CISA KEV adds six: the Outlook zero-day, the Chrome XML zero-day, both Barracuda ESG bugs, a Cisco BroadWorks XXE and an Openwave Webtop transcoder flaw
- Barracuda (due Nov 13, forensic triage required): patching isn't enough under BOD 26-04; agencies must check exposed ESGs for compromise. See the Nov 10 Barracuda and hunt items.
- Outlook and Chrome (due Nov 24): Office build check plus Chrome 157.0.8103.50 or later; Chromium-based browsers need their own fixed builds.
- Cisco BroadWorks: affects Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform before RI.2026.07 (advisory cisco-sa-bworks-xxe-uwUd7CEt). Mostly a service-provider and UCaaS platform; restrict OCI-P to provisioning networks.
- Openwave Webtop Media Transcoder: advisory CAN-2026-2032674 rates it CVSS 4.3; JPCERT/CC's JVNVU#93403064 says exploitation of an authenticated, crafted upload may expose sensitive information.
Sources: CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026) · CISA Known Exploited Vulnerabilities Catalog (2026.11.10) · Cisco: BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt) · Openwave Messaging advisory CAN-2026-2032674 · JVN: JVNVU#93403064 Webtop Media Transcoder (Nov 9, 2026)