CISA KEV Catalog Updated with Six Exploited Vulnerabilities
CISA Adds Six Actively Exploited Flaws to 'Must-Patch' KEV Catalog
Related Entities
Organizations
Products & Tech
CVE Identifiers
MITRE ATT&CK Techniques
Full Report
Executive Summary
On November 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) catalog by adding six new security flaws. The inclusion of these vulnerabilities in the KEV catalog signifies that there is reliable evidence of active exploitation in the wild. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are required to remediate these vulnerabilities by the specified due dates to protect federal networks. The update includes flaws in widely deployed products such as Microsoft Outlook, Cisco BroadWorks, and Barracuda Networks Email Security Gateway, making this a critical alert for public and private sector organizations alike.
Regulatory Details
The KEV catalog is a cornerstone of CISA's effort to drive prioritized vulnerability management across the federal government and the broader cybersecurity community. When a vulnerability is added, it comes with a specific remediation deadline.
- Directive: Binding Operational Directive (BOD) 22-01, "Reducing the Significant Risk of Known Exploited Vulnerabilities."
- Requirement: FCEB agencies must remediate all vulnerabilities in the KEV catalog by the assigned due date.
- Recommendation: CISA strongly urges all organizations to prioritize the remediation of KEV catalog vulnerabilities to reduce their likelihood of compromise by known threat vectors.
Vulnerabilities Added to KEV Catalog
The following six vulnerabilities were added on November 10, 2026:
Impact Assessment
The vulnerabilities added to the KEV list pose a direct and immediate threat to organizations. Active exploitation means that threat actors have developed working exploits and are actively using them in attacks. The flaws range from information disclosure and authentication bypass to command injection and arbitrary code execution.
- The Cisco BroadWorks flaw could allow an unauthenticated attacker to read sensitive files from affected systems.
- The Barracuda flaws can be chained, allowing an attacker to bypass authentication and execute arbitrary commands on the appliance, leading to a full compromise of the email security gateway.
- The Google Chromium flaw could lead to arbitrary code execution on a user's machine simply by visiting a malicious website.
Compliance Guidance
- Prioritize Patching: All organizations, not just federal agencies, should treat the KEV catalog as a prioritized patching list. The vulnerabilities on this list are not theoretical; they are being used in real-world attacks.
- Asset Inventory: Maintain a comprehensive and up-to-date inventory of all hardware and software assets to quickly identify if any of these vulnerable products are present in your environment.
- Vulnerability Scanning: Regularly scan your environment for the vulnerabilities listed in the KEV catalog. Use vulnerability management tools that ingest CISA's KEV feed to automate this process.
- Apply Updates: Follow vendor instructions to apply the necessary security updates or mitigations for all identified vulnerable assets before the CISA-mandated deadline.
- Compensating Controls: If a patch cannot be immediately applied, implement compensating controls such as restricting network access to the vulnerable device, increasing monitoring, or using a Web Application Firewall (WAF) to provide virtual patching.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation for all vulnerabilities in the KEV catalog is to apply the security updates provided by the respective vendors.
Vulnerability Scanning
Regularly scan the environment to identify instances of vulnerable software listed in the KEV catalog.
D3FEND Defensive Countermeasures
The CISA KEV catalog serves as a non-negotiable, priority-driven patching list. For each of the six added vulnerabilities, organizations must apply the vendor-supplied patches as the primary line of defense. This is not a routine patching cycle; it is an emergency response to active threats. For CVE-2026-20320 in Cisco BroadWorks and CVE-2026-124194 in Microsoft Outlook, the patches address the root cause of the flaws. For the Barracuda and Google flaws, the updates prevent attackers from gaining command injection or arbitrary code execution. A robust patch management program that can quickly test and deploy these out-of-band updates is essential. Use vulnerability scanning and asset inventory systems to confirm that all affected systems have been successfully remediated before the CISA deadlines.
Timeline of Events
CISA adds six new vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog.
Deadline for U.S. federal agencies to patch several of the newly added KEVs, including CVE-2026-124194 and CVE-2026-20320.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.