Barracuda ESG flaws actively exploited for root access

Attackers are exploiting two recently patched Barracuda Email Security Gateway vulnerabilities to run commands with root privileges. Apply vendor mitigations immediately and check for signs of compromise.

Google patches eighth actively exploited Chrome zero-day of 2026

Google fixed nine Chrome flaws, including V8 vulnerability CVE-2026-125350, which is being actively exploited in the wild. Update Chrome to the latest version as soon as possible.

CISA adds Cisco BroadWorks and Openwave flaws to KEV catalog

CISA confirmed active exploitation of flaws in Cisco BroadWorks and Openwave Webtop Media Transcoder despite available patches. Prioritize patching these internet-facing systems per BOD 26-04 guidance.

Critical Xen Orchestra auth bypass exploited to hijack VM servers

A critical authentication bypass in Xen Orchestra is being actively exploited to gain administrator privileges and take over XCP-ng virtualization hosts. Patch immediately and review access logs for suspicious activity.

Microsoft MSMQ RCE rated critical 9.8

CVE-2023-36910 is a critical remote code execution vulnerability in Microsoft Message Queuing affecting Windows 10, Windows 11, and Windows Server. Ensure affected systems are patched and MSMQ exposure is minimized.

In March 2023, data allegedly taken from xd0xa1xd0xb1xd0xb5xd1x80xd0xa1xd0xbfxd0xb0xd1x81xd0xb8xd0xb1xd0xbe (SberSpasibo), the loyalty program of Russian bank xd0xa1xd0xb1xd0xb5xd1x80xd0xb1xd0xb0xd0xbdxd0xba (Sberbank), was published online. The data contained records relating to 48M users, including 3.3M unique email addresses alongside phone numbers and dates of birth. Data also included bank card numbers stored as unsalted SHA-1 hashes, plus loyalty program details such as membership dates and the redemption of bonus points for partner offers.

In May 2013, the Russian-language hacking forum YouHack suffered a data breach that was later redistributed as part of a larger corpus of data. The breach exposed 107k forum members' email addresses, usernames, IP addresses and MD5 password hashes, most of which were unsalted. Forum posts also contained email address and password pairs belonging to other victims, bringing the total to 7.2M unique email addresses.

Chromium (Google)

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

Barracuda Email Security Gateway (ESG) (Barracuda Networks)

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

Multiple Products (Barracuda Networks)

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

BroadWorks (Cisco)

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

Webtop Media Transcoder (Openwave Messaging Limited)

Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

Office (Microsoft)

Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.(2026-11-10)

Microsoft Windows 10 | Critical 9.8 | CVE-2023-36910

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Microsoft Windows 11 | Critical 9.8 | CVE-2023-36910

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Microsoft Windows Server | Critical 9.8 | CVE-2023-36910

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Red Hat Enterprise Linux | Critical 9.8 | CVE-2026-53002

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in…

Microsoft Office | High 8.4 | CVE-2026-50301

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on [...] (The Hacker News)

Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT [...] (The Hacker News)

Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...] (BleepingComputer)

Hackers now exploit critical Barracuda ESG flaws to gain root access
Cybersecurity company Barracuda Networks warned that attackers have begun exploiting two recently patched Email Security Gateway (ESG) vulnerabilities that let them run commands with root privileges. [...] (BleepingComputer)

Japanese furniture giant Nitori says hackers stole 37.6M customer records
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...] (BleepingComputer)

Google fixes the eighth actively exploited Chrome zero-day of 2026
Google patched nine Chrome flaws, including a V8 vulnerability tracked as CVE-2026-125350, that attackers have been actively exploiting in the wild. Google has addressed multiple security vulnerabilities, one of which, tracked as CVE-2026-125350, [...] (Security Affairs)

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Tuesday added two security flaws impacting Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of [...] (The Hacker News)

Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...] (BleepingComputer)

Multiple Vulnerabilities in SAP Products Could Allow for Arbitrary Code Execution
Multiple vulnerabilities have been discovered in SAP Products, the most severe of which could allow for arbitrary code execution. SAP NetWeaver is SAP’s technology platform and application server stack (ABAP and Java) that underpins many SAP [...] (Cyber Security Advisories - MS-ISAC)

Multiple Vulnerabilities in SonicWall SonicOS Could Allow for Authentication Bypass
Multiple vulnerabilities have been discovered in SonicWall SonicOS, the most severe of which could allow for Authentication Bypass. SonicOS is the operating system that powers SonicWall firewalls and network security appliances. Successful [...] (Cyber Security Advisories - MS-ISAC)

🔓 Vortex

ALEXION  |  PYRAMID HEALTHCARE  |  CRESA  |  SAMTEC  |  BOZZUTO

🏹 SilentRansomGroup

A&O Shearman  |  1 unnamed victim (identity not disclosed)

💀 play

NY Snacks  |  Signworx  |  BROTHERS EXPRESS LLC

🦠 Orova

Herminio India Precision Technology

🛑 N0n

Landmark Group

👹 medusalocker

Capetown

🤖 krybit

Actualize Consulting

🐉 interlock

Elmcrest Children's Center, Inc  |  Meadows Valley School District  |  Madison Honda  |  Jerome School District  |  Indiana Area School District  |  Assiniboine Dental Group  |  Richmond Public Schools  |  Ridgway High School  |  Custom Floors Unlimited  |  Conecuh Sausage Company Inc  |  Southwest Orthopedic & Reconstructive Specialists

🐉 HYFLOCK

tcadarwin

🐛 Dark Project

MTM&O Gold Refinery DMCC  |  Bear Valley Community Hospital

🫥 Climax Inc

Frolina Home  |  Nepal Electricity Authority  |  Redacted Redacted

🎭 BYOD

Providence  |  Toyota

🪼 bravox

AWO Bundesverband

🔓 Booba Project

Georgetown Sleep Center  |  El Portal Imaging Center  |  Day One RI  |  COMPUTER TASK GROUP, Inc.  |  Collier Sports Medicine and Orthopedic Center  |  Acclaim Health

🎯 Black X

Forus Deporte y Ocio S.L  |  DomusVi  |  Court Square Group