Outlook NTLM-leak zero-day, Chrome XML use-after-free, and Barracuda ESG root chain all under active exploitation

Posted on by

This brief covers the trailing ~48 hours (November 9–11, 2026). Every item below was traced to its primary source — vendor advisory, CISA KEV entry, or the affected organization’s own statement — and confirmed to fall inside the window.

Microsoft Patch Tuesday fixes an exploited Outlook zero-day that leaks NTLMv2 hashes, plus 63 Critical bugs

Microsoft MSRC · November 10, 2026

Microsoft’s November release is another 1,000-plus-CVE Patch Tuesday: just under 1,100 new Microsoft CVEs (1,235 counting republished Edge and third-party entries), 63 of them rated Critical. The one confirmed zero-day is CVE-2026-124194, a Microsoft Outlook spoofing flaw (CVSS 6.5, CWE-356 “Missing User Interaction for Potentially Unsafe Action”) affecting Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024. A crafted message file causes Outlook to connect to an attacker-controlled network location without the usual external-content warning, exposing the user’s NetNTLMv2 hash. It is actively exploited, patched, and was added to CISA KEV on November 10 with a November 24 federal due date. Also worth prioritizing among the Criticals: unauthenticated RCEs in Windows LDAP (CVE-2026-119958), CredSSP (CVE-2026-119962), and IIS (CVE-2026-119961). Adobe shipped nine advisories covering 63 vulnerabilities the same day.

“Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.” — Microsoft, CVE-2026-124194 record

Source: Microsoft Security Update Guide — CVE-2026-124194 · Qualys review · BleepingComputer

Google patches the eighth exploited Chrome zero-day of 2026: a use-after-free in the XML component

Google Chrome Releases · November 9, 2026

Chrome 157.0.8103.50/.51 (Windows, macOS) and 157.0.8103.50 (Linux) fixes nine security bugs, including CVE-2026-125350, a High-severity use-after-free in XML handling reported by an anonymous researcher on November 6. CISA’s ADP scored it CVSS 8.8 (AV:N/AC:L/PR:N/UI:R) and added it to KEV on November 10 (due November 24). Exploitation is confirmed in the wild; Google has not released technical details. A second XML use-after-free, CVE-2026-125346, was fixed in the same build along with a V8 type confusion (CVE-2026-125344) and an out-of-bounds write in GPU (CVE-2026-125348).

“Google is aware that an exploit for CVE-2026-125350 exists in the wild.” — Google Chrome Releases

Source: Chrome Stable Channel Update · The Hacker News

Barracuda confirms exploitation of ESG pre-auth bypass and command-injection chain that yields root; CISA sets a 72-hour deadline

Barracuda Networks · November 9, 2026 (advisory update)

Barracuda updated its November 2 advisory late on November 9 to add in-the-wild exploitation of two chained bugs. CVE-2026-116606 (CVSS 9.3) is a pre-authentication authorization bypass in the Email Security Gateway admin interface that lets an unauthenticated attacker restore a crafted configuration backup; CVE-2026-111560 (CVSS 8.6) is an OS command injection via the timezone field in shared appliance code and also affects Load Balancer ADC, Message Archiver, WAF, WAF Control Center and Web Security Gateway. Together they give root on ESG. Patches are available for all products (ESG 9.4.0.030 or later closes both). CISA added both CVEs to KEV on November 10 with an unusually short November 13 federal due date.

“We have identified exploitation activity affecting a small number of organizations.” — Barracuda Networks Trust Center

Source: Barracuda advisory · Beazley Security analysis

Cisco BroadWorks XXE lands in KEV after “Operation Snowball,” an AI-driven intrusion at a European telecom

CISA / Cisco PSIRT · November 10, 2026

CISA added CVE-2026-20320 (CVSS 7.5, CWE-611) to KEV on November 10, three months after Cisco patched it in BroadWorks release RI.2026.07. The bug is an unauthenticated, out-of-band blind XML external entity injection in the OCI-P XML parser of BroadWorks Application Server, Profile Server, Xtended Services Platform and Application Delivery Platform, allowing an attacker to read sensitive configuration data. Malbear Labs’ November 8 report ties it to a Chinese-speaking actor who used an autonomous agent built on a jailbroken DeepSeek model to compromise a telecom’s BroadWorks XSP, steal system-identity keys and SSL credentials, and move into 13 hosted customers using Sliver, Chisel and Behinder. Cisco’s advisory (v1.0, August 19) still states PSIRT was not aware of malicious use at publication. The same KEV batch added Openwave Webtop Media Transcoder CVE-2026-111793 (CVSS 4.3), which JVN reports is being exploited. Federal due date for both: November 24.

