Daily Threat Briefing: Wednesday, November 11, 2026

#4 · 2026-11-11 · Severity: Critical

Threat types: zero-day, vulnerability-exploit · Industries: media

Verified status

Checked against NVD and CISA KEV on 2026-11-11.

TL;DR

• Top story: Barracuda Networks Barracuda Email Security Gateway (ESG): Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-116606)
• Also notable: Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches; Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft
• 6 new CISA KEV entries in the last 24 hours

Executive summary

The overall threat level is critical, driven by multiple zero-day vulnerabilities and active exploits across various enterprise products. Over the past twenty-four hours, advisories highlighted critical issues including a Barracuda Networks Email Security Gateway authentication bypass vulnerability, actively exploited flaws in Cisco BroadWorks and Openwave, and an exploited Outlook zero-day among many Microsoft patches. Additionally, N-able released security hotfixes for zero-day vulnerabilities, and Google addressed a use-after-free vulnerability in Chromium. Threat intelligence feeds also tracked hundreds of new threat indicators, dozens of malware samples, and multiple ransomware victims.

Top threats

1. Barracuda Networks Barracuda Email Security Gateway (ESG): Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability (CVE-2026-116606)

Severity: Critical | Type: vulnerability-exploit | Industry: cross-industry

The Barracuda Email Security Gateway (ESG) is affected by an authentication bypass vulnerability involving an alternate path or channel. This security flaw has been assigned a CVSS score of 9.3. Administrators must address this vulnerability to secure their deployments.

Sources: CISA KEV

Recommended actions:

• Patch or mitigate CVE-2026-116606 following the vendor guidance; CISA set a remediation due date of 2026-11-13.
• Check logs of exposed systems for signs of exploitation before and after patching.

2. Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

Severity: Critical | Type: zero-day | Industry: media

CISA has added two security flaws affecting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities catalog. This action follows evidence of active exploitation despite available patches for the vulnerabilities, which include an improper restriction of XML external entity issue.

Sources: The Hacker News · CISA KEV

Recommended actions:

• Check the linked report for products you run and verify details with the vendor before acting.

3. Exploited Outlook Zero-Day Among 1,094 Flaws Patched by Microsoft

Severity: Critical | Type: zero-day | Industry: cross-industry

Microsoft has patched an actively exploited Outlook zero-day vulnerability tracked as CVE-2026-124194. This security flaw was included among a total of 1,094 flaws addressed by Microsoft.

Sources: SecurityWeek

Recommended actions:

• Check the linked report for products you run and verify details with the vendor before acting.

4. N-able releases security hotfixes for zero-day vulnerabilities

Severity: Critical | Type: zero-day | Industry: cross-industry

N-able has released security hotfixes to address zero-day vulnerabilities affecting its N-central remote monitoring and management platform. The bugs were publicly disclosed over the weekend, forcing the company to take vulnerable hosted environments offline.

Sources: BleepingComputer

Recommended actions:

• Check the linked report for products you run and verify details with the vendor before acting.

5. Google Chromium: Google Chromium Use-After-Free Vulnerability (CVE-2026-125350)

Severity: High | Type: vulnerability-exploit | Industry: cross-industry

Google has addressed a use-after-free vulnerability in Chromium with a CVSS score of 8.8. Federal civilian executive branch agencies are required to remediate this security flaw by November 24, 2026. The current exploitation status remains unknown.

Sources: CISA KEV

Recommended actions:

• Patch or mitigate CVE-2026-125350 following the vendor guidance; CISA set a remediation due date of 2026-11-24.
• Check logs of exposed systems for signs of exploitation before and after patching.

Ongoing: previously reported

Today’s action checklist

• Patch or mitigate the newly listed CISA KEV vulnerabilities (CVE-2026-20320, CVE-2026-125350, CVE-2026-124194, CVE-2026-116606, CVE-2026-111793) first; they are exploited in the wild and carry a CISA due date.
• Ransomware activity is concentrated in Healthcare: verify offline backups, patch internet-facing edge devices and review remote-access logins.
• Pull current indicators from the linked abuse.ch and OTX pages and add them to blocklists or detection rules where relevant.
• Read the linked sources for the products you run and subscribe to vendor security notices.

Indicators

17 new ransomware victims were listed in this window.

Raw indicators are not republished here. Pull them from the source pages.

• ThreatFox: 1610 new IOCs (view on threatfox.abuse.ch)
• URLhaus: 100 new malicious URLs (view on urlhaus.abuse.ch)
• MalwareBazaar: 19 new malware samples (view on bazaar.abuse.ch)

Sources

• CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
• CISA Cybersecurity Advisories and ICS Advisories (https://www.cisa.gov/news-events/cybersecurity-advisories)
• This product uses data from the NVD API but is not endorsed or certified by the NVD (https://nvd.nist.gov).
• EPSS scores by FIRST (https://www.first.org/epss)
• Ransomware victim data: ransomware.live (https://www.ransomware.live)
• Data: abuse.ch (URLhaus, ThreatFox, MalwareBazaar), https://abuse.ch. Used non-commercially.
• BleepingComputer (https://www.bleepingcomputer.com/feed/)
• The Hacker News (https://feeds.feedburner.com/TheHackersNews)
• SecurityWeek (https://feeds.feedburner.com/securityweek)
• The Record (https://therecord.media/feed)
• Krebs on Security (https://krebsonsecurity.com/feed/)
• NCSC UK (https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml)
• CERT-EU (https://cert.europa.eu/publications/security-advisories-rss)

AI-assisted, published automatically, not human-reviewed; verify with vendors before acting.