Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
KEV Intelligence Brief: Mail Gateways, Voice Infrastructure, and AI Control Planes Under Fire
Date: November 11, 2026
Eight entries landed in KEV on November 9 and 10. Four have deadlines of November 12–13, which is today or the next two days. Under BOD 26-04, those are emergency timelines, so treat them as active incident response rather than routine patch cycles.
Immediate Action: Three-Day Deadlines on Edge and Control-Plane Systems
The tightest deadlines cluster around systems that sit at the network boundary and hold privileged access to everything behind them.
Barracuda: a two-bug chain (due Nov 13). CVE-2026-116606 is an authentication bypass in the Barracuda Email Security Gateway (ESG). An unauthenticated remote attacker can invoke the configuration-import function and restore a crafted backup archive, which rewrites the appliance's global configuration. CVE-2026-111560 is an OS command injection affecting a wide product family: ESG, Load Balancer, ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway. It executes as root when a crafted timezone value is processed. CISA says the two can be chained. On ESG, that plausibly turns an unauthenticated network request into root code execution: plant a malicious config through the bypass, then let the timezone value trigger the injection. The command injection alone requires admin access, so on non-ESG products the exposure depends on how well administrative credentials and management interfaces are protected.
Barracuda ESG appliances have been a repeated target for persistent, hard-to-detect implants. Do not treat patching as the end of the job:
- Apply vendor mitigations, then follow CISA's Forensics Triage Requirements. Review configuration-import events, unexpected backup restores, and changes to timezone settings.
- Rotate all credentials and secrets stored on or reachable from the appliances, including LDAP/AD bind accounts, SMTP relay credentials, and API keys.
- Restrict management interfaces to dedicated admin networks. If an appliance can't be mitigated, BOD 26-04 requires discontinuing use of it.
GPUStack (due Nov 12). CVE-2026-102895 is an improper authentication flaw in GPUStack that gives unauthenticated administrative access. An attacker can alter users and models, create persistent administrator API keys, extract worker and cloud-provider secrets, and execute code through POST /v2/inference-backends/from-yaml. This is a full takeover of the control plane for GPU clusters, and the stolen cloud credentials extend the damage beyond the host. Patch, but also:
- Revoke and reissue any API keys created since exposure, because attacker-created admin keys survive the patch.
- Rotate cloud-provider and worker secrets.
- Audit model definitions and inference-backend YAML for tampering.
- Pull these services off the internet. AI infrastructure is often stood up quickly with permissive exposure, so check for shadow deployments too.
FreeSWITCH (due Nov 12). CVE-2026-116779 is a code injection flaw in SignalWire FreeSWITCH that allows configuration and credential disclosure, arbitrary call control, and command execution. Besides host compromise, the risks include toll fraud, call interception, and exposure of SIP credentials and trunk details. Rotate SIP and trunk credentials, review call detail records for anomalous routing, and confirm that event socket and management interfaces are not reachable from untrusted networks.
Client-Side and Messaging Exposure: Chromium and Outlook (due Nov 24)
Two entries target the user's endpoint rather than the server, and both have two-week deadlines.
CVE-2026-125350 is a use-after-free in Chromium's XML component. A crafted webpage gives a remote attacker code execution inside the sandbox. The sandbox limits the impact, but exploitation like this is typically paired with a sandbox escape. Because it sits in the shared engine, the exposure covers Chrome, Edge, Opera, and any other Chromium derivative. That includes Electron applications and embedded webviews, which update on their own schedules. Inventory those, since they are the usual stragglers. Force browser restarts so that updates actually take effect.
CVE-2026-124194 is a Microsoft Office Outlook flaw: missing user interaction for a potentially unsafe action, enabling network-based spoofing. The details are sparse, but spoofing bugs in a mail client feed phishing and credential-theft campaigns, particularly when they remove a warning prompt users would otherwise see. Deploy the patch, and consider whether your mail gateway filtering and user-reporting workflows are tuned to catch lures that no longer trigger client warnings.
There is a notable overlap with the Barracuda items. If your ESG is compromised, attackers sit in the path of inbound mail and can shape what reaches endpoints that are themselves awaiting Outlook and browser patches. Prioritize the gateway first.
Lower-Profile Entries: Unauthenticated Disclosure and Authenticated Abuse (due Nov 24)
CVE-2026-20320 affects Cisco BroadWorks and is an XML external entity (XXE) flaw. An unauthenticated remote attacker can read sensitive configuration information. Don't dismiss this as "just" information disclosure. Configuration files on carrier-grade voice platforms often contain credentials and topology details that enable follow-on attacks. Patch, then rotate any secrets stored in readable configuration. This pairs naturally with the FreeSWITCH item: audit your whole voice stack together.
CVE-2026-111793 affects Openwave Messaging Limited Webtop Media Transcoder. It is an incorrect resource transfer between spheres flaw that lets an authenticated user convert unintended document types by bypassing the Webmail experience. The authentication requirement lowers the urgency, but KEV listing means exploitation has been observed, likely with stolen or low-privilege mailbox credentials. Restrict direct access to the transcoder service to the webmail front end only, and monitor for conversion requests that don't originate from it.
