On November 10, 2026, CISA added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. This batch is notable for its breadth — it spans enterprise VoIP infrastructure, email security gateways, desktop productivity software, and browser rendering engines. Every vulnerability on this list is being weaponized right now, and the diversity of affected products means virtually every enterprise environment has at least one exposure point.
The six CVEs added to the catalog are:
- CVE-2026-20320 — Cisco BroadWorks Improper Restriction of XML External Entity Reference (XXE)
- CVE-2026-111560 — Barracuda Networks Multiple Products OS Command Injection
- CVE-2026-111793 — Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres
- CVE-2026-116606 — Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel
- CVE-2026-124194 — Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action
- CVE-2026-125350 — Google Chromium Use-After-Free
Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities within a defined timeline — typically 14 days from catalog addition, which puts the deadline at November 24, 2026. While BOD 22-01 applies directly to federal agencies, CISA strongly urges all organizations — public and private — to treat KEV additions as priority-one patching events. The KEV Catalog is not a theoretical risk register; inclusion means threat actors are actively exploiting these flaws against real targets today.
Technical Analysis
CVE-2026-20320: Cisco BroadWorks XXE Vulnerability
Affected Product: Cisco BroadWorks — a carrier-grade VoIP and unified communications platform widely deployed by telecommunications service providers and large enterprises.
Vulnerability Class: Improper Restriction of XML External Entity Reference (CWE-611)
How It Works: The vulnerability exists in the XML parsing components of Cisco BroadWorks application interfaces. The application fails to properly restrict XML External Entity (XXE) references during XML document processing. An unauthenticated or low-privilege remote attacker can craft a malicious XML payload containing external entity declarations that reference internal files, internal network resources, or attacker-controlled servers.
Successful exploitation can result in:
- Arbitrary file disclosure — reading sensitive files from the underlying operating system (
/etc/passwd, application configuration files, private keys, database credentials) - Server-Side Request Forgery (SSRF) — forcing the server to make requests to internal services, enabling network reconnaissance or pivoting to internal-only services
- Denial of Service (DoS) — via billion laughs / XML entity expansion attacks
Cisco BroadWorks is a high-value target because it sits at the core of VoIP infrastructure, processing SIP signaling, call routing, and subscriber management. Compromising this platform gives attackers access to call metadata, subscriber credentials, and potentially the ability to intercept or reroute voice communications.
Exploitation Status: Confirmed active exploitation. Added to CISA KEV on November 10, 2026.
CVE-2026-111560: Barracuda Networks Multiple Products OS Command Injection
Affected Products: Multiple Barracuda Networks products (specific product lines and versions should be confirmed via the Barracuda advisory).
Vulnerability Class: OS Command Injection (CWE-78)
How It Works: The vulnerability allows an attacker to inject arbitrary operating system commands through improperly sanitized input fields in Barracuda product interfaces. OS command injection vulnerabilities in network appliances are particularly dangerous because these devices typically run with elevated privileges, sit at network boundaries, and often lack endpoint detection and response (EDR) coverage.
An attacker exploiting this flaw can execute arbitrary commands on the underlying operating system, typically with the privileges of the web service or application service account. This enables:
- Deployment of web shells or reverse shells for persistent access
- Lateral movement from the appliance into the internal network
- Exfiltration of data processed by the device (email content, filtered traffic, credentials)
- Modification of security policies to allow malicious traffic through
Barracuda appliances have been a favored target for nation-state actors and ransomware groups alike — the 2023 ESG zero-day campaign (CVE-2023-2868) demonstrated how quickly threat actors can weaponize Barracuda vulnerabilities at scale.
Exploitation Status: Confirmed active exploitation. Added to CISA KEV on November 10, 2026.
CVE-2026-111793: Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres
Affected Product: Openwave Messaging Limited Webtop Media Transcoder component.
Vulnerability Class: Incorrect Resource Transfer Between Spheres (CWE-668)
How It Works: This vulnerability involves improper handling of resource transfers between different security contexts within the Webtop Media Transcoder component. The Media Transcoder is responsible for converting multimedia content (images, audio, video) for web-based email clients. The vulnerability allows an attacker to bypass the security boundary between the transcoding service and other application components, potentially enabling unauthorized access to resources, data, or functionality that should be restricted.
In the context of a webmail platform, this type of vulnerability can be leveraged to access other users' email content, session data, or to escalate privileges within the application stack. Webmail platforms are consistently targeted by espionage-motivated threat actors because they provide direct access to communications intelligence.
Exploitation Status: Confirmed active exploitation. Added to CISA KEV on November 10, 2026.
