Skip to content
Tuesday, November 10, 2026Nov 10, 2026
Previous issue

Vol. 1, No. 53Composed Nov 11 · 00:53 UTC

SitRep

Cybersecurity, in perspective.

2 elevated3 stories on the wire

Scale amplifies error; attention controls risk.
— Marcus Andreelius
ⓘMarcus Andreelius is a fictional AI editorial voice. This reflection is original editorial prose, not a quotation.

You are reading a previous issue. Go to the latest edition →

The situation

CISA Adds Barracuda Flaw to Exploited Catalog

CISA listed Barracuda and Chromium flaws as exploited in the wild; Cisco reported Node.js and Brotli fixes.

2 sources

CISA KEV catalogue, Cisco PSIRT Security Advisories

CISA added CVE-2026-111560, an OS command injection vulnerability in Barracuda Networks multiple products, to its catalogue of vulnerabilities exploited in the wild on 2026-11-10. CISA also added CVE-2026-125350, a Google Chromium use-after-free, to the catalogue that day.

Context

The CISA entries identify the Barracuda vulnerability as an OS command injection and the Chromium vulnerability as a use-after-free in its XML component. CISA's Chromium entry says the flaw could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage.

On the wire

  • 0critical
  • 2elevated
  • 1moderate
  • 0low
P1Exploit

CISA Adds Barracuda Flaw to Exploited Catalog

CVE-2026-111560 · Barracuda Networks multiple products

CISA added CVE-2026-111560 in Barracuda Networks multiple products to its catalogue of vulnerabilities exploited in the wild on 2026-11-10.1 The catalogue entry identifies an OS command injection vulnerability in Barracuda Networks Email Security Gateway, Load Balancer, Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway.1

Updated Since Nov 3: Attacker Hijacks cPGuard Update Channel · New: cisa.gov

Added to CISA KEV on 10 Nov 2026 (CVE-2026-111560) · CVE-2026-111560: CVSS 8.6, EPSS 0.01 (FIRST)

  1. 1CISA KEV CATALOGUE · CISA adds CVE-2026-111560 (Barracuda Networks Multiple Products) to its known exploited vulnerabilities catalogue

Copy link to “CISA Adds Barracuda Flaw to Exploited Catalog”

P1Exploit

CISA Adds Chromium Flaw to Exploited Catalog

CVE-2026-125350 · Chromium XML component · potential remote code execution inside the sandbox

CISA added CVE-2026-125350 in Google Chromium to its catalogue of vulnerabilities exploited in the wild on 2026-11-10.1 The entry describes a use-after-free in Chromium's XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage.1

Added to CISA KEV on 10 Nov 2026 (CVE-2026-125350) · CVE-2026-125350: CVSS 8.8

  1. 1CISA KEV CATALOGUE · CISA adds CVE-2026-125350 (Google Chromium) to its known exploited vulnerabilities catalogue

Copy link to “CISA Adds Chromium Flaw to Exploited Catalog”

P2Exploit

Cisco Details Node.js and Brotli Vulnerabilities

CVE-2026-111497 · CVE-2026-105482 · CVE-2026-105483 · CVE-2026-106069 · fixes released October 21, 2026

Cisco warned of CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069 across Node.js 22.x, 24.x, and 26.x.1 Cisco says the issues include Brotli decoder remote code execution risk, DNS resolution truncation, and TLS hostname validation bypass, and that fixes were released October 21, 2026.1 Cisco listed priority products under investigation and noted that some products are not vulnerable.1

Updated Since Nov 9: CVE Program Records Brotli Decoder Flaw · CVE-2026-111497 · New: github.com

Timeline

  1. 2 earlier appearances
  2. Oct 31Brotli Decoder Overflow Affects Palo Alto PAN-OS
  3. Weekend, Oct 31Microsoft Details Brotli Decoder Buffer Overflow
  4. Nov 5Cisco Advises on Node.js and Brotli Flaws
  5. Nov 6Cisco Warns of Node.js and Brotli Flaws
  6. Nov 9CVE Program Records Brotli Decoder Flaw
  7. This edition

