt risk-based vulnerability management practices to address these high-risk vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-19
CVE-2026-20320 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-16
CVE-2026-111793 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-02
CVE-2026-116606 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-10
CISA adds vulnerabilities to KEV Catalog
CISA added six vulnerabilities to its KEV Catalog based on active exploitation evidence, impacting various products.
Cisa
2026-11-10
CVE-2026-125350 zero-day advisory published
Google issued a zero-day advisory for CVE-2026-125350, a use-after-free vulnerability in Chromium.
X
2026-11-10
CVE-2026-111560 exploitation confirmed
Barracuda's authentication bypass vulnerability (CVE-2026-111560) was confirmed to be exploited in the wild.
X
2026-11-10
CVE-2026-124194 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (5)

Following this threat?

Track Barracuda Networks and CVE-2026-111560 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (32)

1 / 4

Common questions

Which products are affected?
The vulnerabilities affect Cisco BroadWorks, Barracuda Networks products, Microsoft Outlook, and Google Chromium.
How urgent is the response?
Federal agencies must act quickly, with some vulnerabilities requiring remediation by November 13, 2026.
What should organizations do?
Organizations should prioritize patching the listed vulnerabilities and adopt risk-based vulnerability management practices.