---
title: CISA KEV adds six: the Outlook zero-day, the Chrome XML zero-day, both Barracuda ESG bugs, a Cisco BroadWorks XXE and an Openwave Webtop transcoder flaw | ctxsec
url: https://ctxsec.com/items/cisa-kev-nov-10-outlook-chrome-barracuda-broadworks-openwave
description: "CISA's Nov 10 update lists Microsoft Outlook CVE-2026-124194, Chrome CVE-2026-125350 and Barracuda CVE-2026-116606 and CVE-2026-111560 (all covered earlier), plus two lower-profile additions. Cisco BroadWorks CVE-2026-20320 (CVSS 7.5) is an unauthenticated blind XXE in the Open Client Interface - Provisioning (OCI-P) service that lets an attacker read files with the BroadWorks user's privileges; Cisco fixed it in RI.2026.07 in August and lists no workaround. Openwave Webtop Media Transcoder CVE-2026-111793 lets an authenticated user convert file types the admin meant to block by going around the webmail interface; JVN says the developer has seen attacks, and the fix is version 1.1.22.0 or later (the vendor advises moving to a supported Media Server 2.0 release)."
status: "official (CISA KEV catalog 2026.11.10, six entries added Nov 10, 2026; Barracuda pair due Nov 13 with forensic triage required, the rest due Nov 24; ransomware use Unknown for all six)"
published: 2026-11-10
---

> CISA's Nov 10 update lists Microsoft Outlook CVE-2026-124194, Chrome CVE-2026-125350 and Barracuda CVE-2026-116606 and CVE-2026-111560 (all covered earlier), plus two lower-profile additions. Cisco BroadWorks CVE-2026-20320 (CVSS 7.5) is an unauthenticated blind XXE in the Open Client Interface - Provisioning (OCI-P) service that lets an attacker read files with the BroadWorks user's privileges; Cisco fixed it in RI.2026.07 in August and lists no workaround. Openwave Webtop Media Transcoder CVE-2026-111793 lets an authenticated user convert file types the admin meant to block by going around the webmail interface; JVN says the developer has seen attacks, and the fix is version 1.1.22.0 or later (the vendor advises moving to a supported Media Server 2.0 release).

[← Cybersecurity News](/news) · [markdown](/items/cisa-kev-nov-10-outlook-chrome-barracuda-broadworks-openwave.md)

official (CISA KEV catalog 2026.11.10, six entries added Nov 10, 2026; Barracuda pair due Nov 13 with forensic triage required, the rest due Nov 24; ransomware use Unknown for all six)

2026-11-10

### CISA KEV adds six: the Outlook zero-day, the Chrome XML zero-day, both Barracuda ESG bugs, a Cisco BroadWorks XXE and an Openwave Webtop transcoder flaw

- **Barracuda (due Nov 13, forensic triage required):** patching isn't enough under BOD 26-04; agencies must check exposed ESGs for compromise. See the Nov 10 Barracuda and hunt items.
- **Outlook and Chrome (due Nov 24):** Office build check plus Chrome 157.0.8103.50 or later; Chromium-based browsers need their own fixed builds.
- **Cisco BroadWorks:** affects Application Delivery Platform, Application Server, Profile Server and Xtended Services Platform before RI.2026.07 (advisory cisco-sa-bworks-xxe-uwUd7CEt). Mostly a service-provider and UCaaS platform; restrict OCI-P to provisioning networks.
- **Openwave Webtop Media Transcoder:** advisory CAN-2026-2032674 rates it CVSS 4.3; JPCERT/CC's JVNVU#93403064 says exploitation of an authenticated, crafted upload may expose sensitive information.

Sources: [CISA: CISA Adds Six Known Exploited Vulnerabilities to Catalog (Nov 10, 2026)](https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog) · [CISA Known Exploited Vulnerabilities Catalog (2026.11.10)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Cisco: BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability (cisco-sa-bworks-xxe-uwUd7CEt)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bworks-xxe-uwUd7CEt) · [Openwave Messaging advisory CAN-2026-2032674](https://github.com/GISOpenwave/security-advisories-public/blob/main/CAN-2026-2032674.md) · [JVN: JVNVU#93403064 Webtop Media Transcoder (Nov 9, 2026)](https://jvn.jp/en/vu/JVNVU93403064/)