Cyber Threat Brief — November 11 2026
1. Barracuda ESG chain — CVE-2026-116606 and CVE-2026-111560
TL;DR: CISA added Barracuda CVE-2026-116606 and CVE-2026-111560 to the Known Exploited Vulnerabilities catalog on 10 November, due 13 November. Apply the patch for each product in Barracuda’s advisory, and keep the Admin UI off the internet.
What’s New:
- CISA added both CVEs on 10 November. The federal due date is 13 November. Barracuda says the activity has affected a small number of organizations.
- CVE-2026-116606 needs no login, but the attacker must reach the ESG Admin UI. CISA says it restores a crafted backup and changes the appliance’s global configuration.
- CVE-2026-111560 is command injection on ESG, ADC, BMA, WCC, WAF, and WSG. It needs an administrator. CISA says the command runs as root when a crafted timezone value is processed. Chained with CVE-2026-116606, that path reaches root.
- SecurityWeek says Previdian saw 17 attempts against CVE-2026-116606 from 15 IP addresses in three countries between 9 and 11 November.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ESG on 9.4.017 or later | Vulnerable version | T1190 | Firmware inventory | Apply patch BNSF-40425 on ESG 9.4.017 or later. Barracuda advisory |
| ESG before 9.4.017 | Vulnerable version | T1190 | Firmware inventory | Apply patch BNSF-40430 on ESG before 9.4.017. Barracuda advisory |
| Barracuda Load Balancer ADC | Vulnerable version | T1059 | Firmware inventory | Apply patch BNADC-16586 on the Load Balancer ADC for CVE-2026-111560. Barracuda advisory |
| Barracuda Web Application Firewall | Vulnerable version | T1059 | Firmware inventory | Apply patch BNADC-16586 on the Web Application Firewall for CVE-2026-111560. Barracuda advisory |
| Barracuda Message Archiver | Vulnerable version | T1059 | Firmware inventory | Apply patch BNMA-32468 on Message Archiver for CVE-2026-111560. Barracuda advisory |
| Barracuda WAF Control Center | Vulnerable version | T1059 | Firmware inventory | Apply patch BNWF-60060 on WAF Control Center for CVE-2026-111560. Barracuda advisory |
| Barracuda Web Security Gateway | Vulnerable version | T1059 | Firmware inventory | Apply patch BNYF-24789 on Web Security Gateway for CVE-2026-111560. Barracuda advisory |
| ESG configuration-import of a backup archive | Configuration behavior | T1190 | ESG admin audit log | Alert when ESG runs a configuration-import or restores a backup your operators did not start. |
| timezone value on ESG, ADC, BMA, WCC, WAF, or WSG | Configuration | T1059 | Admin audit log | Review timezone changes on ESG, ADC, BMA, WCC, WAF, and WSG, and remove any value your operators did not set. |
| Barracuda Admin UI reachable from the internet | Exposure | T1190 | Firewall policy | Block internet access to the Barracuda Admin UI and allow it only from trusted networks. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule matches the backup import or timezone value. |
| Elastic | None — verified | No rule matches the backup import or timezone value. |
| Sigma | None — verified | 2023 UNC4841 ESG rules target older malware, not this chain. |
Hunt hint: Apply the Barracuda patch for each product. Use BNSF-40425 on ESG 9.4.017 or later, and BNSF-40430 on older ESG. Apply BNADC-16586 on the ADC and the WAF, BNMA-32468 on Message Archiver, BNWF-60060 on WAF Control Center, and BNYF-24789 on Web Security Gateway. Block the Admin UI from the internet. Alert on a configuration-import or backup restore your operators did not start. Review timezone changes on ESG, ADC, BMA, WCC, WAF, and WSG.
Sources: CISA KEV catalog · CISA alert, 10 Nov · Barracuda advisory · SecurityWeek
2. Microsoft Outlook — CVE-2026-124194
TL;DR: CISA added Outlook CVE-2026-124194 to the Known Exploited Vulnerabilities catalog on 10 November, due 24 November. Apply the 10 November Office security updates, then hunt outbound SMB or WebDAV to outside hosts after a user opens a message file.
