cyber.hendryadrian.com
Vulnerability & Exploit · cisa.gov

CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog

· Original article ↗

Summary

CISA added six CVEs to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. It urges organizations to prioritize remediation and describes updated risk-based requirements for federal agencies.

Key points

  • The six additions affect Cisco BroadWorks, Barracuda products, Openwave Messaging Webtop, Microsoft Outlook, and Google Chromium.
  • The listed vulnerabilities include XML external entity handling, OS command injection, authentication bypass, and use-after-free flaws.
  • BOD 26-04 requires FCEB agencies to prioritize certain KEV-listed vulnerabilities on publicly exposed assets and check for possible compromise before patching.
  • CISA encourages all organizations to use risk-based vulnerability management and prioritize KEV vulnerabilities.

Article Details

Vulnerability Types
  • Improper restriction of XML external entity references
  • OS command injection
  • Incorrect resource transfer between spheres
  • Authentication bypass using an alternate path or channel
  • Missing user interaction for a potentially unsafe action
  • Use-after-free
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unknown

CVE

CVE-2026-111560Barracuda Networks · Barracuda Email Security Gateway (ESG); Barracuda Networks · Barracuda Load Balancer Application Delivery Controller (ADC); +4 moreCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability CVE-2026-111793Openwave Messaging (Ireland) Limited · Webtop Media TranscoderCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability CVE-2026-116606Barracuda Networks · Barracuda Email Security Gateway (ESG)CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability CVE-2026-124194Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office LTSC 2021; +1 moreCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability CVE-2026-125350Vendor / Product unavailableCVE-2026-125350 Google Chromium Use-After-Free Vulnerability CVE-2026-20320Cisco · Cisco BroadWorksCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability 

Vendors

BarracudaCVE-2026-111560 Barracuda Networks Multiple Products OS Command Injection Vulnerability CiscoCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability GoogleCVE-2026-125350 Google Chromium Use-After-Free Vulnerability MicrosoftCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability Openwave Messaging LimitedCVE-2026-111793 Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability 

Products

BroadWorksCVE-2026-20320 Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability Email Security Gateway (ESG)CVE-2026-116606 Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability Google ChromiumCVE-2026-125350 Google Chromium Use-After-Free Vulnerability Microsoft OutlookCVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability 

Related Articles