Three-day deadlines don't leave room
for a missed email.
CyberComply monitors the CISA KEV catalog 24/7 and alerts you within minutes of every new listing, so the clock never starts without you.
Barracuda ESG Exploit Chain: Overdue Today
The most urgent items in this batch are CVE-2026-116606 and CVE-2026-111560, both Barracuda Networks entries added November 10 with a patch deadline of today, November 13. If you run Barracuda gear and haven't acted, you are at the deadline now.
CVE-2026-116606 is an authentication bypass in the Email Security Gateway (ESG). An unauthenticated remote attacker can invoke the configuration-import function and restore a crafted backup archive, which modifies the appliance's global configuration. CVE-2026-111560 is an OS command injection affecting a wider set of products: ESG, Load Balancer, ADC, Message Archiver, WAF Control Center, WAF, and Web Security Gateway. A crafted timezone value executes as root when it is later processed. On its own it requires an authenticated administrator. Chained with the bypass, it does not.
The chain turns an unauthenticated network request into root on an internet-facing mail gateway. Those appliances sit at a trust boundary and often hold mail flow, credentials, certificates, and directory integrations. Treat any exposed ESG as potentially compromised until shown otherwise:
- Apply vendor remediation, then hunt. Patching does not remove persistence planted through a restored configuration. Compare running configuration against known-good backups and review admin accounts, scheduled tasks, and timezone settings for anomalies.
- Review logs for configuration-import activity from unexpected sources, and for unexplained restores.
- Rotate secrets held on the appliance: admin credentials, API keys, LDAP/service-account bindings, and TLS private keys.
- Restrict management interfaces to dedicated admin networks. Do not assume that "authenticated admin" requirements make CVE-2026-111560 low priority on non-ESG products, since the chain may be adapted.
- Follow CISA's Forensics Triage Requirements under BOD 26-04 and preserve evidence before rebuilding.
If mitigations are unavailable for an end-of-life unit, BOD 26-04 directs you to discontinue use.
Infrastructure Footholds: Network Services and Privilege Escalation
Two additions, both with a November 16 deadline (Monday), concern privileged infrastructure components. Weekend response teams should plan accordingly.
CVE-2026-123039 affects Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket without authenticating callers, so any authenticated local user can run commands as root. It is local, but that matters less than it seems. Security gateways are high-value targets, and attackers who land a low-privileged foothold, whether through stolen credentials, a web-facing flaw, or a delegated admin account, can use this to take full control of the device. Audit who holds shell or CLI access on Gaia systems, remove unnecessary accounts, and review for unexpected root-level changes. Multi-Domain environments deserve particular attention because one compromised management server can affect many tenants or policy domains.
CVE-2026-114713 in UnrealIRCd allows any user on a network with two or more linked servers to inject server-to-server commands that execute with server authority. The delimiter-neutralization failure collapses the boundary between ordinary client and trusted peer. IRC is rare in federal environments but persists in developer communities, legacy operations channels, and some botnet-adjacent infrastructure. Inventory first: find any UnrealIRCd instances, especially linked deployments, and apply the vendor fix. If you cannot, unlink servers or take the service offline. Assume any injected commands could have altered network state.
Client-Side and Application-Layer Exposure
The remaining four entries share a November 24 deadline, which leaves time but not an excuse to wait.
CVE-2026-125350 is a use-after-free in Chromium's XML component. A crafted webpage can give a remote attacker code execution inside the sandbox. In practice this is typically one stage of an exploit chain that pairs with a sandbox escape. Because the flaw lives in Chromium, it affects Chrome, Edge, Opera, and other derived browsers, as well as embedded Chromium and Electron-based applications. Patching only Chrome is not enough. Check each browser's update channel and enterprise management tooling, then inventory Electron apps whose vendors lag behind upstream.
CVE-2026-124194 is a Microsoft Office Outlook flaw in which missing user interaction for a potentially unsafe action enables network spoofing by an unauthorized attacker. Spoofing bugs in mail clients often feed credential theft or NTLM relay. Deploy the Microsoft update, and in the meantime verify that outbound SMB and NTLM are restricted at the perimeter. Pair this with the Barracuda review above, because compromised mail gateways and spoofing flaws in clients make a strong combination.
CVE-2026-20320 affects Cisco BroadWorks. An improper restriction of XML external entity references lets an unauthenticated remote attacker read sensitive configuration information. Even without code execution, leaked configuration data can include credentials and topology details that support later intrusion. Patch, then rotate any secrets present in BroadWorks configuration files, especially for internet-reachable instances.
CVE-2026-111793 in Openwave Messaging Limited's Webtop Media Transcoder is the quietest entry. An authenticated user who bypasses the Webmail interface can convert unintended document types. Limit direct access to the transcoder service to the webmail tier, and review logs for unexpected callers.
Prioritization Summary
- Today: Barracuda CVE-2026-116606 and CVE-2026-111560. Patch, hunt, rotate.
- By Monday, November 16: Check Point CVE-2026-123039 and UnrealIRCd CVE-2026-114713.
- By November 24: Chromium, Outlook, BroadWorks, and Openwave Webtop. Start browser and Outlook rollouts now, since they cover the largest user populations.
Under BOD 26-04, evaluate each asset's internet exposure and document your decisions.