What’s New:
- CISA added CVE-2026-124194 on 10 November. The federal due date is 24 November. Microsoft says exploitation has been detected, and it has not named an actor.
- Microsoft rates it Moderate, CVSS 6.5. A user must open a crafted message file. The Preview Pane does not trigger it.
- Opening the file can make Outlook connect to an attacker-controlled location without the usual external-content warning. Microsoft says that can disclose the user’s NTLMv2 hash.
- Microsoft’s update data lists fixed builds 16.0.14334.21048 for Office LTSC 2021 and 16.0.17932.21140 for Office LTSC 2024. For Microsoft 365 Apps for Enterprise it points to the security update release notes for each channel.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Microsoft 365 Apps for Enterprise | Vulnerable version | T1187 | Software inventory | Install the 10 November 2026 security update for each update channel you run, per Microsoft’s release notes. MSRC CVE-2026-124194 Microsoft 365 Apps security updates |
| Office LTSC 2021 before 16.0.14334.21048 | Vulnerable version | T1187 | Software inventory | Update Office LTSC 2021 to 16.0.14334.21048 or later. MSRC CVE-2026-124194 |
| Office LTSC 2024 before 16.0.17932.21140 | Vulnerable version | T1187 | Software inventory | Update Office LTSC 2024 to 16.0.17932.21140 or later. MSRC CVE-2026-124194 |
| Outbound TCP 445 or 139 to an internet address | Network behavior | T1187 | Firewall or NetFlow | Alert on SMB from any internal host to the internet, and block it at the edge. Windows makes SMB connections as System, not as OUTLOOK.EXE. |
| rundll32.exe davclnt.dll,DavSetCookie to an outside host | Process behavior | T1187 | Sysmon 1 or EDR process | Alert when the WebDAV client contacts an outside host shortly after a user opens a message file. |
| OUTLOOK.EXE connection to a non-local IP | Process behavior | T1187 | Sysmon 3 or EDR network | Alert when OUTLOOK.EXE connects to an address outside Microsoft 365 ranges right after a message file is opened. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Detect Outbound SMB Traffic | Flags SMB to public IPs but does not tie it to an opened message file. |
| Elastic | Partial — SMB (Windows File Sharing) Activity to the Internet | Network-only SMB rule; misses the WebDAV path and the Outlook context. |
| Sigma | Partial — Office Application Initiated Network Connection To Non-Local IP | Sees connections Outlook makes itself, not SMB made by System. |
Hunt hint: Move Office LTSC 2021 to 16.0.14334.21048, Office LTSC 2024 to 16.0.17932.21140, and Microsoft 365 Apps to the 10 November build for its channel. The Preview Pane does not trigger this, so focus on users who open a message file. Block and alert on outbound SMB (TCP 445/139) to the internet. Alert on WebDAV client (rundll32 davclnt.dll,DavSetCookie) requests to outside hosts. Reset the password of any user whose host reached an outside SMB or WebDAV server.
Sources: CISA KEV catalog · CISA alert, 10 Nov · MSRC CVE-2026-124194 · SecurityWeek · BleepingComputer
3. Google Chrome — CVE-2026-125350
TL;DR: CISA added Chrome CVE-2026-125350 to the Known Exploited Vulnerabilities catalog on 10 November, due 24 November. Update desktop Chrome on the stable channel, and do not copy a Chrome build number onto Edge or Opera.
What’s New:
- CISA added CVE-2026-125350 on 10 November. The federal due date is 24 November. Google says it is aware that an exploit for it exists.
- The bug is a use-after-free in Chrome’s XML component. CyberInsider, citing the Chromium patch, describes a libxslt pattern-cache error.
- Google’s 9 November stable-channel post lists the fix as 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux, rolling out over the coming days and weeks.