CVE-2026-116606: Barracuda Networks Email Security Gateway (ESG) Authentication Bypass
Affected Product: Barracuda Networks Email Security Gateway (ESG) appliances.
Vulnerability Class: Authentication Bypass Using an Alternate Path or Channel (CWE-288)
How It Works: The vulnerability allows an attacker to bypass authentication mechanisms on Barracuda ESG appliances by accessing functionality through an alternate path or channel that does not enforce the same authentication checks as the primary interface. This is the second Barracuda ESG vulnerability in this KEV batch, and the combination of an authentication bypass with the OS command injection in CVE-2026-111560 creates a potentially devastating attack chain: an unauthenticated attacker can bypass login controls and then execute arbitrary OS commands.
ESG appliances process all inbound and outbound email traffic for an organization. Compromising an ESG gives attackers:
- Full visibility into all email communications (inbound and outbound)
- The ability to modify, redirect, or intercept email messages
- Access to email-borne credentials, financial data, and sensitive business communications
- A persistent foothold at the network perimeter
Authentication bypass vulnerabilities in security appliances are especially insidious because they undermine the very control the device is supposed to enforce. The Barracuda ESG has a documented history of targeted exploitation — the 2023 UNC4841 campaign exploited CVE-2023-2868 to deploy malware on ESG appliances across multiple industries.
Exploitation Status: Confirmed active exploitation. Added to CISA KEV on November 10, 2026.
CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action
Affected Product: Microsoft Office Outlook (desktop client). Specific versions should be confirmed via the Microsoft Security Response Center (MSRC) advisory.
Vulnerability Class: Missing User Interaction for Potentially Unsafe Action (CWE-693 / related to improper security UI)
How It Works: The vulnerability in Microsoft Outlook allows a potentially unsafe action to execute without requiring explicit user interaction or consent. In practical terms, this means an attacker can craft a malicious email that, when processed by Outlook (potentially even in the Preview Pane), triggers an action that would normally require the user to click a link, open an attachment, or explicitly approve a prompt.
This class of vulnerability is particularly dangerous in Outlook because:
- Preview Pane exploitation: Malicious content can execute simply by the user selecting the email in the message list, without opening it
- No user interaction required: Traditional user awareness training ("don't click suspicious links") provides no protection
- NTLM credential theft: Similar Outlook vulnerabilities have historically been used to force NTLM authentication to attacker-controlled servers, leaking password hashes
- Mass exploitation potential: Every Outlook user is a potential target; a single crafted email can compromise an endpoint
Outlook vulnerabilities requiring no user interaction are among the most valuable to threat actors because they eliminate the human variable entirely. Given Outlook's ubiquity in enterprise environments, this vulnerability has an enormous attack surface.
Exploitation Status: Confirmed active exploitation. Added to CISA KEV on November 10, 2026.
CVE-2026-125350: Google Chromium Use-After-Free
Affected Product: Google Chromium — the open-source browser project that underpins Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, and numerous other Chromium-based browsers.
Vulnerability Class: Use-After-Free (CWE-416)
How It Works: A use-after-free vulnerability occurs when a program continues to reference a memory location after the memory has been freed and potentially reallocated. In the context of Chromium, this type of vulnerability typically exists in the rendering engine (Blink) or JavaScript engine (V8). An attacker can craft a malicious web page that, when visited by a victim, triggers the use-after-free condition.
Exploitation of a browser use-after-free can result in:
- Arbitrary code execution within the browser sandbox
- Sandbox escape when chained with additional vulnerabilities
- Drive-by download attacks — victim simply visits a compromised or malicious website
- Targeted watering hole attacks — attackers compromise websites frequented by specific target populations
Chromium zero-days are consistently among the most actively exploited vulnerabilities because of the browser's massive user base. A use-after-free in Chromium affects not just Chrome users but every Chromium-based browser — Microsoft Edge alone is the default browser on every Windows endpoint in most enterprises.
Exploitation Status: Confirmed active exploitation in the wild. Added to CISA KEV on November 10, 2026.
Detection & Response
The following detection content targets observable behaviors associated with exploitation of the vulnerabilities in this KEV batch. Because these CVEs span network appliances, server applications, desktop software, and browsers, detection strategies must be layered across network, endpoint, and application telemetry.