Added to CISA KEV on 27 Oct 2026 (CVE-2026-111497) · CVE-2026-111497: CVSS 9.2, EPSS 0.83 (FIRST), patch listed (GitHub); CVE-2026-105482: CVSS 7.4, EPSS <0.01 (FIRST) and 2 more

  1. 1CISCO PSIRT SECURITY ADVISORIES · Cisco Advises on Node.js and Brotli Vulnerabilities Impacting Products

Copy link to “Cisco Details Node.js and Brotli Vulnerabilities”

Known exploited

Added 10 NovAt least 6 vulnerabilities added to CISA’s catalogue of flaws exploited in the wild

CVEVendor and productAddedDue
CVE-2026-111560Barracuda Networks Multiple Products10 Nov13 Nov
CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder10 Nov24 Nov
CVE-2026-116606Barracuda Networks Barracuda Email Security Gateway (ESG)10 Nov13 Nov
CVE-2026-124194Microsoft Office10 Nov24 Nov
CVE-2026-125350Google Chromium10 Nov24 Nov
CVE-2026-20320Cisco BroadWorks10 Nov24 Nov

Source: CISA KEV catalogue, version 2026.11.10 (released 10 Nov 2026; read by SitRep 10 Nov 2026).

Due dates are CISA’s deadlines for US federal civilian agencies (BOD 22-01).

SitRep last read the catalogue on 10 Nov 2026, before this window was complete; additions may be missing.

The full catalogue at cisa.gov

The wire, last 30 days

This edition has 2 stories rated critical or elevated (P0 or P1); the 25 daily editions from 12 Oct to 9 Nov averaged 3.4. 4 of the 29 earlier days have no bar: no daily edition with rated stories.

The figures as a table
EditionP0P1P2P3
10 Nov (this edition)0210
9 Nov1110
8 Nov0310
7 Nov0300
6 Nov1310
5 Nov0320
4 Nov2200
3 Nov0310
2 Nov0211
1 Nov0300
31 Oct1210
30 Oct1400
29 Oct1110
28 Oct1211
27 Oct1310
26 Oct1111
23 Oct0320
22 Oct1400
21 Oct2200
20 Oct2210
19 Oct2300
16 Oct1210
15 Oct1310
14 Oct2111
13 Oct1300
12 Oct2200

Source: SitRep’s daily editions; stories without a severity are not counted.

Elsewhere in the edition

Windows Remote Desktop Client Information Disclosure Vulnerability CVE-2026-108419

Microsoft Security Response Center notes a Windows Remote Desktop Client information disclosure vulnerability,, with a Security Update Guide page. The article links to the Microsoft update guide.

5 reports

Outlook Zero-Day Among 1,094 Microsoft Patch Tuesday Fixes

Microsoft patched 1,094 vulnerabilities in November 2026 Patch Tuesday, including an exploited Outlook zero-day (CVE-2026-124194). The flaw is a spoofing vulnerability where an unauthenticated user can persuade a target to open a malicious file, potentially exposing NTLMv2 hashes. Affected products include Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024.

5 reports

Hackers Exploit Critical Xen Orchestra Auth Bypass for Admin Access

French vendor Vates VMS warns of a critical Xen Orchestra authentication bypass (VSA-2026-062) being actively exploited, enabling admin access and potential arbitrary code execution on managed pools and XCP-ng, with indicators including crafted cookies and compromised hosts.

2 reports

Three China-Nexus Espionage Campaigns Linked via Sparrow Malware

Check Point Research ties three China-nexus espionage clusters—SilentDelivery, OceanGate, and DarkWire—through Sparrow malware ecosystem. CopperDragon allegedly powers tools for campaigns targeting telecoms, government, and research sectors across Latin America, Asia, and Europe, with backdoors like SparrowDoor, CopperDoor, and SparrowShell observed.

2 reports

Also reported

End of the Tuesday, November 10, 2026 edition.

Colophon

SitRep · Vol. 1, No. 53

Publisher
Published and funded by its independent maintainer. No advertising or sponsors.
AI disclosure
SitRep uses AI to prepare its editions from cited reporting; editions are not reviewed by a person before they are published.
Editorial standards
Read our editorial standards.
Corrections
brief@sitrepit.com or the contact page.