CISA adds six exploited vulnerabilities to its KEV catalog
Original title: CISA Adds Six Known Exploited Vulnerabilities to Catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
CISA added six vulnerabilities to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The entries affect Cisco BroadWorks, Barracuda products including Email Security Gateway, Openwave Webtop Media Transcoder, Microsoft Office Outlook, and Google Chromium. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of high-risk KEV entries on publicly exposed assets. CISA urges other organizations to do the same.
Unconfirmed: CISA does not name attackers, exploitation dates, or remediation deadlines in this alert.
- CVE-2026-20320 is a Cisco BroadWorks XML external entity flaw.
- CVE-2026-111560 and CVE-2026-116606 affect Barracuda products.
- CVE-2026-124194 affects Microsoft Office Outlook.
- CVE-2026-125350 is a Google Chromium use-after-free flaw.
- CVE-2026-111793 affects Openwave Webtop Media Transcoder.
Impact: active exploitation of flaws that can give control of exposed assets
| Product | Affected |
|---|---|
| Cisco BroadWorks | — |
| Barracuda Networks | — |
| Barracuda Networks Email Security Gateway | — |
| Openwave Messaging Limited Webtop Media Transcoder | — |
| Microsoft Office Outlook | — |
| Google Chromium | — |
- 1.Prioritize remediation of the six KEV entries on publicly exposed assets.
- 2.FCEB agencies should follow BOD 26-04, including pre-patch compromise checks.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111560 | Command Injection in Barracuda Appliance Timezone Field | 8.6 | 1% | KEV | KEV |
| CVE-2026-111793 | File-type restriction bypass in Openwave Webtop Media Transcoder | 4.3 | <1% | KEV | KEV |
| CVE-2026-116606 | Auth bypass in Barracuda Email Security Gateway before 9.4.0.030 | 9.3 | 2% | KEV | KEV |
| CVE-2026-124194 | Missing unsafe-action warning in Microsoft Office Outlook | 6.5 | — | KEVPoC | KEV |
| CVE-2026-125350 | Use-after-free in Chrome XML before 157.0.8103.50 | 8.8 | — | KEVPoC | KEV |
| CVE-2026-20320 | Unauthenticated XXE File Read in Cisco BroadWorks OCI-P Service | 7.5 | <1% | KEVPoC | KEV |
From the original article
1 min read at cisa.govCISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.