Sigma Rules
---
title: Cisco BroadWorks XXE Exploitation - Suspicious XML Entity Declarations in HTTP Requests
id: 8a2f4b31-7c1e-4d56-a392-1e5b9f03c7d8
status: experimental
description: Detects HTTP requests to Cisco BroadWorks application interfaces containing XML External Entity declarations, indicative of XXE exploitation attempts against CVE-2026-20320.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/10
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method:
- 'POST'
- 'PUT'
cs-uri|contains:
- '/webservice'
- '/provisioning'
- '/ocomm'
- '/cli'
cs-body|contains:
- '<!ENTITY'
- 'SYSTEM "file://"'
- 'SYSTEM "http://"'
- '<!DOCTYPE'
- '%ENTITY'
condition: selection
falsepositives:
- Legitimate XML API integrations using DOCTYPE declarations (rare in BroadWorks API calls)
level: high
---
title: Barracuda ESG - Web Shell or Command Execution on Appliance
id: 3e7b1c94-5a8f-4d12-b6e3-9c2f8a04d1b6
status: experimental
description: Detects process execution on Barracuda ESG appliances consistent with post-exploitation activity following OS command injection (CVE-2026-111560) or authentication bypass (CVE-2026-116606). Identifies web server or application processes spawning shell commands.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/10
tags:
- attack.execution
- attack.t1059.004
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- 'httpd'
- 'nginx'
- 'apache'
- 'lighttpd'
- 'php'
- 'perl'
- 'python'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/nc'
- '/ncat'
- '/netcat'
- '/curl'
- '/wget'
- '/chmod'
- '/chown'
- '/id'
- '/whoami'
- '/uname'
- '/cat'
- '/base64'
- '/openssl'
condition: selection_parent and selection_child
falsepositives:
- Legitimate appliance maintenance scripts executed by administrators via the web UI
level: critical
---
title: Outlook NTLM Authentication to External IP - Potential CVE-2026-124194 Exploitation
id: 5d1a8e72-3b9c-4f67-a821-6e4d0c93b2f5
status: experimental
description: Detects Microsoft Outlook initiating SMB or WebDAV connections to external IP addresses, which may indicate exploitation of CVE-2026-124194 where an email triggers NTLM authentication to an attacker-controlled server without user interaction.
references:
- https://www.cisa.gov/news-events/alerts/2026/11/10/cisa-adds-six-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/11/10
tags:
- attack.credential_access
- attack.t1187
- attack.t1040
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: '\OUTLOOK.EXE'
DestinationPort:
- 445
- 139
- 80
- 443
filter_internal:
DestinationIp|startswith:
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.20.'
- '172.21.'
- '172.22.'
- '172.23.'
- '172.24.'
- '172.25.'
- '172.26.'
- '172.27.'
- '172.28.'
- '172.29.'
- '172.30.'
- '172.31.'
- '192.168.'
- '127.'
condition: selection and not filter_internal
falsepositives:
- Outlook connecting to external Exchange servers hosted by third-party providers
- SharePoint or OneDrive integration accessing external resources
level: high
KQL (Microsoft Sentinel / Defender)
// Hunt 1: Outlook network connections to external IPs (potential CVE-2026-124194 exploitation)
// Identifies Outlook.exe establishing connections to non-RFC1918 addresses on SMB/WebDAV ports
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "OUTLOOK.EXE"
| where RemotePort in (445, 139, 80, 443, 8080)
| where not(ipv4_is_private(RemoteIP))
| where RemoteIP !in ("127.0.0.1", "0.0.0.0")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
RemoteIP, RemotePort, RemoteUrl, ActionType
| order by TimeGenerated desc
// Hunt 2: Suspicious child processes spawned by web server processes (Barracuda / Cisco appliance exploitation)
// Detects httpd/nginx/PHP spawning shell interpreters — consistent with CVE-2026-111560 and CVE-2026-116606 post-exploitation
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("httpd", "nginx", "apache2", "lighttpd", "php", "php-fpm", "perl")
| where FileName in~ ("sh", "bash", "dash", "zsh", "nc", "ncat", "curl", "wget", "base64", "python", "python3", "perl", "whoami", "id", "uname")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc
// Hunt 3: Chromium-based browser child process anomalies (potential CVE-2026-125350 sandbox escape)
// Detects Chrome/Edge renderer processes spawning unexpected child processes
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe")
| where InitiatingProcessCommandLine has_any ("--type=renderer", "--type=gpu")