- CISA says the bug could affect other Chromium browsers, including Edge and Opera. This brief has no Edge or Opera fixed build.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Google Chrome before 157.0.8103.50 on Windows or macOS | Vulnerable version | T1203 | Browser inventory | Upgrade Windows and macOS Chrome before 157.0.8103.50 to 157.0.8103.50 or 157.0.8103.51. Chrome stable channel |
| Google Chrome 157.0.8103.50 and 157.0.8103.51 on Windows and macOS | Fixed build | T1203 | Browser inventory | Install 157.0.8103.50 or 157.0.8103.51 on Windows and macOS. Chrome stable channel |
| Google Chrome before 157.0.8103.50 on Linux | Vulnerable version | T1203 | Browser inventory | Upgrade Linux Chrome before 157.0.8103.50 to 157.0.8103.50. Chrome stable channel |
| Google Chrome 157.0.8103.50 on Linux | Fixed build | T1203 | Browser inventory | Install 157.0.8103.50 on Linux. Do not require 157.0.8103.51 on Linux. Chrome stable channel |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified | No rule matches a Chrome XML use-after-free. |
| Elastic | None — verified | No rule matches a Chrome XML use-after-free. |
| Sigma | None — verified | No rule matches a Chrome XML use-after-free. |
Hunt hint: Inventory Chrome and update Windows and macOS to 157.0.8103.50 or 157.0.8103.51, and Linux to 157.0.8103.50. Do not apply those Chrome build numbers to Edge or Opera. CISA says other Chromium browsers can be affected, and this brief has no Edge or Opera fixed build. Google has not named an actor, a site, or a payload. Treat a browser crash as a weak signal only, because no parent process or URL is public for this bug.
Sources: CISA KEV catalog · CISA alert, 10 Nov · Chrome stable channel · BleepingComputer · CyberInsider
Detection index: ESCU 4c1652e (2026-11-03) · elastic detection-rules b351c01 (2026-11-11) · SigmaHQ d7c9da1 (2026-11-10). GitHub code search covered Barracuda, OUTLOOK.EXE network rules, outbound SMB, WebDAV (davclnt, DavSetCookie), and Chrome XML. The Outlook Partial rows were read: “Detect Outbound SMB Traffic” and “SMB (Windows File Sharing) Activity to the Internet” flag TCP 139/445 from internal to public addresses. The Sigma rule needs outlook.exe as the connecting image. The WebDAV-client rules “Windows Rundll32 WebDAV Request” (ESCU) and “Rare Connection to WebDAV Target” (Elastic) match rundll32 davclnt.dll,DavSetCookie and would also see a WebDAV fallback. Sigma’s 2023 UNC4841 Barracuda rules target that earlier campaign’s malware and were not claimed.
Status Updates
- GPUStack (CVE-2026-102895): Still due 12 Nov. No new material. Upgrade builds before 2.2.0 to 2.3.0 or a later stable release. Releases 10 Nov brief
- FreeSWITCH (CVE-2026-116779): Still due 12 Nov. No new material. The fix remains 1.11.3 or later. v1.11.3 10 Nov brief
- IBM Aspera Faspex (CVE-2026-123218): Still due 12 Nov. No new material. The fix remains 5.0.19 PL1. IBM bulletin 10 Nov brief
- OpenSSH (OpenSSH-CVE-2026-123158): Still due 12 Nov. No new material. Scope remains musl with PAM disabled. Fix remains 10.6p2. OpenSSH notes 10 Nov brief
- VMware ESX (CVE-2026-41709): Watching (no change). KEV is due today, 11 November. Prior brief
- Brotli (CVE-2026-111497): KEV is now overdue (due 10 Nov). The PAN-OS fix builds remain as listed on 10 Nov. Exposure still needs Brotli inspection plus decryption. Palo Alto 10 Nov brief
- Adobe Commerce (CVE-2026-48356): KEV is now overdue (due 10 Nov). No new material. Prior brief
