Date range covered: CISA alerts published November 6 to November 12, 2026. In that window the US Cybersecurity and Infrastructure Security Agency (CISA) added 11 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which means it has evidence each one is being used in real attacks. We found alerts for November 6, 9 and 10 and none for November 7, 11 or 12. Anything CISA adds after that falls outside this roundup. Severity scores below come from the aggregator Senserva; the CVE lists and vulnerability types come from CISA’s own alerts, and the deadlines and advisory links from the KEV catalog itself (version 2026.11.10, still the latest when we checked on November 13).
November 6: one addition
- CVE-2026-19868, SonicWall SonicOS SSLVPN: use of single-factor authentication. Senserva scores it 7.5 (High). CISA’s alert gives no patch version or mitigation.
November 9: four additions
From CISA’s November 9 alert:
- CVE-2026-102895, GPUStack: improper authentication. Senserva: 9.8 (Critical).
- CVE-2026-116779, SignalWire FreeSwitch: code injection. Senserva: 9.8 (Critical).
- CVE-2026-123158, OpenBSD OpenSSH: unexpected status code or return value. Senserva: 8.1 (High), and describes an issue in sshd before version 10.6p2 on Linux when built with musl libc and without PAM. The description on that page is cut off, so confirm the affected versions in the OpenSSH advisory.
- CVE-2026-123218, IBM Aspera Faspex: incorrect authorization. Senserva: 9.8 (Critical).
November 10: six additions
From CISA’s November 10 alert, the same day as Microsoft’s Patch Tuesday:
- CVE-2026-20320, Cisco BroadWorks: XML external entity reference. Senserva: 7.5 (High).
- CVE-2026-111560, Barracuda Networks products: OS command injection.
- CVE-2026-116606, Barracuda Email Security Gateway: authentication bypass using an alternate path or channel.
- CVE-2026-111793, Openwave Messaging Webtop Media Transcoder: incorrect resource transfer between spheres.
- CVE-2026-124194, Microsoft Outlook: missing user interaction for a potentially unsafe action, the Patch Tuesday zero-day. Senserva: 6.5 (Medium). Our Patch Tuesday guide covers the fix.
- CVE-2026-125350, Google Chromium: use-after-free. Senserva: 8.8 (High). Update Chrome, Edge and other Chromium browsers.
What to do
- Check what you run. Look for SonicWall SSLVPN, Barracuda email gateways, Cisco BroadWorks, IBM Aspera Faspex, FreeSwitch, GPUStack and OpenSSH on Linux with musl.
- Start with internet-facing systems. CISA’s binding directive for federal agencies, BOD 26-04, prioritises KEV flaws on publicly exposed assets that could give an attacker total control. CISA encourages all organisations to follow the same approach.
- Patch, then look back. The directive also expects teams to check whether an attacker got in before the patch. Review logs and accounts on any exposed device that was unpatched.
- Update browsers and Office for the Chromium and Outlook entries.
Federal deadlines
The KEV catalog sets a date by which US federal civilian agencies must fix each entry. The dates bind only those agencies.
- November 12 (already passed): GPUStack, FreeSwitch, OpenSSH and IBM Aspera Faspex, the four November 9 entries.
- November 13: both Barracuda flaws.
- November 20: SonicWall SonicOS SSLVPN.
- November 24: Cisco BroadWorks, Openwave Webtop Media Transcoder, Microsoft Outlook and Google Chromium.
Vendor advisories
These are the advisories CISA links from each catalog entry. Check them for fixed versions.
- SonicWall (CVE-2026-19868): SNWLID-2026-0014
- GPUStack (CVE-2026-102895): GitHub advisory
- FreeSwitch (CVE-2026-116779): GitHub advisory
- OpenSSH (CVE-2026-123158): OpenSSH release notes and Alpine Linux notice
- IBM Aspera Faspex (CVE-2026-123218): IBM security bulletin
- Cisco BroadWorks (CVE-2026-20320): Cisco advisory
- Barracuda (CVE-2026-111560 and CVE-2026-116606): Barracuda advisory
- Openwave (CVE-2026-111793): Openwave advisory
- Microsoft Outlook (CVE-2026-124194): Microsoft Security Response Center
- Google Chromium (CVE-2026-125350): Chrome stable channel update
CISA does not say who is exploiting these flaws. Its catalog lists known ransomware use as “Unknown” for all 11.
Sources
- CISA: Adds One Known Exploited Vulnerability to Catalog (November 6, 2026)
- CISA: Adds Four Known Exploited Vulnerabilities to Catalog (November 9, 2026)
- CISA: Adds Six Known Exploited Vulnerabilities to Catalog (November 10, 2026)
- CISA: Known Exploited Vulnerabilities Catalog (version 2026.11.10)
- Senserva: CISA KEV additions this week
Image: padlock over a circuit board pattern, by jaydeep_, CC0, via Wikimedia Commons.
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