| where FileName !in~ ("chrome.exe", "msedge.exe", "conhost.exe", "dwm.exe", "WerFault.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
FileName, ProcessCommandLine, SHA256, AccountName
| order by TimeGenerated desc
// Hunt 4: Syslog/CEF ingestion — Barracuda ESG authentication bypass indicators
// Identifies successful admin logins from unusual source IPs or at unusual times on Barracuda appliances
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor contains "Barracuda"
| where DeviceProduct contains "Email Security Gateway" or DeviceProduct contains "ESG"
| where Activity contains "login" or Activity contains "auth"
| where AdditionalExtensions has "admin"
| extend SourceIP = tostring(SourceIP)
| summarize LoginCount = count(), DistinctSources = dcount(SourceIP), SourceIPs = make_set(SourceIP)
by DeviceName, DestinationUserName, bin(TimeGenerated, 1h)
| where DistinctSources > 3
| order by LoginCount desc
Velociraptor VQL
-- Hunt for post-exploitation artifacts on endpoints potentially compromised
-- via CVE-2026-124194 (Outlook) or CVE-2026-125350 (Chromium UAF)
-- Identifies recently executed suspicious processes and browser-spawned anomalies
-- Query 1: Outlook and browser child processes (last 7 days)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
hash(path=Exe) AS ExeHash
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|certutil|bitsadmin|msiexec)'
AND (
-- Check if parent is Outlook or a browser
get(pid=Ppid).Name =~ '(?i)(OUTLOOK|chrome|msedge|brave|opera)'
)
ORDER BY CreateTime DESC
-- Query 2: Recently modified files in temp directories (common dropper locations)
SELECT FullPath, Size, Mtime, Atime, Ctime,
hash(path=FullPath) AS FileHash
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\**', accessor='ntfs')
WHERE Mtime > now() - 604800
AND FullPath =~ '(?i)\\.(exe|dll|ps1|bat|vbs|js|wsf|hta|scr)$'
ORDER BY Mtime DESC
LIMIT 100
-- Query 3: Active network connections from Outlook or browsers to non-standard ports
SELECT Pid, Name, Path, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)(OUTLOOK|chrome|msedge)'
AND RemotePort NOT IN (80, 443, 25, 110, 143, 993, 995, 587, 465)
AND Status =~ 'ESTABLISHED'
Remediation Script
# =============================================================================
# CISA KEV November 2026 Batch - Enterprise Verification & Remediation Script
# Run as Administrator on domain-joined Windows endpoints
# Covers: CVE-2026-124194 (Outlook), CVE-2026-125350 (Chromium)
# For network appliances (Cisco BroadWorks, Barracuda, Openwave), see vendor advisories
# =============================================================================
$ErrorActionPreference = 'Continue'
$reportDate = Get-Date -Format 'yyyy-MM-dd_HHmm'
$reportPath = "C:\Temp\KEV_Remediation_Report_$reportDate.txt"
New-Item -Path 'C:\Temp' -ItemType Directory -Force | Out-Null
"=== CISA KEV November 2026 Remediation Report ===" | Out-File $reportPath
"Generated: $(Get-Date)" | Out-File $reportPath -Append
"Hostname: $env:COMPUTERNAME" | Out-File $reportPath -Append
"" | Out-File $reportPath -Append
# -----------------------------------------------------------------------------
# 1. CVE-2026-124194 - Microsoft Outlook: Check installed version and patch status
# -----------------------------------------------------------------------------
"[+] Checking Microsoft Outlook installation and version..." | Out-File $reportPath -Append
$outlookPath = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE' -ErrorAction SilentlyContinue
if ($outlookPath) {
$outlookExe = $outlookPath.'(default)'
$outlookVersion = (Get-Item $outlookExe -ErrorAction SilentlyContinue).VersionInfo.ProductVersion
" Outlook Version: $outlookVersion" | Out-File $reportPath -Append
" Path: $outlookExe" | Out-File $reportPath -Append
" ACTION REQUIRED: Verify this version includes the November 2026 security update." | Out-File $reportPath -Append
" Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124194" | Out-File $reportPath -Append
} else {
" Outlook not found in App Paths. Checking Click-to-Run..." | Out-File $reportPath -Append
$c2r = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue
if ($c2r) {
" Office C2R Version: $($c2r.VersionToReport)" | Out-File $reportPath -Append
" Channel: $($c2r.UpdateChannel)" | Out-File $reportPath -Append
} else {
" No Outlook/Office installation detected." | Out-File $reportPath -Append
}
}
# Force Office update check
"`n[+] Triggering Microsoft Office update check..." | Out-File $reportPath -Append