- Cisco BroadWorks (CVE-2026-20320): KEV added 10 Nov, due 24 Nov. Not yet briefed. Cisco still says it is not aware of malicious use. The fix on the advisory is RI.2026.07. Advisory
- Openwave Webtop Media Transcoder (CVE-2026-111793): KEV added 10 Nov, due 24 Nov. Not yet briefed. Fixed in 1.1.22.0, and the vendor says to move to Media Server 2.0. Advisory
- European refrigeration controllers (Refrigeration-Controllers-EU-2026-11): Watching (no change). France’s C4 still attributes the 11–12 Oct attacks on about 700 French retail sites to IRGC unit Shahid Kaveh; that attribution does not cover the November wave. 10 Nov brief
- LNbits (LNbits-server-shutdown-2026-11): Watching (no change). The latest release is still v1.6.2 from 18 Sep, so there is no fixed release. Keep self-hosted LNbits stopped and the Paywall extension disabled. Releases 9 Nov brief
- Plex Media Server (Plex2Shell-CVE-2026-96652): Watching (no change). QNAP’s 6 Nov FAQ still applies: install 1.43.3.10861 or later, and clean-reinstall any NAS whose Plex was reachable from the internet. CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656 remain KEV overdue. QNAP FAQ 6 Nov brief
- N-able N-central: N-able released N-central 2026.4 HF2 (build 2026.4.1.26) on 10 Nov and has upgraded hosted servers. On-premises servers should upgrade now, and every customer must upgrade Agents, then Probes. N-able HF2 notes 10 Nov brief
- Synology DSM (Cerber-Synology-DSM-2026-10): Watching (no change). Synology still has not identified which of CVE-2024-10441, CVE-2024-50629 or CVE-2024-10445 was used. 2 Nov brief
- ARTEX (ARTEX-Software-Vendors-2026-11): Watching (no change). WorkOS attributes its incident to an escaped test agent. Microsoft’s Storm-3358 financial claim stays deferred. 3 Nov brief
- Retired from watch: BeyondTrust Remote Support CVE-2026-102764 (last update 2026-11-04); Ivanti Connect Secure CVE-2026-111357 (last update 2026-11-04). CVE-2026-118527 on the Ivanti entry is still KEV due 13 Nov; the fix trains in the 1 Nov brief still apply. 8 Nov brief 1 Nov brief
- WordPress Core (WordPress-Core-CVE-2026-119977): Watching (no change). KEV remains overdue. Before a full-package update, deny
/wp-content/upgrade/and verify 403. 7 Nov brief - SonicWall SonicOS (SonicWall-SonicOS-CVE-2026-19868): Watching (no change). KEV remains due 20 November. SNWLID-2026-0014 7 Nov brief
- SharePoint ToolShell (Storm2603-ToolShell-Fileless-2026-11): Watching (no change). CVE-2025-53770 is KEV overdue; CVE-2025-53771 is not in KEV. Prior brief
- Apple (Apple-CVE-2024-27834-2026-11): Watching (no change). CVE-2024-27834 remains KEV due 18 November. Prior brief
- Zyxel GS1900 (Zyxel-GS1900-CVE-2026-107441): Watching (no change). The 3 Nov advisory and the separate CVE-2026-7273 KEV bug remain as briefed. Prior brief
- GitLab (CVE-2026-110264): Watching (no change). Prior brief
- Canonical LXD (CVE-2026-112816): Watching (no change). Prior brief
- Binance (Binance-TraderTraitor-2026-11): Watching (no change). Prior brief
- eMudhra (eMudhra-CVE-2026-111943): Watching (no change). CVE-2026-111943 and CVE-2026-91403 remain unchanged. Prior brief
- Tailscale SSH (Tailworm-Tailscale-SSH-2026-10): Watching (no change). Prior brief
- Cursor marketplace Claude Code (Cursor-Claude-Code-2.1.313-2026-10): Watching (no change). Prior brief
- XCPE Android TV (XCPE-Botnet-2026-11): Watching (no change). Prior brief