“This is a threat actor who delegated the intrusion to an AI and checked in asynchronously to review progress.” — Malbear Labs

Source: Cisco advisory cisco-sa-bworks-xxe-uwUd7CEt · CISA KEV alert · Malbear Labs · The Hacker News

Vates: critical Xen Orchestra authentication bypass actively exploited, gives admin and root on XCP-ng hosts

Vates · November 10, 2026

Vates published advisory VSA-2026-062 (“Empty-object login token”) for Xen Orchestra and the Xen Orchestra Appliance. The REST cookie parser turns authenticationToken=j:%7B%7D into an empty object, which the token provider accepts as an unfiltered lookup and authenticates the caller as the owner of the first unexpired token — yielding Admin, code execution on managed pools and root on XCP-ng nodes. No CVE has been assigned yet and no CVSS is available; Vates rates it Critical. Fixed in Xen Orchestra 6.10.1 (latest) and 6.9.2 (stable), xo-server 5.213.1 / 5.211.2. The advisory lists attacker infrastructure (91.211.251[.]112:8001, a Tor address on port 3333), a VM named “pivot2,” and persistence files under /etc/cron.d/zz-ustar*. Reported by Filip Magic and Christoffer Olsen of TDC NET Security. Not yet in KEV.

“This vulnerability is actively exploited by a threat actor” — Vates Security Advisory VSA-2026-062

Source: Vates VSA-2026-062 · The Hacker News

N-able ships N-central 2026.4 HF2 for seven publicly dropped zero-days as scanners probe exposed RMM servers

N-able · November 10, 2026

N-able released N-central 2026.4 Hotfix 2 (build 2026.4.1.26) covering seven CVEs that were disclosed publicly before patches existed: CVE-2026-125883 (XXE), CVE-2026-125878 (OGNL injection), CVE-2026-125882 (RCE via path traversal in file-repository upload, credited to Nate Fair of Sprocket Security), CVE-2026-125881 (SSRF), CVE-2026-125880 (stored XSS in admin context), CVE-2026-125879 (local root via writable syslog-ng config) and CVE-2026-91000 (insecure IPC privilege escalation). N-able has not published CVSS scores and has not flagged in-the-wild exploitation, but Defused reported probing of N-central for the leaked bugs on November 10, and Shadowserver’s count of exposed servers fell from 1,338 to about 148 in a day as operators pulled them offline. Both hosted and on-premises customers must also update Agents and Probes. Not in KEV.

“Customers should follow the published upgrade guidance carefully before restoring normal access to their N-central environment.” — N-able

Source: N-central 2026.4 HF2 release notes · BleepingComputer

Maersk confirms data theft from an acquired legacy system as WhiteArmor demands $5 million

A.P. Moller–Maersk · November 11, 2026

Maersk confirmed unauthorized access to and data extraction from a local legacy system inherited through a previous acquisition. The company says the system has been secured, other Maersk systems and customer/partner integrations were not affected, and it does not expect operational disruption. The WhiteArmor ransomware group listed Maersk on its leak site, claiming roughly 100 GB from the OCF/LF Logistics platform — driver records, plaintext passwords, 33 super-admin accounts, signed delivery receipts and device logs — and demanding USD 5 million in bitcoin within 30 days. Those claims are unverified; Maersk has not detailed the data types involved and warns customers to verify any unexpected communications about the incident through their usual Maersk contact.

“Our findings so far strongly suggest no sensitive data has been disclosed.” — A.P. Moller–Maersk

Source: Maersk statement · BleepingComputer

CISA adds OpenSSH “SSHole,” IBM Aspera Faspex, FreeSWITCH and GPUStack to KEV with a three-day deadline

CISA · November 9, 2026

Monday’s KEV batch added four flaws, all with a November 12 federal due date. CVE-2026-123158 “SSHole” (CVSS 8.1) is a password-authentication bypass in sshd on Linux systems built with musl libc and PAM disabled (Alpine’s default), triggered by a 257–1,024-byte password against an account whose hash is “*”; it is fixed in OpenSSH 10.6p2 (released November 5) and honeypot operators Previdian and GreyNoise have recorded post-exploitation activity including root-key theft and authorized_keys persistence. CVE-2026-123218 IBM Aspera Faspex (CVSS 9.8, incorrect authorization, patched November 2026), CVE-2026-116779 SignalWire FreeSWITCH (CVSS 9.8, code injection, patched October 2026) and CVE-2026-102895 GPUStack (CVSS 9.8, improper authentication allowing unauthenticated admin access, patched July 2026) round out the list; the GPUStack maintainers’ advisory credits Ulex Innovative Systems with reporting in-the-wild exploitation.

“avoid password authentication bypass that is exploitable through sshd(8)” — OpenSSH 10.6p2 release notes

Source: CISA KEV alert · OpenSSH release notes · GPUStack advisory · The Hacker News

This brief covers the trailing ~48 hours (November 9–11, 2026).

Primary sources:

Leave a Reply