try {
$officeC2RPath = "C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe"
if (Test-Path $officeC2RPath) {
Start-Process -FilePath $officeC2RPath -ArgumentList '/update user displaylevel=false' -Wait -NoNewWindow
" Office update check initiated. Monitor for completion." | Out-File $reportPath -Append
} else {
" OfficeC2RClient.exe not found. Manual update may be required." | Out-File $reportPath -Append
}
} catch {
" ERROR triggering Office update: $_" | Out-File $reportPath -Append
}
# -----------------------------------------------------------------------------
# 2. CVE-2026-125350 - Chromium: Check Chrome and Edge versions
# -----------------------------------------------------------------------------
"`n[+] Checking Chromium-based browser versions..." | Out-File $reportPath -Append
# Google Chrome
$chromePath = @(
"${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
"${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
"$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
) | Where-Object { Test-Path $_ } | Select-Object -First 1
if ($chromePath) {
$chromeVersion = (Get-Item $chromePath).VersionInfo.ProductVersion
" Google Chrome Version: $chromeVersion" | Out-File $reportPath -Append
" Path: $chromePath" | Out-File $reportPath -Append
" ACTION: Ensure Chrome is updated to the latest stable release." | Out-File $reportPath -Append
} else {
" Google Chrome not detected." | Out-File $reportPath -Append
}
# Microsoft Edge
$edgePath = @(
"${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe",
"${env:ProgramFiles}\Microsoft\Edge\Application\msedge.exe"
) | Where-Object { Test-Path $_ } | Select-Object -First 1
if ($edgePath) {
$edgeVersion = (Get-Item $edgePath).VersionInfo.ProductVersion
" Microsoft Edge Version: $edgeVersion" | Out-File $reportPath -Append
" Path: $edgePath" | Out-File $reportPath -Append
} else {
" Microsoft Edge not detected." | Out-File $reportPath -Append
}
# Force Chrome update via Google Update
"`n[+] Triggering Google Chrome update..." | Out-File $reportPath -Append
$googleUpdate = "${env:ProgramFiles(x86)}\Google\Update\GoogleUpdate.exe"
if (Test-Path $googleUpdate) {
Start-Process -FilePath $googleUpdate -ArgumentList '/ua /installsource ondemand' -Wait -NoNewWindow
" Chrome update triggered." | Out-File $reportPath -Append
} else {
" Google Update not found. Manual update may be required." | Out-File $reportPath -Append
}
# -----------------------------------------------------------------------------
# 3. Hardening: Disable NTLM outbound to untrusted networks (mitigates CVE-2026-124194 NTLM relay)
# -----------------------------------------------------------------------------
"`n[+] Applying NTLM hardening policies (CVE-2026-124194 mitigation)..." | Out-File $reportPath -Append
# Block NTLMv1
$lsaPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
$currentLM = (Get-ItemProperty -Path $lsaPath -Name 'LmCompatibilityLevel' -ErrorAction SilentlyContinue).LmCompatibilityLevel
if ($null -eq $currentLM -or $currentLM -lt 5) {
Set-ItemProperty -Path $lsaPath -Name 'LmCompatibilityLevel' -Value 5 -Type DWord
" LmCompatibilityLevel set to 5 (NTLMv2 only, refuse LM & NTLM)." | Out-File $reportPath -Append
} else {
" LmCompatibilityLevel already at $currentLM (adequate)." | Out-File $reportPath -Append
}
# Block outbound NTLM to remote servers (restrict NTLM traffic)
$msvPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0'
if (-not (Test-Path $msvPath)) { New-Item -Path $msvPath -Force | Out-Null }
Set-ItemProperty -Path $msvPath -Name 'RestrictSendingNTLMTraffic' -Value 2 -Type DWord
" RestrictSendingNTLMTraffic set to 2 (deny all outbound NTLM to remote servers)." | Out-File $reportPath -Append
" NOTE: Test this setting in your environment — it may impact applications using NTLM to external services." | Out-File $reportPath -Append
# -----------------------------------------------------------------------------
# 4. SMB Signing enforcement (defense-in-depth for NTLM relay attacks)
# -----------------------------------------------------------------------------
"`n[+] Checking SMB signing configuration..." | Out-File $reportPath -Append
$smbServer = Get-SmbServerConfiguration -ErrorAction SilentlyContinue
if ($smbServer) {
if (-not $smbServer.RequireSecuritySignature) {
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
" SMB server signing REQUIRED (enabled)." | Out-File $reportPath -Append
} else {