Sources: CISA KEV Catalog · Barracuda Networks Security Advisories · Check Point Support Center · Microsoft Security Response Center · Chrome Releases · Cisco Security Advisories · UnrealIRCd Security Announcements
Free KEV Alerts
- Real-time notification the moment a KEV drops
- Vendor and product details
- BOD 26-04 remediation deadline included
Pro Alerts Coming Soon
- Real-time notification the moment a KEV drops
- Filtered to your specific vendor watchlist
- Urgency scoring (Critical / Urgent / Standard)
- Direct patch links included
Stay ahead of CISA.
Search the KEV Catalog by Vendor or Product
Search for CVEs by vendor or product to identify known exploited vulnerabilities in your environment
Upcoming Patch Due Dates
via Binding Operational Directive 26-04
BOD 26-04 is CISA's current vulnerability remediation directive for Federal Civilian Executive Branch (FCEB) agencies, updating the KEV-driven framework introduced under BOD 22-01 with a more risk-based approach to prioritization. While binding only on FCEB agencies, its framework increasingly influences contractor expectations through procurement requirements, FedRAMP programs, and agency security clauses.
Loading...
Cyber Security News
You may have missed...
Hacking Editorial Brief — November 12, 2026
Threat Actors Target Enterprise Infrastructure with Multi-Exploit Staging and Persistence Tools
Researchers observed threat actors targeting Qlik Sense servers with PowerShell reverse shell commands, according to The Hacker News. The attackers' infrastructure contained exploit tools for Apache ActiveMQ and Veeam Backup & Replication, indicating preparation for broader attacks beyond the initial Qlik Sense compromise, though researchers have not disclosed victim counts, campaign scope, or attribution. Separately, Microsoft Threat Intelligence discovered threat actors deploying GSocket on compromised Linux servers to maintain encrypted remote access channels after original vulnerabilities are patched. The technique allows attackers to establish persistent backdoors that survive remediation of initial entry points, though Microsoft has not specified affected organizations, deployment scale, or threat actor identity. Additionally, researchers disclosed "worse_query," an unpatched iOS sandbox escape vulnerability that allows malicious apps to read local files from other applications, potentially exposing cryptocurrency seed phrases, private keys, and login credentials across the Apple ecosystem, according to Apple Insider. Apple has not confirmed the vulnerability or announced remediation timelines.
Confirmed Breaches Include Maersk Ransomware Incident and Romanian Government Cyber Attack
Maersk confirmed attackers stole approximately 100 gigabytes of data from a legacy system inherited through its LF Logistics acquisition, with the WhiteArmor ransomware group demanding $5 million in bitcoin, according to CISO Series. The shipping company has not disclosed the compromise timeline or affected data types. Romania's intelligence agency attributed a cyber attack on an unspecified Romanian government organization to a hacking group linked to Russia's FSB security service, according to Reuters. The agency has not disclosed the attack timeline, affected systems, or data exfiltration details. Separately, Bacon County Hospital and Health System in Georgia disclosed that an unauthorized party accessed its network on July 10 and copied files around July 27, indicating a 17-day dwell time, though the hospital has not specified affected patient counts or data types exposed. Binance reported working to resolve what it described as a "complex attack" affecting approximately $6.3 billion in funds, according to AFP, though the company has not disclosed attack vectors, compromise timelines, or fund recovery status.
Additional Reported Activity: CloudSek reported that a hacking group with ties to Kazakhstan used the Hermes autonomous AI agent framework to steal over 2,000 national security documents from Tajikistan after discovering an exposed server, though the claim has not been independently verified. India reportedly bypassed its own procurement rules to acquire Israeli phone surveillance technology with capabilities extending beyond device cloning to cloud-based data access from major technology companies, according to Al Jazeera.
Sources: The Hacker News · Microsoft Security Blog · Apple Insider · CISO Series · Reuters · Becker's Hospital Review · AFP · Just Security · Al Jazeera
*
Inside a cyberattack: How hackers steal data
The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organization, particularly as the cybercrime industry ...
SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
SilentAir, a Chinese state-level APT active since early 2025, has been hijacking Asian telecom networks to intercept SMS two-factor authentication cod...
CISA Confirms Active Exploitation of Outlook User Interaction 0-Day Vulnerability
CISA confirmed active exploitation of Microsoft Outlook zero-day vulnerability CVE-2026-124194 that exposes user authentication data through specially...
CISA Warns of Google Chromium 0-Day Vulnerability Actively Exploited in Attacks
CISA added a new Google Chromium zero-day CVE-2026-125350 to its Known Exploited Vulnerabilities catalog with attackers already using it in the wild.
Feds announce seizure of $1.2 billion from Binance theft; also takedown of 'FaceStealer' tools
The Department of Justice and FBI announced two separate actions in response to North Korea-linked cryptocurrency theft operations.
US authorities freeze billions in stolen Binance crypto after massive North Korean hack
Federal authorities froze over $2.7 billion in cryptocurrency stolen from Binance during a massive North Korean cyberattack totaling $6 billion.
New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access
In the published code, the privileged process is the Defender antimalware service, triggered through its update interface. Cybersecurity. "Everything ...
Hackers Target Qlik Sense Servers with Reverse Shells and Stage Multiple Exploits
Threat actors were observed targeting Qlik Sense servers with PowerShell reverse shell commands, with infrastructure containing ActiveMQ and Veeam exp...
Critical Red Hat Quay Vulnerability Could Expose Private Container Images
A critical vulnerability in Red Hat Quay with a CVSS score of 9.8 allows attackers to access private container images and replace content in repositor...
Updated daily