Patch Tuesday used to be routine. This one is not. On Tuesday, November 10, CISA added six flaws to its Known Exploited Vulnerabilities catalog — bugs it has evidence are being used in real attacks. Two hit software most people use every day, Microsoft Outlook and Google Chrome. Two hit Barracuda email gateways with a three-day federal deadline. And one, in Cisco BroadWorks, was used in a campaign where the attacker reportedly let an AI agent do the intruding.
What happened
The Outlook flaw is the one I want most people to hear about, because its score undersells it. CVE-2026-124194 is rated moderate, CVSS 6.5. Microsoft says it has been actively exploited. An attacker sends a specially crafted message file and persuades you to open it in Outlook. Outlook then connects to a location the attacker controls without showing the usual external-content warning, and in doing so can disclose your NTLMv2 hash — authentication material an attacker can use to impersonate you. Microsoft notes the Preview Pane is not an attack vector; you have to open the file. The affected products are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024. The fix arrived in Microsoft’s November updates, in a release The Hacker News counts at 1,259 vulnerabilities — the second straight month over 1,000. CISA gave federal agencies until November 24 to apply this one.
The Chrome flaw on the list, CVE-2026-125350 at CVSS 8.8, is the use-after-free bug in Chrome’s XML component I wrote about yesterday. Google already fixed it in Chrome 157.0.8103.50. What changed yesterday is the status: CISA has now formally listed it as known exploited, which removes any remaining argument for waiting on that restart.
The Barracuda pair also changed status. CVE-2026-116606, CVSS 9.3, lets an unauthenticated attacker restore a crafted backup on the Email Security Gateway, fixed in 9.4.0.030. Chained with CVE-2026-111560, CVSS 8.6, an operating system command injection in Barracuda appliances, it can lead to commands running as root. I covered that chain on November 9 when no exploitation had been reported. Now Barracuda has confirmed attacks against a small number of organizations, according to the reporting, and CISA set an unusually short deadline — November 13 — for both Barracuda flaws. Three days is CISA telling you how urgent it thinks this is.
Then there is Cisco. CVE-2026-20320, CVSS 7.5, is an XML external entity flaw in the Open Client Interface parser of Cisco BroadWorks. An unauthenticated remote attacker can use it to read sensitive configuration information. Cisco fixed it in August 2026, in release RI.2026.07. According to Malbear Labs, reported by The Hacker News, a Chinese-speaking threat actor used it against a European telecommunications provider in a campaign dubbed Operation Snowball, using an autonomous framework built with a jailbroken DeepSeek Flash model. The reporting says the agent enumerated hundreds of assets, extracted dozens of credential sets, and exfiltrated thousands of rows of subscriber billing and device records over two weeks, largely without the operator present. The sixth flaw, CVE-2026-111793 at CVSS 4.3 in Openwave Webtop Media Transcoder, lets an authenticated user process unintended document types; it was fixed in October, in version 1.1.22.0.
How bad is it, honestly?
A KEV listing is not hype. It means CISA has evidence of exploitation, not just a proof of concept. Be precise about who is exposed, though. You are probably not running BroadWorks, a Barracuda gateway, or Openwave at home. Those are enterprise and telecom problems, and the teams running them should treat November 13 and November 24 as real deadlines. The Outlook and Chrome flaws reach ordinary desktops, and both already have fixes.
Do not let the Outlook score fool you. A 6.5 that leaks credentials attackers can reuse to impersonate you, and that Microsoft confirms is being exploited, outranks plenty of higher-scored bugs nobody is using yet. Patch order should follow exploitation first, score second. The AI angle on the Cisco case matters for a different reason: if an agent can run reconnaissance, pick an exploit path, and adapt when blocked, then leaving an August patch unapplied for months is no longer a slow human race. The window between a fix shipping and an attack arriving keeps shrinking.
What to actually do
First, run Microsoft’s November updates, and make sure Office updates too — the Outlook fix comes through the Office channel, not just the Windows cumulative update. Verify Outlook is updated, not just that Windows Update ran once.
Second, if you did not already take yesterday’s advice, update Chrome to 157.0.8103.50 or later and relaunch it. Confirm the version on the About page after the restart.
Third, if you run Barracuda ESG or the other affected Barracuda appliances, patch before November 13, restrict the admin interface so it does not answer from the internet, and check for a configuration restore or admin activity you cannot explain. A patch does not prove nobody got in first.
Fourth, if you run Cisco BroadWorks, confirm you are on the fixed RI.2026.07 release or later, and review for credential exposure — the reported campaign was after credentials and configuration, not just a foothold.
My bottom line: six flaws, all confirmed exploited, all already patched by their vendors. There is no research project here and no waiting for more information. Update Outlook and Chrome today, and if you operate any of the enterprise gear on this list, treat CISA’s deadlines as your deadlines.
Sources: The Hacker News, “Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes” (November 11, 2026) — thehackernews.com; The Hacker News, “Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches” (November 11, 2026) — thehackernews.com; SecurityOnline, “CISA Adds Six Exploited Flaws in Outlook, Chrome, Barracuda, Cisco and Openwave to KEV Catalog” (November 11, 2026) — securityonline.info, summarizing CISA’s November 10, 2026 KEV additions.