" SMB server signing already required." | Out-File $reportPath -Append
}
}
$smbClient = Get-SmbClientConfiguration -ErrorAction SilentlyContinue
if ($smbClient) {
if (-not $smbClient.RequireSecuritySignature) {
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force
" SMB client signing REQUIRED (enabled)." | Out-File $reportPath -Append
} else {
" SMB client signing already required." | Out-File $reportPath -Append
}
}
# -----------------------------------------------------------------------------
# 5. Windows Update check
# -----------------------------------------------------------------------------
"`n[+] Checking for pending Windows Updates..." | Out-File $reportPath -Append
try {
$updateSession = New-Object -ComObject Microsoft.Update.Session
$updateSearcher = $updateSession.CreateUpdateSearcher()
$searchResult = $updateSearcher.Search("IsInstalled=0 and Type='Software' and IsHidden=0")
" Pending updates: $($searchResult.Updates.Count)" | Out-File $reportPath -Append
foreach ($update in $searchResult.Updates) {
" - $($update.Title)" | Out-File $reportPath -Append
}
} catch {
" ERROR querying Windows Update: $_" | Out-File $reportPath -Append
}
# -----------------------------------------------------------------------------
# Summary
# -----------------------------------------------------------------------------
"`n========================================" | Out-File $reportPath -Append
"REMEDIATION CHECKLIST:" | Out-File $reportPath -Append
"[ ] CVE-2026-124194 - Outlook: Apply November 2026 Office security update" | Out-File $reportPath -Append
"[ ] CVE-2026-125350 - Chromium: Update Chrome/Edge to latest stable" | Out-File $reportPath -Append
"[ ] CVE-2026-20320 - Cisco BroadWorks: Apply Cisco patch (see advisory)" | Out-File $reportPath -Append
"[ ] CVE-2026-111560 - Barracuda: Apply Barracuda patch (see advisory)" | Out-File $reportPath -Append
"[ ] CVE-2026-111793 - Openwave Webtop: Apply Openwave patch (see advisory)" | Out-File $reportPath -Append
"[ ] CVE-2026-116606 - Barracuda ESG: Apply Barracuda patch (see advisory)" | Out-File $reportPath -Append
"[ ] Verify NTLM hardening did not break any critical applications" | Out-File $reportPath -Append
"" | Out-File $reportPath -Append
"CISA KEV Deadline for FCEB: November 24, 2026" | Out-File $reportPath -Append
"========================================" | Out-File $reportPath -Append
Write-Host "`nReport saved to: $reportPath" -ForegroundColor Green
Write-Host "Review the report and complete all checklist items." -ForegroundColor Yellow
#!/bin/bash
# =============================================================================
# CISA KEV November 2026 - Linux/Network Appliance Verification Script
# Covers: Cisco BroadWorks, Barracuda ESG, Openwave Webtop exposure checks
# Run as root or with sudo on management/monitoring hosts
# =============================================================================
REPORT="/tmp/kev_audit_$(date +%Y%m%d_%H%M).txt"
echo "=== CISA KEV November 2026 Network Appliance Audit ===" > "$REPORT"
echo "Date: $(date)" >> "$REPORT"
echo "Host: $(hostname)" >> "$REPORT"
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 1. Identify Cisco BroadWorks instances on the network (CVE-2026-20320)
# -----------------------------------------------------------------------------
echo "[+] Scanning for Cisco BroadWorks application interfaces..." >> "$REPORT"
# Common BroadWorks ports: 80, 443, 2208, 8443
echo " Checking for BroadWorks HTTP/HTTPS services on common ports..." >> "$REPORT"
for host in $(cat /etc/hosts | grep -i broad | awk '{print $2}' 2>/dev/null); do
for port in 443 8443; do
if timeout 3 bash -c "echo >/dev/tcp/$host/$port" 2>/dev/null; then
banner=$(timeout 5 curl -sk "https://$host:$port/" 2>/dev/null | head -20)
if echo "$banner" | grep -qi "broadworks\|bw_\|cisco"; then
echo " ALERT: Possible BroadWorks instance at $host:$port" >> "$REPORT"
echo " ACTION: Verify patch level for CVE-2026-20320 (XXE)" >> "$REPORT"
fi
fi
done
done
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 2. Identify Barracuda ESG appliances (CVE-2026-111560, CVE-2026-116606)
# -----------------------------------------------------------------------------
echo "[+] Scanning for Barracuda ESG management interfaces..." >> "$REPORT"
# Barracuda ESG management typically runs on port 8000/443
for subnet in "10.0.0.0/8" "192.168.0.0/16" "172.16.0.0/12"; do
echo " Scanning $subnet for Barracuda ESG on port 8000 and 443..." >> "$REPORT"
