CISA Adds Six Exploited Flaws Including Cisco BroadWorks, Barracuda and Outlook: What IT Teams Should Patch

CISA's Known Exploited Vulnerabilities catalog lists flaws with confirmed real-world exploitation. The November 10 update spans email security, telephony, browsers and mail clients, which makes it relevant to nearly every B2B software stack.

Below is what CISA and press reports say happened, why it matters, and a checklist for IT and security teams.

What Happened: Six New Entries in CISA's KEV Catalog

On November 10, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The entries cover Cisco BroadWorks, Barracuda products, Openwave Webtop Media Transcoder, Microsoft Outlook and Google Chromium.

The details come from CISA's official alert. CISA's alert did not list a remediation deadline for these entries, though it points federal civilian agencies to its binding directive on prioritizing KEV fixes.

The Cisco BroadWorks and Openwave Exploitation Details

SecurityWeek reported on November 11 that attackers are exploiting the Cisco BroadWorks and Openwave flaws. Cisco's flaw is an unauthenticated, remotely reachable XML external entity issue in the OCI-P service, disclosed on August 19, 2026, with fixes in release RI.2026.07.

SecurityWeek, citing a Malbear Labs report from November 8, said a Chinese-speaking threat actor used the Cisco flaw against a European telecommunications provider and its customers, using an autonomous AI intrusion harness, and that at least 13 organizations may have been targeted. These attribution details come from the vendor research as reported and have not been confirmed by CISA.

For Openwave, SecurityWeek says the flaw let unintended file types be processed. It was disclosed on October 7, with patches in version 1.1.22.0, and Japan's JVN flagged exploitation on November 9. SecurityWeek reports that federal agencies were urged to patch both flaws by November 24, a date that does not appear in the CISA alert itself, so confirm the deadline against your own advisories.

Why It Matters: Email, Browser and Telecom Systems Are Attack Paths

These entries hit systems almost every company relies on: email gateways, mail clients, browsers and voice-provisioning platforms. A KEV listing means exploitation is already happening, so the usual wait-and-test patch cycle carries real risk.

The Outlook and Barracuda entries follow a heavy week for email security. Our earlier coverage of the November 2026 Patch Tuesday Outlook zero-day shows the same product family under pressure. Treat these as related risks in one mail-flow pipeline rather than isolated bulletins.

The Chromium flaw matters beyond Chrome, because Microsoft Edge and many embedded browsers share the engine. Confirm that each Chromium-based browser in your fleet has received the vendor's update.

What This Means for B2B SaaS Buyers and IT Teams

Buyers should ask vendors about patch speed for internet-facing components and verify that exploited flaws are fixed in their hosted services. If you run these products on premises, you own the patching; if they run in a vendor's cloud, you own the questions.

• Self-hosted Cisco, Barracuda or Openwave users: inventory versions today and compare them with vendor fix releases.
• Microsoft 365 and Outlook users: confirm the latest updates are deployed and review NTLM exposure controls.
• Managed service providers: check client environments for the same products.
• SaaS buyers: request written patch timelines in security questionnaires.

CISA encourages all organizations, not only federal agencies, to use the KEV catalog to prioritize remediation, and NIST's SP 800-40 Rev. 4 gives guidance on enterprise patch management planning.

What to Do Now: A Patching Checklist

Prioritize by exposure: internet-facing email gateways and telephony platforms first, then desktop software. Work through the checklist below today and record the result for each system, so audits and insurers can see the timeline.

• Search asset inventories for Cisco BroadWorks, Barracuda email and security products, Openwave Webtop Media Transcoder, Outlook and Chromium-based browsers.
• Apply vendor fixes or workarounds; for BroadWorks, SecurityWeek lists RI.2026.07, and for Openwave version 1.1.22.0.
• Hunt in logs for unusual OCI-P requests, unexpected file conversions and suspicious mail-gateway logins.
• Rotate credentials stored on or reachable from affected systems if compromise is suspected.
• Add KEV feed alerts to your vulnerability management workflow.

Teams that lack tooling for this should evaluate vulnerability and patch management products. Browse our Cybersecurity Software and SIEM Software categories, and see the vendor's own notices for Barracuda products. Further reading from the same sources: SecurityWeek and The Hacker News on the November 9 batch.

Frequently Asked Questions

Does a KEV listing mean my company must patch?
Federal agencies are bound by CISA directives, but any organization benefits from treating KEV entries as top priority because exploitation is confirmed. Patch internet-facing systems first and record each action.

How do I know if I was affected by the Cisco BroadWorks flaw?
Check whether you run an affected BroadWorks version, then review OCI-P service logs for unusual XML requests. If you cannot confirm, treat it as exposed, patch and rotate credentials.

Which security tools help track exploited vulnerabilities?
Vulnerability management, asset inventory and SIEM platforms can ingest the KEV feed and match it to your assets. Compare options in SaaSPodium's cybersecurity and SIEM categories and request a pilot against your environment.