Security Advisory

Exploited Flaws in Outlook, Chrome, and Barracuda Email Gateways: What to Update This Week

November 11, 2026 · Cyber One Solutions Security Team

On November 10, 2026, CISA added an Outlook flaw, a Chrome flaw, and two Barracuda appliance flaws to its Known Exploited Vulnerabilities catalog. Microsoft, Google, and Barracuda each confirm exploitation and each have fixes available. Here is what each one does, who it affects, and the short list of checks to run this week.

On November 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added several entries to its Known Exploited Vulnerabilities catalog, the list of flaws CISA has evidence attackers are already using. Three of them touch software that many small and mid-size businesses run every day: Microsoft Outlook, the Google Chrome browser, and Barracuda email and web security appliances. All three vendors have published fixes. None of this means your business has been attacked. It means these updates should not wait for the next routine maintenance cycle.

Outlook: A File That Skips the Usual Warning

Microsoft published CVE-2026-124194, titled "Microsoft Outlook Spoofing Vulnerability," on November 10, 2026, and marks it "Exploitation Detected." Microsoft rates it Moderate, with a CVSS score of 6.5. The moderate rating reflects that an attacker needs a person to act, not that the flaw is harmless.

Microsoft's advisory explains how it works: "An unauthenticated attacker could send a specially crafted message file and convince a user to open it in an affected version of Microsoft Outlook. Opening the file could cause Outlook to connect to an attacker-controlled network location without displaying the usual external-content warning, potentially disclosing authentication information that could be used to impersonate the user." Microsoft adds that the flaw "discloses a user's NTLMv2 hash to the attacker who could use this to authenticate as the user." An NTLMv2 hash is a scrambled form of a Windows sign-in credential. It is not the password itself, but Microsoft's point is that an attacker who captures it may be able to sign in as that person.

Two details from the advisory matter for planning. First, Microsoft states that "the Preview Pane is not an attack vector," so reading a message in the reading pane is not enough; someone has to open the attached file. Second, the affected products Microsoft lists are Microsoft 365 Apps for Enterprise, Office LTSC 2021, and Office LTSC 2024, in both 32-bit and 64-bit editions. Microsoft gives the fixed builds for the LTSC editions as 16.0.14334.21048 (Office LTSC 2021) and 16.0.17932.21140 (Office LTSC 2024), and points Microsoft 365 Apps customers to its Office security release notes for the fixed build on each update channel.

Chrome: Update and Relaunch, and Watch for the Edge Fix

Google's Stable Channel Update for Desktop, dated November 9, 2026, moves Chrome to 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. It includes nine security fixes, and Google states plainly: "Google is aware that an exploit for CVE-2026-125350 exists in the wild." The official CVE record describes that flaw as a use after free in XML that "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." In practical terms, visiting a malicious web page in an unpatched browser is the exposure.

Google says the update "will roll out over the coming days/weeks," so do not assume every computer already has it. Chrome also has to be relaunched before a downloaded update takes effect, and browsers that stay open for weeks are a common reason a fix that was delivered is not actually running.

CISA's catalog entry notes that the flaw "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." For Edge, Microsoft's security release notes carried this entry dated November 9, 2026, when we checked on November 11: "Microsoft is aware of the recent exploits existing in the wild. We are actively working on releasing a security fix." Until Microsoft lists an Edge Stable release that includes the fix, treat Edge on desktop as still waiting for it and check that page again.

Barracuda Appliances: Check the Patch and the Admin Interface

Barracuda's security advisory, published November 2, 2026, covers two flaws. CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway (ESG), which Barracuda scores 9.3. CVE-2026-111560 is a command injection flaw, scored 8.6, in the ESG and five other products: Load Balancer Application Delivery Controller, Message Archiver, WAF Control Center, Web Application Firewall, and Web Security Gateway. Barracuda warns that "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device."

On November 9, Barracuda updated the advisory to say it has "identified exploitation activity affecting a small number of organizations." It also clarified that authentication is not required to exploit CVE-2026-116606, but that "exploitation requires the administrative user interface (Admin UI) to be accessible to the attacker." That is the key question for any business with one of these appliances: can the administrative interface be reached from the internet? Barracuda says organizations whose administrative interfaces are not publicly accessible "are less exposed to this attack path."

Barracuda has released patches for every affected product and lists the patch identifiers in the advisory. It cautions that "if a patch has not been automatically applied, customers should manually apply the appropriate patch as soon as possible," and that a device several firmware versions behind may need more than one update.

What to Do This Week

Update Office on every Windows computer. In any Office app, open File, then Account (Office Account in Outlook), then Update Options, and choose Update Now. If your updates are managed centrally, ask for confirmation that the November 10 security release has reached every device, including laptops that are rarely in the office.
Remind staff not to open attached message files or other Office attachments they were not expecting, even when the sender looks familiar. With this flaw, opening the file is the step the attacker needs.
Update Chrome and relaunch it. In Chrome, open Help, then About Google Chrome, and confirm the version is 157.0.8103.50 or later. In Edge, open Settings, then About Microsoft Edge, install whatever update is offered, and check again as Microsoft's fix is released.
If you have a Barracuda appliance from the list above, confirm it is on the latest firmware with the patch named in Barracuda's advisory, and confirm the administrative interface is reachable only from trusted internal networks. If the interface was exposed to the internet before patching, ask your IT provider or Barracuda Support to review the device rather than assuming the patch alone settles it.
If you are not sure whether you have one of these appliances, check with whoever manages your email filtering. A device installed years ago by a previous provider is easy to overlook.

What to Watch Next

CISA set remediation dates of November 13, 2026 for the two Barracuda flaws and November 24, 2026 for the Outlook and Chrome flaws. Those dates bind U.S. federal civilian agencies, not private businesses, but they are a reasonable benchmark for how quickly CISA expects these to be handled. Watch Microsoft's Edge release notes for the desktop fix, and Barracuda's advisory for further updates on the exploitation it has observed.

Cyber One Solutions deploys operating system, Office, and browser updates and reports on patch status for clients through our managed IT service, and our managed cybersecurity service tracks vendor advisories like these against the systems a client actually runs. If you are not sure whether these updates have reached every device in your business, contact us and we can help you check.