# Use nmap if available for targeted scanning
if command -v nmap &>/dev/null; then
nmap -p 8000,443 --open -sV --script=http-title "$subnet" 2>/dev/null | \
grep -iA5 "barracuda\|Email Security Gateway\|ESG" >> "$REPORT" 2>/dev/null
else
echo " nmap not available. Install nmap for network scanning." >> "$REPORT"
fi
done
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 3. Check for web shells or suspicious files in common web directories
# -----------------------------------------------------------------------------
echo "[+] Checking web server directories for recently modified suspicious files..." >> "$REPORT"
WEB_DIRS="/var/www /opt/barracuda /usr/share/nginx /srv/www"
for dir in $WEB_DIRS; do
if [ -d "$dir" ]; then
echo " Scanning $dir..." >> "$REPORT"
# Files modified in last 14 days with suspicious extensions
find "$dir" -type f \( -name "*.php" -o -name "*.jsp" -o -name "*.cgi" -o -name "*.pl" -o -name "*.sh" \) \
-mtime -14 -ls 2>/dev/null >> "$REPORT"
# Base64 encoded content in files (common web shell indicator)
grep -rl --include="*.php" --include="*.jsp" "eval\|base64_decode\|shell_exec\|passthru\|system(" \
"$dir" 2>/dev/null | while read -r f; do
echo " SUSPICIOUS: $f contains potential web shell patterns" >> "$REPORT"
done
fi
done
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 4. Check for suspicious processes (web server spawning shells)
# -----------------------------------------------------------------------------
echo "[+] Checking for suspicious process parent-child relationships..." >> "$REPORT"
ps auxf 2>/dev/null | grep -E "(httpd|nginx|apache|php|perl).*\.(sh|bash|nc|ncat|curl|wget)" >> "$REPORT" 2>/dev/null
# Also check for reverse shells
ps aux | grep -E "nc.*-e|ncat.*-e|bash.*-i|/dev/tcp/" | grep -v grep >> "$REPORT" 2>/dev/null
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 5. Check for unauthorized listening ports
# -----------------------------------------------------------------------------
echo "[+] Checking for unauthorized listening services..." >> "$REPORT"
ss -tlnp 2>/dev/null | grep -v -E "^(State|.*:(22|25|53|80|110|143|443|465|587|993|995|3306|5432|8080|8443)\s)" >> "$REPORT" 2>/dev/null
echo "" >> "$REPORT"
# -----------------------------------------------------------------------------
# 6. Summary
# -----------------------------------------------------------------------------
echo "========================================" >> "$REPORT"
echo "REMEDIATION CHECKLIST:" >> "$REPORT"
echo "[ ] CVE-2026-20320 - Patch Cisco BroadWorks per Cisco advisory" >> "$REPORT"
echo "[ ] CVE-2026-111560 - Patch Barracuda products per Barracuda advisory" >> "$REPORT"
echo "[ ] CVE-2026-116606 - Patch Barracuda ESG per Barracuda advisory" >> "$REPORT"
echo "[ ] CVE-2026-111793 - Patch Openwave Webtop Media Transcoder" >> "$REPORT"
echo "[ ] CVE-2026-124194 - Patch Microsoft Outlook (Windows endpoints)" >> "$REPORT"
echo "[ ] CVE-2026-125350 - Update all Chromium-based browsers" >> "$REPORT"
echo "" >> "$REPORT"
echo "CISA KEV FCEB Deadline: November 24, 2026" >> "$REPORT"
echo "========================================" >> "$REPORT"
echo ""
echo "Audit complete. Report saved to: $REPORT"
cat "$REPORT"
Remediation
Immediate Actions (Within 24-48 Hours)
1. CVE-2026-20320 — Cisco BroadWorks XXE
- Apply the Cisco security patch for BroadWorks immediately. Refer to the Cisco Security Advisory for the specific fixed version applicable to your BroadWorks deployment (Application Server, Network Server, Media Server, Profile Server).
- If patching cannot be completed immediately, restrict network access to BroadWorks application interfaces (provisioning portal, OCI-P interface, CommPilot) to trusted management networks only.
- Implement a web application firewall (WAF) rule to inspect and reject XML payloads containing
<!ENTITYor<!DOCTYPEdeclarations targeting BroadWorks endpoints. - Review BroadWorks access logs for evidence of XXE exploitation — look for XML payloads containing
SYSTEM "file:///"or external URL references.
2. CVE-2026-111560 — Barracuda OS Command Injection
- Apply the Barracuda security patch to all affected products. Consult the Barracuda Security Advisories page for product-specific patch versions.
- If a patch is not yet available for your specific product/firmware combination, consider taking the appliance offline or restricting management interface access to an isolated management VLAN.