Prioritization Summary
| Priority | Item | Deadline | |---|---|---| | 1 | GPUStack CVE-2026-102895; FreeSWITCH CVE-2026-116779 | Nov 12 | | 1 | Barracuda CVE-2026-116606 and CVE-2026-111560 | Nov 13 | | 2 | Chromium CVE-2026-125350; Outlook CVE-2026-124194 | Nov 24 | | 3 | Cisco BroadWorks CVE-2026-20320; Openwave CVE-2026-111793 | Nov 24 |
If you can't patch within the window, isolate the system from untrusted networks as a stopgap and document the exception. BOD 26-04 makes you responsible for assessing each asset's internet exposure, so keep that evidence current.
Sources: CISA KEV Catalog · CISA Binding Operational Directives · Barracuda Campus Security Advisories · Cisco Security Advisories · Microsoft Security Response Center · Chrome Releases Blog · GPUStack GitHub Security Advisories · SignalWire FreeSWITCH Security
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 12, 2026
Threat Actors Target Enterprise Infrastructure with Multi-Exploit Staging and Persistence Tools
Researchers observed threat actors targeting Qlik Sense servers with PowerShell reverse shell commands, according to The Hacker News. The attackers' infrastructure contained exploit tools for Apache ActiveMQ and Veeam Backup & Replication, indicating preparation for broader attacks beyond the initial Qlik Sense compromise, though researchers have not disclosed victim counts, campaign scope, or attribution. Separately, Microsoft Threat Intelligence discovered threat actors deploying GSocket on compromised Linux servers to maintain encrypted remote access channels after original vulnerabilities are patched. The technique allows attackers to establish persistent backdoors that survive remediation of initial entry points, though Microsoft has not specified affected organizations, deployment scale, or threat actor identity. Additionally, researchers disclosed "worse_query," an unpatched iOS sandbox escape vulnerability that allows malicious apps to read local files from other applications, potentially exposing cryptocurrency seed phrases, private keys, and login credentials across the Apple ecosystem, according to Apple Insider. Apple has not confirmed the vulnerability or announced remediation timelines.
Confirmed Breaches Include Maersk Ransomware Incident and Romanian Government Cyber Attack
Maersk confirmed attackers stole approximately 100 gigabytes of data from a legacy system inherited through its LF Logistics acquisition, with the WhiteArmor ransomware group demanding $5 million in bitcoin, according to CISO Series. The shipping company has not disclosed the compromise timeline or affected data types. Romania's intelligence agency attributed a cyber attack on an unspecified Romanian government organization to a hacking group linked to Russia's FSB security service, according to Reuters. The agency has not disclosed the attack timeline, affected systems, or data exfiltration details. Separately, Bacon County Hospital and Health System in Georgia disclosed that an unauthorized party accessed its network on July 10 and copied files around July 27, indicating a 17-day dwell time, though the hospital has not specified affected patient counts or data types exposed. Binance reported working to resolve what it described as a "complex attack" affecting approximately $6.3 billion in funds, according to AFP, though the company has not disclosed attack vectors, compromise timelines, or fund recovery status.
Additional Reported Activity: CloudSek reported that a hacking group with ties to Kazakhstan used the Hermes autonomous AI agent framework to steal over 2,000 national security documents from Tajikistan after discovering an exposed server, though the claim has not been independently verified. India reportedly bypassed its own procurement rules to acquire Israeli phone surveillance technology with capabilities extending beyond device cloning to cloud-based data access from major technology companies, according to Al Jazeera.
Sources: The Hacker News · Microsoft Security Blog · Apple Insider · CISO Series · Reuters · Becker's Hospital Review · AFP · Just Security · Al Jazeera
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
Hackers Target Qlik Sense Servers with Reverse Shells and Stage Multiple Exploits
Threat actors were observed targeting Qlik Sense servers with PowerShell reverse shell commands, with infrastructure containing ActiveMQ and Veeam exp...
Critical Red Hat Quay Vulnerability Could Expose Private Container Images
A critical vulnerability in Red Hat Quay with a CVSS score of 9.8 allows attackers to access private container images and replace content in repositor...
Hackers Deploy Malware in Fresh ScreenConnect Campaign
A threat actor compromised hundreds of endpoints across dozens of ConnectWise ScreenConnect customers, affecting at least 6 MSPs and 288 hosts across ...
Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely
Security company Wiz said later that day that no exploit was available and that no exploitation in the wild had been reported. Cybersecurity. HTTP/2 ....
Maersk breach, CopperDragon malware, United AI booking ban - CISO Series
Cybersecurity News: Maersk gets a $5M ransom note, CopperDragon's malware connections, United grounds AI booking bots. By. Sarah Lane. -. November 12,...
CopperDragon Malware Ecosystem Links Three China-Nexus Espionage Campaigns
Check Point Research reveals three China-linked espionage clusters targeting telecommunications, government, military, and critical infrastructure acr...
Microsoft Patches Over 1,093 Security Flaws, Including Outlook Zero-Day Exploited in Attacks
Microsoft released November 2026 Patch Tuesday updates addressing 1,093 newly disclosed security flaws including an actively exploited Outlook spoofin...
Russian hackers compromised government email servers to steal NATO, EU correspondence
Russian state-linked hackers have compromised government email servers in Romania and Kazakhstan to secretly intercept messages exchanged with ...
Updated daily