- Conduct a forensic review of the appliance. Given Barracuda's history of pre-patch exploitation, assume compromise and investigate for web shells, unauthorized processes, and unexpected outbound connections.
- Critical lesson from 2023: In the CVE-2023-2868 incident, Barracuda advised customers to physically replace compromised ESG appliances because threat actors had achieved persistence that survived firmware updates. Evaluate whether this guidance applies to your situation.
3. CVE-2026-116606 — Barracuda ESG Authentication Bypass
- Patch the ESG appliance immediately via the Barracuda update mechanism or manual firmware update.
- Audit all administrative accounts on the ESG for unauthorized additions or privilege changes.
- Review authentication logs for successful logins from unexpected source IP addresses, particularly logins that bypassed the standard web interface.
- Rotate all credentials stored on or passing through the ESG, including LDAP bind credentials, API keys, and any certificates.
- Verify that the ESG management interface is not accessible from the internet. The management interface should only be reachable from a dedicated management network.
4. CVE-2026-111793 — Openwave Webtop Media Transcoder
- Apply the Openwave patch for the Webtop Media Transcoder component. Contact Openwave (now Synchronoss) support for the specific patch and installation instructions.
- If the Media Transcoder service is not actively used, consider disabling it as an interim measure.
- Review Webtop access logs for anomalous requests to the Media Transcoder endpoints, particularly requests attempting to access resources outside the transcoding context.
5. CVE-2026-124194 — Microsoft Outlook
- Apply the November 2026 Microsoft Office security update via Windows Update, Microsoft Update, WSUS, or Microsoft Endpoint Configuration Manager. Refer to the MSRC advisory for CVE-2026-124194 for specific patched version numbers.
- Enable the Block NTLM outbound Group Policy setting (
RestrictSendingNTLMTraffic = 2) as defense-in-depth to prevent NTLM hash leakage even if a similar vulnerability is discovered. - Consider disabling the Reading Pane (Preview Pane) as a temporary measure if patching cannot be completed immediately, though this may not fully mitigate all exploitation vectors.
- Deploy the Sigma rule and KQL queries above to detect Outlook connections to external SMB/WebDAV resources.
6. CVE-2026-125350 — Google Chromium Use-After-Free
- Update Google Chrome to the latest stable release immediately. Chrome's auto-update mechanism typically delivers patches within 24-48 hours, but force a manual check via
chrome://settings/helpif needed. - Update Microsoft Edge via Windows Update or Edge's built-in updater (
edge://settings/help). - Update all other Chromium-based browsers in the environment (Brave, Opera, Vivaldi, Arc).
- For enterprise environments using managed browsers, push the update via your software management platform (SCCM, Intune, Jamf, etc.) and enforce a browser restart policy to ensure the update takes effect.
- Consider enabling Chrome's Site Isolation and Strict Site Isolation policies as defense-in-depth against renderer process exploitation.
CISA Deadlines
Under BOD 22-01, FCEB agencies must remediate all six vulnerabilities by November 24, 2026. Private-sector organizations should treat this date as their own internal deadline. If you cannot patch within this window, implement the documented mitigations and document a formal risk acceptance with a remediation timeline.
Verification and Validation
After applying patches:
- Verify the installed version matches the vendor's patched version for each product
- Re-run vulnerability scans (authenticated scans where possible) to confirm remediation
- Review the detection rules and hunt queries above for any indicators of pre-patch compromise
- If any indicators of compromise are found, initiate your incident response process — patching alone does not remove an existing foothold
- Document the remediation in your vulnerability management system with the CVE, date patched, and verification method
Key Takeaways
This KEV batch is a cross-section of the modern attack surface: carrier VoIP infrastructure, email security appliances, webmail platforms, desktop email clients, and browser rendering engines. The inclusion of two Barracuda ESG vulnerabilities is particularly concerning given the documented history of sophisticated threat actors targeting these appliances for persistent, long-term access.
The combination of CVE-2026-116606 (authentication bypass) and CVE-2026-111560 (command injection) on Barracuda appliances creates a complete unauthenticated remote code execution chain — the most dangerous vulnerability class in network security. If you operate Barracuda ESG appliances, treat this as your highest priority.
The Microsoft Outlook vulnerability (CVE-2026-124194) and Chromium use-after-free (CVE-2026-125350) represent the client-side threat vector — a single malicious email or web page visit can compromise an endpoint. These vulnerabilities bypass the human firewall entirely, making technical controls (patching, NTLM hardening, browser update enforcement) the only reliable defense.
Patch now. Hunt for evidence of pre-patch compromise. Assume breach if you find indicators.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.